Network Traffic to Rare Destination Country
editNetwork Traffic to Rare Destination Country
editA machine learning job detected a rare destination country name in the network logs. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, when a user clicks on a link in a phishing email or opens a malicious document, a request may be sent to download and run a payload from a server in a country which does not normally appear in network traffic or business work-flows. Malware instances and persistence mechanisms may communicate with command-and-control (C2) infrastructure in their country of origin, which may be an unusual destination country for the source network.
Rule type: machine_learning
Machine learning job: rare_destination_country
Machine learning anomaly threshold: 75
Severity: low
Risk score: 21
Runs every: 15 minutes
Searches indices from: now-30m (Date Math format, see also Additional look-back time)
Maximum alerts per execution: 100
References:
Tags:
- Elastic
- Network
- Threat Detection
- ML
Version: 2 (version history)
Added (Elastic Stack release): 7.13.0
Last modified (Elastic Stack release): 7.14.0
Rule authors: Elastic
Rule license: Elastic License v2
Potential false positives
editBusiness workflows that occur very occasionally, and involve a business relationship with an organization in a country that does not routinely appear in network events, can trigger this alert. A new business workflow with an organization in a country with which no workflows previously existed may trigger this alert - although the model will learn that the new destination country is no longer anomalous as the activity becomes ongoing. Business travelers who roam to many countries for brief periods may trigger this alert.
Rule version history
edit- Version 2 (7.14.0 release)
-
- Formatting only