Sunturai
Back to results
InformationalSplunk security contentTeoderick Contreras +1

Windows Process Outbound Connection To Social Media Domain

This analytic detects outbound network connections from a Python process running from suspicious or non-standard directories to social media related domains. It leverages Sysmon Event ID 3 to surface this anomalous…

Description

This analytic detects outbound network connections from a Python process running from suspicious or non-standard directories to social media related domains. It leverages Sysmon Event ID 3 to surface this anomalous behavior. Legitimate Python applications rarely originate from paths such as "C:\Users\Public\", Windows font or debug folders, or the Recycle Bin, making direct outbound calls to social media infrastructure from these locations a strong indicator of compromise. For example the Braodo Stealer, a Python-based credential-harvesting malware, abuses authenticated browser sessions to query the Meta Graph API and enumerate the victim's Facebook and Meta advertising infrastructure.

Detection logic

Detection requirements

Platform
PRE

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
sysmon_eventid_3

Known benign triggers

  • No false positives have been identified at this time.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice