diff --git a/Solutions/Network Session Essentials/Analytic Rules/PossibleBeaconingActivity.yaml b/Solutions/Network Session Essentials/Analytic Rules/PossibleBeaconingActivity.yaml index eeeb7e1f670..21c00f47f47 100644 --- a/Solutions/Network Session Essentials/Analytic Rules/PossibleBeaconingActivity.yaml +++ b/Solutions/Network Session Essentials/Analytic Rules/PossibleBeaconingActivity.yaml @@ -1,7 +1,7 @@ id: fcb9d75c-c3c1-4910-8697-f136bfef2363 name: Potential beaconing activity (ASIM Network Session schema) description: | - This rule identifies beaconing patterns from Network traffic logs based on recurrent frequency patterns. Such potential outbound beaconing patterns to untrusted public networks should be investigated for any malware callbacks or data exfiltration attempts as discussed in this [Blog](http://www.austintaylor.io/detect/beaconing/intrusion/detection/system/command/control/flare/elastic/stack/2017/06/10/detect-beaconing-with-flare-elasticsearch-and-intrusion-detection-systems/).\

+ This rule identifies beaconing patterns from Network traffic logs based on recurrent frequency patterns. Such potential outbound beaconing patterns to untrusted public networks should be investigated for any malware callbacks or data exfiltration attempts as discussed in this [Blog](https://medium.com/@HuntOperator/detect-beaconing-with-flare-elastic-stack-and-intrusion-detection-systems-110dc74e0c56).\

This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM NetworkSession schema' severity: Low status: Available