Network endpoint to host executable correlation

Correlates blocked URLs hosting [malicious] executables with host endpoint data to identify potential instances of executables of the same name having been recently run.

Detection logic

Detection requirements

Platform: Containers IaaS Linux macOS Windows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
Log source product: securityevents trendmicro windowsforwardedevents windowssecurityevents
Log source service: commonsecuritylog securityevent securityevents windowsevent

Detection rules

Network endpoint to host executable correlation

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules