Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Unusual Linux Network Activity

Identifies Linux processes that do not usually use the network but have unexpected network activity, which can indicate command-and-control, lateral movement, persistence, or data exfiltration activity. A process with unusual network activity can denote process exploitation or injection, where the process is used to run persistence mechanisms that allow a malicious actor remote access or control of the host, data exfiltration, and execution of unauthorized network applications.

ATT&CK coverage

Outside the enterprise matrix

What the source says

References

https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html

Tagged by the source as

Data Source: Elastic DefendData Source: Network Packet CaptureDomain: EndpointOS: LinuxResources: Investigation GuideRule Type: Machine LearningRule Type: MLUse Case: Threat Detection

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.