Possible FIN7 DGA Command and Control Behavior

 1[metadata]
 2creation_date = "2020/07/06"
 3integration = ["network_traffic", "panw"]
 4maturity = "production"
 5updated_date = "2026/07/16"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10This rule detects a known command and control pattern in network events. The FIN7 threat group is known to use this
11command and control technique, while maintaining persistence in their target's network.
12"""
13false_positives = [
14    """
15    This rule could identify benign domains that are formatted similarly to FIN7's command and control algorithm. Alerts
16    should be investigated by an analyst to assess the validity of the individual observations.
17    """,
18]
19from = "now-9m"
20language = "esql"
21license = "Elastic License v2"
22name = "Possible FIN7 DGA Command and Control Behavior"
23note = """## Triage and analysis
24
25In the event this rule identifies benign domains in your environment, the `destination.domain` exclusion in the rule can be modified to include those domains. Example: `... | where destination.domain not in ("zoom.us", "benign.domain1", "benign.domain2")`."""
26references = [
27    "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html",
28]
29risk_score = 73
30rule_id = "4a4e23cf-78a2-449c-bac3-701924c269d3"
31severity = "high"
32tags = [
33    "Use Case: Threat Detection",
34    "Tactic: Command and Control",
35    "Domain: Endpoint",
36    "Data Source: PAN-OS",
37    "Resources: Investigation Guide",
38]
39timestamp_override = "event.ingested"
40type = "esql"
41
42query = '''
43from packetbeat-*, filebeat-*, logs-network_traffic.*, logs-panw.panos* metadata _id, _version, _index
44| where (
45    data_stream.dataset in ("network_traffic.tls", "network_traffic.http") or
46    (event.category in ("network", "network_traffic") and network.protocol in ("tls", "http") and network.transport == "tcp")
47  )
48| where destination.domain RLIKE "[a-zA-Z]{4,5}\\.(pw|us|club|info|site|top)"
49| where destination.domain != "zoom.us"
50| keep @timestamp, destination.domain, source.ip, destination.ip, network.protocol, network.transport, data_stream.dataset, _id, _version, _index
51'''
52
53
54[[rule.threat]]
55framework = "MITRE ATT&CK"
56[[rule.threat.technique]]
57id = "T1071"
58name = "Application Layer Protocol"
59reference = "https://attack.mitre.org/techniques/T1071/"
60[[rule.threat.technique.subtechnique]]
61id = "T1071.001"
62name = "Web Protocols"
63reference = "https://attack.mitre.org/techniques/T1071/001/"
64
65
66[[rule.threat.technique]]
67id = "T1568"
68name = "Dynamic Resolution"
69reference = "https://attack.mitre.org/techniques/T1568/"
70[[rule.threat.technique.subtechnique]]
71id = "T1568.002"
72name = "Domain Generation Algorithms"
73reference = "https://attack.mitre.org/techniques/T1568/002/"
74
75
76
77[rule.threat.tactic]
78id = "TA0011"
79name = "Command and Control"
80reference = "https://attack.mitre.org/tactics/TA0011/"