ML Rules

Download 156
Last updated Dec 28, 2024

ml-beaconing-connections

Detect beaconing connections by analyzing session patterns.

Syntax

ml-beaconing-connections [schema=Schema] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss] [duration=NUM{mon|w|d|h|m|s}] [threshold=Threshold]

Options

schema=Schema
Optional. Schema name (default: session)
from=yyyyMMddHHmmss
Optional. Start time (yyyyMMddHHmmss)
to=yyyyMMddHHmmss
Optional. End time (yyyyMMddHHmmss)
duration=NUM{mon|w|d|h|m|s}
Optional. Time duration (e.g., 1d, 1h)
threshold=Threshold
Optional. Average interval threshold in seconds (default: 600)

Output Fields

FieldTypeNameDescription
_tableStringTableTable name. e.g. pfsession
src_ipIP addressSource IPSource IP address. e.g. 192.168.0.1
dst_ipIP addressDestination IPDestination IP address. e.g. 8.8.8.8
dst_portIntegerDestination portDestination port number. e.g. 443
protocolStringProtocolProtocol. e.g. TCP, UDP, ICMP
appStringApplicationApplication name. e.g. ssl, ms-netlogon, incomplete
countIntegerCountNumber of sessions. e.g. 10
stddevDoubleStandard deviationStandard deviation of intervals. e.g. 5.2
avgDoubleAverage intervalAverage interval between sessions in seconds. e.g. 600.5
sent_bytesLongSent bytesTotal bytes sent. e.g. 1024000
rcvd_bytesLongReceived bytesTotal bytes received. e.g. 2048000
first_seenDateFirst seenFirst session time. e.g. 2025-01-01 00:00:00
last_seenDateLast seenLast session time. e.g. 2025-01-01 01:00:00