linux:sysmon 3
Network connection
- Log source
- Sysmon for Linux
- Host type
- Linux
- Tier, host type
- Minimum
- Techniques
- 2
- Rules depending on it
- Splunk 1, Sigma 5
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Linux server | Minimum | |
| Linux web server, internet-facing | Minimum |
Techniques it helps detect
Rules that depend on it
Splunk 1
Sigma 5
- Communication To LocaltoNet Tunneling Service Initiated - Linux by Andreas Braathen (mnemonic.io)
- Communication To Ngrok Tunneling Service - Linux by Florian Roth (Nextron Systems)
- Linux Crypto Mining Pool Connections by Florian Roth (Nextron Systems)
- Linux Reverse Shell Indicator by Florian Roth (Nextron Systems)
- Potentially Suspicious Malware Callback Communication - Linux by hasselj
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Network source and destinationAppendix B item 5(2) | Supports an activity | our analysis |
EDR events that stand in for it
Full: the sensor event carries what this event carries. Partial: the sensor reports a subset, so it does not replace the event.
| Product | Sensor event | Fidelity | Basis |
|---|---|---|---|
| CrowdStrike Falcon sensor telemetry (FDR event_simpleName) | NetworkConnectIP4 | Full | pySigma-backend-crowdstrike: network_connection |
| CrowdStrike Falcon sensor telemetry (FDR event_simpleName) | NetworkConnectIP6 | Full | pySigma-backend-crowdstrike: network_connection |
| Microsoft Defender for Endpoint device tables | DeviceNetworkEvents | Full | Defender for Endpoint on Linux populates DeviceNetworkEvents |
| Elastic Defend endpoint events | network | Full | Elastic Defend for Linux network dataset |