HTTP with suspicious characteristics

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	2 Hours
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: Palo Alto Networks Firewall EAL Logs OR XDR Agent
ATT&CK Tactic	Command and Control (TA0011), Exfiltration (TA0010)
ATT&CK Technique	Web Service (T1102), Exfiltration Over Web Service (T1567)
Severity	Low

Description

Uncommon HTTP communication was performed by the host that might indicate its attempt to hide malicious activities.

Attacker's Goals

Data exfiltration, attack tool staging or command and control channel through a trusted service.

Investigative actions

• Examine the legitimacy of the application that produced this uncommon connection.
• Examine the parent process of this application.
• Check for anomalies at the time when the communication occurred.

Variations

HTTP with suspicious characteristics which is repetitive

Synopsis

Field	Value
ATT&CK Tactic	Command and Control (TA0011), Exfiltration (TA0010)
ATT&CK Technique	Web Service (T1102), Exfiltration Over Web Service (T1567)
Severity	Low

Description

Repetitevne HTTP communication was performed by the host that might indicate its attempt to hide malicious activities.

Attacker's Goals

Data exfiltration, attack tool staging or command and control channel through a trusted service.

Investigative actions

• Examine the legitimacy of the application that produced this uncommon connection.
• Examine the parent process of this application.
• Check for anomalies at the time when the communication occurred.

HTTP with suspicious characteristics to an IP address

Synopsis

Field	Value
ATT&CK Tactic	Command and Control (TA0011), Exfiltration (TA0010)
ATT&CK Technique	Web Service (T1102), Exfiltration Over Web Service (T1567)
Severity	Low

Description

Uncommon HTTP communication to IP address was performed by the host that might indicate its attempt to hide malicious activities.

Attacker's Goals

Data exfiltration, attack tool staging or command and control channel through a trusted service.

Investigative actions

• Examine the legitimacy of the application that produced this uncommon connection.
• Examine the parent process of this application.
• Check for anomalies at the time when the communication occurred.

HTTP with suspicious characteristics that always fails

Synopsis

Field	Value
ATT&CK Tactic	Command and Control (TA0011), Exfiltration (TA0010)
ATT&CK Technique	Web Service (T1102), Exfiltration Over Web Service (T1567)
Severity	Informational

Description

Unsuccessful HTTP communication to IP address was performed by the host that might indicate its attempt to hide malicious activities.

Attacker's Goals

Data exfiltration, attack tool staging or command and control channel through a trusted service.

Investigative actions

• Examine the legitimacy of the application that produced this uncommon connection.
• Examine the parent process of this application.
• Check for anomalies at the time when the communication occurred.