HoneyLabs high-confidence indicator seen for the first time
Surfaces hosts that contacted a HoneyLabs indicator backed by heavy evidence (Confidence 80 or above, meaning ten or more observed attacks) where that IP has not been seen in your logs in the preceding 14 days. First…
Description
Surfaces hosts that contacted a HoneyLabs indicator backed by heavy evidence (Confidence 80 or above, meaning ten or more observed attacks) where that IP has not been seen in your logs in the preceding 14 days. First contact with a well-evidenced attacker is a stronger hunting lead than repeat background noise.
Detection logic
Detection requirements
- Platform
- ContainersESXiIaaSLinuxmacOSNetwork DevicesWindows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
- Log source product
- threatintelligencetaxii
- Log source service
- threatintelligenceindicator
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
No references are available for this detection.
From the source
- At source
- Open at source
- Upstream identifier
- 9f1c2a44-7d18-4f5b-9c33-2a6e5b8d1c07
- Tagged by the source as
- InitialAccess
Licence
- Published under
- MIT LicenseRead the licence
- Attribution
- Required
- Obtained under
- MITRead the origin licence
Authorship
- Published
- Sep 1, 2026
- Version
- 1