endpoint.events[.]networkDomain
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 3 years ago
What the reports say
2 reports, newest first · the exact sentence from each-
An Elastic approach to large-scale dynamic malware analysis“This can be seen by adding the source.port to the packetbeat fingerprint calculation, resulting in the endpoint.events[.]network and all network_traffic-* datasets to increase drastically.”
-
Twice around the dance floor - Elastic discovers the PIPEDANCE backdoor“…s.name:("makecab.exe" or "typeperf.exe" or "w32tm.exe" or "bootcfg.exe" or "diskperf.exe" or "esentutl.exe") and event.dataset: endpoint.events[.]network”
Indicators reported together
named in the same reports- 9d3f739e35182992…e63eddc5a1e7in 1 report
- 805a4250ec1f6b99…7aaf6e1e6ce7in 1 report
- exl.officeappsreviews[.]comin 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.