DocsAttack Types

Malware & Command-and-Control

Communication matching known command-and-control or botnet behaviour.

A VM talks to known command-and-control servers, the machines that direct botnets and malware. It usually means the VM is compromised. Frabs matches destinations against threat-intelligence lists and can block the destination at once.

Detectors (15)

Detector	Measures	Warning	Incident	Critical
Known C2 Communication	Contacts with addresses on threat-intelligence lists (contacts)	1 in 10 min	10 in 1 h	100 in 1 h
Known Malicious Destination	Contacts with addresses on threat-intelligence lists (contacts)	1 in 10 min	10 in 1 h	100 in 1 h
Botnet Communication	Contacts with addresses on threat-intelligence lists (contacts)	1 in 10 min	10 in 1 h	100 in 1 h
Botnet Beaconing	Regularity of repeated connections (0-100) (score)	50 in 10 min	70 in 30 min	90 in 1 h
Malware Beaconing	Regularity of repeated connections (0-100) (score)	50 in 10 min	70 in 30 min	90 in 1 h
Periodic Beaconing	Regularity of repeated connections (0-100) (score)	50 in 10 min	70 in 30 min	90 in 1 h
HTTP C2	Contacts with addresses on threat-intelligence lists (contacts)	1 in 10 min	10 in 1 h	100 in 1 h
HTTPS C2	Contacts with addresses on threat-intelligence lists (contacts)	1 in 10 min	10 in 1 h	100 in 1 h
DNS C2	Tunnelling indicators (0-100) (score)	50 in 10 min	70 in 30 min	90 in 1 h
IRC C2	Contacts with addresses on threat-intelligence lists (contacts)	1 in 10 min	10 in 1 h	100 in 1 h
Custom Protocol C2	Regularity of repeated connections (0-100) (score)	50 in 10 min	70 in 30 min	90 in 1 h
Encrypted C2	Regularity of repeated connections (0-100) (score)	50 in 10 min	70 in 30 min	90 in 1 h
Domain Generation Activity	Average entropy of queried names (bits)	3.5 in 5 min	4 in 10 min	4.5 in 30 min
Remote Access Trojan Traffic	Contacts with addresses on threat-intelligence lists (contacts)	1 in 10 min	10 in 1 h	100 in 1 h
Backdoor Communication	Contacts with addresses on threat-intelligence lists (contacts)	1 in 10 min	10 in 1 h	100 in 1 h

Change the thresholds

Use Custom Protection to change any of these, or set them for one VM. See Detectors and Thresholds.

PreviousBrute Force & Credential Attacks NextMalicious Payload Distribution