« Appendix ^: Downloadable rule update v8.19.11 SOCKS Traffic from an Unusual Process »
Elastic Docs ›Elastic Security [8.19] ›Downloadable rule update v8.19.11

PANW and Elastic Defend - Command and Control Correlation

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

PANW and Elastic Defend - Command and Control Correlation

edit

This detection correlates Palo Alto Networks (PANW) command and control events with Elastic Defend network events to identify the source process performing the network activity.

Rule type: eql

Rule indices:

  • logs-endpoint.events.network-*
  • logs-panw.panos-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Endpoint
  • OS: Linux
  • OS: Windows
  • OS: macOS
  • Use Case: Threat Detection
  • Tactic: Command and Control
  • Data Source: Elastic Defend
  • Data Source: PAN-OS
  • Resources: Investigation Guide

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating PANW and Elastic Defend - Command and Control Correlation

Possible investigation steps

  • Investigate in the Timeline feature the two events matching this correlation (PANW and Elastic Defend).
  • Review the process details like command_line, privileges, global relevance and reputation.
  • Assess the destination.ip reputation and global relevance.
  • Review the parent process execution details like command_line, global relevance and reputation.
  • Examine all network connection details performed by the process during last 48h.
  • Correlate the alert with other security events or logs to identify any patterns or additional indicators of compromise related to the same process or network activity.

False positive analysis

  • Trusted system or third party processes performing network activity that looks like beaconing.

Response and remediation

  • Immediately isolate the affected system from the network to prevent further unauthorized access or data exfiltration.
  • Terminate the suspicious processes and all associated children and parents.
  • Implement network-level controls to block traffic to the destination.ip.
  • Conduct a thorough review of the system’s configuration files to identify unauthorized changes.
  • Reset credentials for any accounts associated with the source machine.
  • Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.

Rule query

edit
sequence by source.port, source.ip, destination.ip with maxspan=1m
 [network where event.module == "panw" and event.action == "c2_communication"]
 [network where event.module == "endpoint" and event.action in ("disconnect_received", "connection_attempted")]

Framework: MITRE ATT&CKTM

« Appendix ^: Downloadable rule update v8.19.11 SOCKS Traffic from an Unusual Process »