edr:elastic-defend network
network
Stands in for win:sysmon 3 (full), linux:sysmon 3 (full)
- Log source
- Elastic Defend endpoint events
- Host type
- EDR sensors (product telemetry, cross-platform)
- How to enable
- Elastic Agent with the Elastic Defend integration; datasets logs-endpoint.events.*.
- Tier, host type
- Minimum
- Techniques
- 0
- Rules depending on it
- Elastic 121
Why this tier
ATT&CK via equivalence to win:sysmon 3; ATT&CK via equivalence to linux:sysmon 3
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstationEDR path | Minimum | |
| Windows member serverEDR path | Minimum | |
| Windows domain controllerEDR path | Minimum | |
| Windows web server (IIS), internet-facingEDR path | Minimum | |
| Linux serverEDR path | Minimum | |
| Linux web server, internet-facingEDR path | Minimum | |
| macOS endpointEDR path | Minimum |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
Elastic 121
- AWS Control Plane Access by Suspicious Process
- Active Directory Forced Authentication from Linux Host - SMB Named Pipes
- Apple Script Execution followed by Network Connection
- Azure WireServer Unusual Process Connection
- Connection to Common Large Language Model Endpoints
- Connection to Commonly Abused Free SSL Certificate Providers
- Connection to Commonly Abused Web Services
- Connection to External Network via Telnet
- Connection to Internal Network via Telnet
- Curl or Wget Egress Network Connection via LoLBin
- DNS Request for IP Lookup Service via Unsigned Binary
- DNS to Commonly Abused Web Services
- Egress Connection from Entrypoint in Container
- Elastic Defend Alert Followed by Telemetry Loss
- Executable File Download via Wget
- Execution from a Removable Media with Network Connection
- Execution via Microsoft DotNet ClickOnce Host
- External IP Lookup from Non-Browser Process
- First Time Seen DNS Query to RMM Domain
- FortiGate SOCKS Traffic from an Unusual Process
- GenAI Process Connection to Suspicious Top Level Domain
- GenAI Process Connection to Unusual Domain
- GenAI Process Performing Encoding/Chunking Prior to Network Activity
- Git Hook Egress Network Connection
- Google Calendar C2 via Script Interpreter
- High Number of Egress Network Connections from Unusual Executable
- Incoming DCOM Lateral Movement via MSHTA
- Incoming DCOM Lateral Movement with MMC
- Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows
- Incoming Execution via PowerShell Remoting
- Incoming Execution via WinRM Remote Shell
- Initial Access via File Upload Followed by GET Request
- InstallUtil Process Making Network Connections
- Java Dropped and Executed With DNS Lookup
- Kerberos Traffic from Unusual Process
- Kubelet API Connection Attempt to Internal IP
- MsBuild Making Network Connections
- Mshta Making Network Connections
- MsiExec Service Child Process With Network Connection
- Network Activity Detected via Kworker
- Network Activity Detected via cat
- Network Activity to a Suspicious Top Level Domain
- Network Connection Followed by File Creation
- Network Connection Initiated by Suspicious SSHD Child Process
- Network Connection by Cups or Foomatic-rip Child
- Network Connection from Binary with RWX Memory Region
- Network Connection to OAST Domain via Script Interpreter
- Network Connection via Certutil
- Network Connection via Compiled HTML File
- Network Connection via MsXsl
- Network Connection via Recently Compiled Executable
- Network Connection via Registration Utility
- Network Connection via Signed Binary
- Network Connections Initiated Through XDG Autostart Entry
- Ollama API Accessed from External Network
- Ollama DNS Query to Untrusted Domain
- Outbound Scheduled Task Activity via PowerShell
- PANW and Elastic Defend - Command and Control Correlation
- Package Runtime Secret File Access Followed by IMDS Request
- Payload Downloaded by Interpreter and Piped to Interpreter
- Perl Outbound Network Connection
- Potential Command and Control via Internet Explorer
- Potential DNS Exfiltration via Excessive Chunked Queries
- Potential Enumeration via Active Directory Web Service
- Potential Etherhiding C2 via Blockchain Connection
- Potential Execution via SSH Backdoor
- Potential Java Service Exploitation via Suspicious Child Process
- Potential Kerberos SPN Spoofing via Suspicious DNS Query
- Potential Lateral Tool Transfer via SMB Share
- Potential Malware-Driven SSH Brute Force Attempt
- Potential Outgoing RDP Connection by Unusual Process
- Potential Port Scanning Activity from Compromised Host
- Potential Protocol Tunneling via Chisel Client
- Potential Remote File Execution via MSIEXEC
- Potential Reverse Shell
- Potential Reverse Shell via Child
- Potential Reverse Shell via Java
- Potential Reverse Shell via Suspicious Binary
- Potential Reverse Shell via Suspicious Child Process
- Potential SharpRDP Behavior
- Potential Subnet Scanning Activity from Compromised Host
- Potential Tunneling via AWS IoT Secure Tunneling Localproxy
- Potential Webshell Deployed via Apache Struts CVE-2023-50164 Exploitation
- Potential Windows Error Manager Masquerading
- PsExec Network Connection
- Rare SMB Connection to the Internet
- Remote File Download via PowerShell
- Remote File Download via Script Interpreter
- Remote Scheduled Task Creation
- Remotely Started Services via RPC
- Root Network Connection via GDB CAP_SYS_PTRACE
- SMB Connections via LOLBin or Untrusted Process
- Script Interpreter Connection to Non-Standard Port
- Service Command Lateral Movement
- Simple HTTP Web Server Connection
- Splunk Enterprise PostgreSQL Recovery Endpoint Injection Artifacts
- Suricata and Elastic Defend Network Correlation
- Suspicious APT Package Manager Network Connection
- Suspicious AWS S3 Connection via Script Interpreter
- Suspicious Automator Workflows Execution
- Suspicious Command Prompt Network Connection
- Suspicious Curl to Google App Script Endpoint
- Suspicious Installer Package Spawns Network Event
- Suspicious Instance Metadata Service (IMDS) API Request
- Suspicious Kerberos Authentication Ticket Request
- Suspicious Linux Process Connection to AWS IoT Core MQTT
- Suspicious Linux Process Connection to Bulletproof Hosting ASN
- Suspicious Network Activity to the Internet by Previously Unknown Executable
- Suspicious Network Connection via systemd
- Suspicious Outbound Network Connection via Unsigned Binary
- System Public IP Discovery via DNS Query
- Uncommon DNS Request via Bun or Node.js
- Unusual DNS Request to Suspicious Top Level Domain
- Unusual Network Activity from a Windows System Binary
- Unusual Network Connection to Suspicious Top Level Domain
- Unusual Network Connection to Suspicious Web Service
- Unusual Network Connection via DllHost
- Unusual Network Connection via RunDLL32
- Unusual Process Network Connection
- Unusual Process Resolving AWS ECS Agent Communication Service Endpoint
- WMI Incoming Lateral Movement