Breadcrumbs

CNC Callback and Suspicious Connection Log Message (Part-1)

Vendor Documentation

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field

LogRhythm Default

LogRhythm Default v2.0

N/A

<severity>

<severity>

Header (logVer)

N/A

N/A

Header (vendor)

N/A

N/A

Header (pname)

N/A

N/A

Header (pver)

<version>

N/A

Header (eventid)

<vendorinfo>

N/A

Header (eventName)

<threatname>

<vmid>

Header (severity)

<severity>

N/A

deviceExternalId

N/A

N/A

rt

N/A

N/A

cat

<processid>

N/A

deviceFacility

N/A

N/A

cs2Label

<threatname>

N/A

cs2

<cve>

N/A

shost

<sname>

N/A

src

<sip>

<sip>

spt

<sport>

N/A

c6a2Label

N/A

N/A

c6a2

N/A

<sip>

cs3Label

N/A

N/A

cs3

N/A

<domainorigin>

cs4Label

N/A

N/A

cs4

N/A

<policy>

act

<action>

<action>
<tag1>

cn1Label

<policy>

N/A

cn1

N/A

<severity>

cn2Label

N/A

N/A

cn2

N/A

N/A

cn3Label

N/A

N/A

cn3

N/A

N/A

request

N/A

<url>

deviceCustomDate1Label

N/A

N/A

deviceCustomDate1

N/A

N/A

deviceCustomDate2Label

N/A

N/A

deviceCustomDate2

N/A

N/A

cs5Label

N/A

N/A

cs5

N/A

N/A

dst

<dip>

<dip>

dpt

<dport>

N/A

c6a3Label

N/A

N/A

c6a3

N/A

<dip>

deviceProcessName

N/A

<process>

deviceNtDomain

<domainorigin>

N/A

dntdom

N/A

N/A

dvchost

<dname>

N/A

TMCMLogDetectedHost

N/A

<dname>

TMCMLogDetectedIP

N/A

<dip>

ApexCentralHost

N/A

N/A

devicePayloadId

N/A

N/A

reason

<reason>

N/A

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID

Rule Name

Rule Type

Classification

Common Event

1011519

CNC Callback and Suspicious Connection Log Message

Base Rule

Suspicious

Suspicious Activity

LogRhythm Default v2.0

Regex ID

Rule Name

Rule Type

Classification

Common Event

1012135

V 2.0 : C&C Callback Event

Base Rule

Activity

General Threat Message

V 2.0 : C&C Callback : Unknown

Sub Rule

Activity

General Threat Message

V 2.0 : C&C Callback : Pass

Sub Rule

Malware

Detected Malware Activity

V 2.0 : C&C Callback : Block

Sub Rule

Failed Activity

Threat Blocked

V 2.0 : C&C Callback : Monitor

Sub Rule

Malware

Detected Malware Activity

V 2.0 : C&C Callback : Delete

Sub Rule

Failed Activity

Threat Deleted

V 2.0 : C&C Callback : Quarantine

Sub Rule

Activity

Quarantine

V 2.0 : C&C Callback : Warn

Sub Rule

Malware

Detected Malware Activity

V 2.0 : C&C Callback : Warn & Continue

Sub Rule

Malware

Detected Malware Activity

V 2.0 : C&C Callback : Override

Sub Rule

Malware

Detected Malware Activity