Interpreter Contacting Multiple Unique Domains
Detects a host initiating network connections to multiple unique domains within a short time frame using common tools and interpreters. This can be indicative of C2 channel rotation, or network enumeration. This rule is excluding certain cloud metadata services. This rule requires a correlation engine to aggregate events over time.
Sigma
