Identifying beaconing malware using Elastic — Elastic Security Labs
Tags
cmtmf-attack-pattern: Supply Chain Compromise
attack-pattern: Data Datasets Cloud Services - T1021.007 Dns - T1071.004 Dns - T1590.002 Malware - T1587.001 Malware - T1588.001 Rundll32 - T1218.011 Software - T1592.002 Ssh - T1021.004 Supply Chain Compromise - T1474 Rundll32 - T1085 Supply Chain Compromise - T1195 Supply Chain Compromise
Show in Graph
Common Information
Type Value
UUID 21106a06-df73-4821-ad78-5020c076906b
Fingerprint a0cc119561350cd6
Analysis status DONE
Considered CTI value 0
Text language
Published March 1, 2023, midnight
Added to db Nov. 19, 2023, 6:18 a.m.
Last updated Nov. 18, 2024, 9:32 a.m.
Headline Identifying beaconing malware using Elastic
Title Identifying beaconing malware using Elastic — Elastic Security Labs
Detected Hints/Tags/Attributes 55/2/3
Source URLs
Redirection Url
Details Source https://www.elastic.co/security-labs/identifying-beaconing-malware-using-elastic
URL Provider
Details Provider Source level domain
Details elastic.co www.elastic.co
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 306 ✔ Elastic Security Labs https://www.elastic.co/security-labs/rss/feed.xml 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details File 1019 
rundll32.exe
Details IPv4 5 
192.99.221.77
Details IPv4 6 
83.171.237.173