SID 1:63072

Rule Groups

Rule Categories::Malware::Other

Rules for detecting miscellaneous malware traffic

MITRE::ATT&CK Framework::Enterprise::Command and Control::Application Layer Protocol

Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

T1071

MITRE::ATT&CK Framework::Enterprise::Initial Access::Phishing

Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.

T1566