Unusual Network Connection to Suspicious Web Service

  1[metadata]
  2creation_date = "2025/03/26"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10This rule monitors for the unusual occurrence of outbound network connections to suspicious webservice domains. 
 11"""
 12from = "now-9m"
 13index = ["logs-endpoint.events.network-*"]
 14language = "kuery"
 15license = "Elastic License v2"
 16name = "Unusual Network Connection to Suspicious Web Service"
 17note = """ ## Triage and analysis
 18
 19> **Disclaimer**:
 20> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 21
 22### Investigating Unusual Network Connection to Suspicious Web Service
 23
 24In macOS environments, network connections to web services are routine for data sharing and collaboration. However, adversaries exploit these services for command and control by disguising malicious traffic as legitimate. The detection rule identifies unusual outbound connections to known suspicious domains, flagging potential misuse by monitoring specific domain patterns and connection events, thus aiding in early threat detection.
 25
 26### Possible investigation steps
 27
 28- Review the destination domain and process executable from the alert to determine if it matches any expected web service communication.
 29- Check the event.category and event.type fields to confirm the nature of the network connection and ensure it aligns with the expected behavior of a macOS system.
 30- Investigate the source host identified by host.os.type to gather information about its recent activities, installed applications, and any potential indicators of compromise.
 31- Analyze network traffic logs for the source host to identify any other unusual or suspicious outbound connections that may indicate a broader compromise.
 32- Correlate the alert with other security events or alerts from the same host or network segment to identify patterns or related incidents.
 33- Consult threat intelligence sources to gather additional context on the flagged domain and assess its reputation and history of malicious activity.
 34
 35### False positive analysis
 36
 37- Frequent access to legitimate cloud storage services like Google Drive or Dropbox for routine file sharing can trigger false positives. Users can create exceptions for specific domains or IP addresses known to be safe and frequently accessed by their organization.
 38- Automated backup services that use domains such as OneDrive or SharePoint may be flagged. To mitigate this, identify and whitelist the specific services or applications that are part of regular backup operations.
 39- Collaboration tools like Slack or Discord, used for legitimate communication, might be mistakenly flagged. Users should review and whitelist these domains if they are part of standard business operations.
 40- URL shorteners like bit.ly or tinyurl.com used in marketing or communication campaigns can cause false alerts. Establish a list of trusted shortener services and exclude them from monitoring if they are regularly used by the organization.
 41- Development and testing environments using services like ngrok or localtunnel for temporary public URLs can be misidentified. Ensure these environments are documented and excluded from the rule if they are part of normal development workflows.
 42
 43### Response and remediation
 44
 45- Immediately isolate the affected macOS device from the network to prevent further communication with the suspicious domains.
 46- Conduct a thorough review of the network logs to identify any data exfiltration attempts or additional suspicious connections originating from the isolated device.
 47- Remove any unauthorized or suspicious applications or scripts found on the device that may be facilitating the outbound connections.
 48- Update the device's security software and perform a full system scan to detect and remove any malware or unauthorized software.
 49- Reset credentials and review access permissions for the affected user accounts to prevent unauthorized access.
 50- Monitor the network for any further attempts to connect to the flagged domains and ensure that alerts are configured to notify security teams of any recurrence.
 51- Escalate the incident to the security operations center (SOC) or relevant cybersecurity team for further investigation and to determine if the threat is part of a larger attack campaign.
 52"""
 53references = [
 54"https://specterops.io/blog/2026/01/30/weaponizing-whitelists-an-azure-blob-storage-mythic-c2-profile/"
 55]
 56risk_score = 47
 57rule_id = "b07f0fba-0a78-11f0-8311-b66272739ecb"
 58severity = "medium"
 59tags = [
 60    "Domain: Endpoint",
 61    "OS: macOS",
 62    "Use Case: Threat Detection",
 63    "Tactic: Command and Control",
 64    "Data Source: Elastic Defend",
 65    "Resources: Investigation Guide",
 66    "Noise: Medium",
 67    "Performance: Normal",
 68    "Profile: Recommended",
 69    "Threat: Web Service Abuse",
 70    "Rule Type: New Terms",
 71    "Platform: macOS",
 72]
 73timestamp_override = "event.ingested"
 74type = "new_terms"
 75query = '''
 76event.category : "network" and host.os.type : "macos" and event.type : "start" and
 77destination.domain : (
 78    pastebin.* or
 79    paste.ee or
 80    ghostbin.com or
 81    drive.google.com or
 82    ?.docs.live.net or
 83    api.dropboxapi.* or
 84    content.dropboxapi.* or
 85    *dl.dropboxusercontent.* or
 86    api.onedrive.com or
 87    *.onedrive.org or
 88    onedrive.live.com or
 89    filebin.net or
 90    *.ngrok.io or
 91    ngrok.com or
 92    *.portmap.* or
 93    *serveo.net or
 94    *localtunnel.me or
 95    *pagekite.me or
 96    *localxpose.io or
 97    *notabug.org or
 98    rawcdn.githack.* or
 99    paste.nrecom.net or
100    zerobin.net or
101    controlc.com or
102    requestbin.net or
103    api.slack.com or
104    slack-redir.net or
105    slack-files.com or
106    cdn.discordapp.com or
107    discordapp.com or
108    discord.com or
109    apis.azureedge.net or
110    cdn.sql.gg or
111    ?.top4top.io or
112    top4top.io or
113    uplooder.net or
114    *.cdnmegafiles.com or
115    transfer.sh or
116    updates.peer2profit.com or
117    api.telegram.org or
118    t.me or
119    meacz.gq or
120    rwrd.org or
121    *.publicvm.com or
122    *.blogspot.com or
123    api.mylnikov.org or
124    script.google.com or
125    script.googleusercontent.com or
126    paste4btc.com or
127    workupload.com or
128    temp.sh or
129    filetransfer.io or
130    gofile.io or
131    store?.gofile.io or
132    tiny.one or
133    api.notion.com or
134    *.sharepoint.com or
135    *upload.ee or
136    bit.ly or
137    t.ly or
138    cutt.ly or
139    mbasic.facebook.com or
140    api.gofile.io or
141    file.io or
142    api.anonfiles.com or
143    api.trello.com or
144    gist.githubusercontent.com or
145    dpaste.com or
146    *azurewebsites.net or
147    *.zulipchat.com or
148    *.4shared.com or
149    filecloud.me or
150    i.ibb.co or
151    files.catbox.moe or
152    *.getmyip.com or
153    mockbin.org or
154    webhook.site or
155    run.mocky.io or
156    *infinityfreeapp.com or
157    free.keep.sh or
158    tinyurl.com or
159    ftpupload.net or
160    lobfile.com or
161    *.ngrok-free.app or
162    myexternalip.com or
163    yandex.ru or
164    *.yandex.ru or
165    *.aternos.me or
166    cdn??.space or
167    *.pcloud.com or
168    mediafire.zip or
169    urlz.fr or
170    rentry.co or
171    *.b-cdn.net or
172    pastecode.dev or
173    i.imgur.com or
174    the.earth.li or
175    *.trycloudflare.com or
176    *.blob.core.windows.net or
177    *.blob.storage.azure.net
178) and 
179not (destination.domain : (*.sharepoint.com or *.azurewebsites.net or "onedrive.live.com" or *.b-cdn.net or api.onedrive.com or "drive.google.com" or *.blogspot.com or *.blob.core.windows.net or *.blob.storage.azure.net) and process.code_signature.subject_name:(*Microsoft* or "Software Signing" or "Apple Mac OS Application Signing" or *VMware*) and process.code_signature.trusted:true) and 
180not (process.code_signature.subject_name:(*Mozilla* or *Google* or *Brave* or *Opera* or "Software Signing" or "macOS Software Signing" or *Zscaler* or *Browser*) and process.code_signature.trusted:true)  and 
181not (destination.domain :("discord.com" or cdn.discordapp.com or "content.dropboxapi.com" or "dl.dropboxusercontent.com") and process.code_signature.subject_name :(*Discord* or *Dropbox*) and process.code_signature.trusted:true)
182'''
183
184[[rule.threat]]
185framework = "MITRE ATT&CK"
186
187[[rule.threat.technique]]
188id = "T1071"
189name = "Application Layer Protocol"
190reference = "https://attack.mitre.org/techniques/T1071/"
191
192[[rule.threat.technique.subtechnique]]
193id = "T1071.001"
194name = "Web Protocols"
195reference = "https://attack.mitre.org/techniques/T1071/001/"
196
197[[rule.threat.technique]]
198id = "T1102"
199name = "Web Service"
200reference = "https://attack.mitre.org/techniques/T1102/"
201
202[rule.threat.tactic]
203id = "TA0011"
204name = "Command and Control"
205reference = "https://attack.mitre.org/tactics/TA0011/"
206
207[[rule.threat]]
208framework = "MITRE ATT&CK"
209
210[[rule.threat.technique]]
211id = "T1567"
212name = "Exfiltration Over Web Service"
213reference = "https://attack.mitre.org/techniques/T1567/"
214
215[[rule.threat.technique.subtechnique]]
216id = "T1567.002"
217name = "Exfiltration to Cloud Storage"
218reference = "https://attack.mitre.org/techniques/T1567/002/"
219
220[[rule.threat.technique.subtechnique]]
221id = "T1567.003"
222name = "Exfiltration to Text Storage Sites"
223reference = "https://attack.mitre.org/techniques/T1567/003/"
224
225[[rule.threat.technique.subtechnique]]
226id = "T1567.004"
227name = "Exfiltration Over Webhook"
228reference = "https://attack.mitre.org/techniques/T1567/004/"
229
230[rule.threat.tactic]
231id = "TA0010"
232name = "Exfiltration"
233reference = "https://attack.mitre.org/tactics/TA0010/"
234[rule.new_terms]
235field = "new_terms_fields"
236value = ["host.id", "process.executable", "destination.domain"]
237
238[[rule.new_terms.history_window_start]]
239field = "history_window_start"
240value = "now-7d"