Network utility executed with suspicious URI
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。
Goal
Detect HTTP requests with patterns that are unusual for a cloud workload.
Strategy
This rule generates a signal when a network utility such as curl or wget makes a request for a URI with an unusual pattern. The patterns used in this rule appeared in previous compromises of cloud resources. For example, it is unusual for a production workload to download a file with a .jpg extension. Threat actors have used this extension to evade detection.
Triage and response
- Determine the URL being requested using the process tree.
- Identify other compromised systems by searching logs for requests to this URI or domain.
- Attempt to contain the compromise (possibly by terminating the workload, depending on the stage of attack). Follow your organization’s internal processes for investigating and remediating compromised systems.
Requires Agent version 7.27 or greater.
