Mythic C2 over SMB Detection
This rule detects potential Mythic C2 activity communicating over SMB. It identifies network traffic using the SMB protocol with a total upload size greater than 360 bytes, originating from and destined for private IP address ranges. The rule then groups these connections by agent hostname, local IP, remote IP, and process image name, flagging instances where three or more such connections occur within a 7-day timeframe, indicating potential beaconing behavior.
Cortex XDR
