---
title: Suricata and Elastic Defend Network Correlation
description: This detection correlates Suricata alerts with Elastic Defend network events to identify the source process performing the network activity. Rule type:...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/cross-platform/command_and_control_suricata_elastic_defend_c2
products:
  - Elastic Security
---

# Suricata and Elastic Defend Network Correlation
This detection correlates Suricata alerts with Elastic Defend network events to identify the source process performing
the network activity.
**Rule type**: eql
**Rule indices**:
- logs-endpoint.events.network-*
- filebeat-*
- logs-suricata.*

**Rule Severity**: medium
**Risk Score**: 47
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://attack.mitre.org/tactics/TA0011/](https://attack.mitre.org/tactics/TA0011/)](https://attack.mitre.org/tactics/TA0011/)
- [[https://www.elastic.co/docs/reference/integrations/suricata](https://www.elastic.co/docs/reference/integrations/suricata)](https://www.elastic.co/docs/reference/integrations/suricata)
- [[https://www.elastic.co/docs/reference/integrations/endpoint](https://www.elastic.co/docs/reference/integrations/endpoint)](https://www.elastic.co/docs/reference/integrations/endpoint)

**Tags**:
- Domain: Endpoint
- Domain: Network
- OS: Linux
- OS: Windows
- OS: macOS
- Use Case: Threat Detection
- Tactic: Command and Control
- Data Source: Elastic Defend
- Data Source: Suricata
- Resources: Investigation Guide
- Noise: High
- Performance: Normal
- Profile: Aggressive
- Rule Type: Event Correlation (EQL)
- Platform: Windows
- Platform: Linux
- Platform: macOS

**Version**: 6
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Investigation guide


## Triage and analysis


### Investigating Suricata and Elastic Defend Network Correlation


### Possible investigation steps

- Investigate in the Timeline feature the two events matching this correlation (Suricata and Elastic Defend).
- Review the process details like command_line, privileges, global relevance and reputation.
- Assess the destination.ip reputation and global relevance.
- Review the parent process execution details like command_line, global relevance and reputation.
- Examine all network connection details performed by the process during last 48h.
- Correlate the alert with other security events or logs to identify any patterns or additional indicators of compromise related to the same process or network activity.


### False positive analysis

- Trusted system or third party processes performing network activity that looks like beaconing.


### Response and remediation

- Immediately isolate the affected system from the network to prevent further unauthorized access or data exfiltration.
- Terminate the suspicious processes and all associated children and parents.
- Implement network-level controls to block traffic to the destination.ip.
- Conduct a thorough review of the system's configuration files to identify unauthorized changes.
- Reset credentials for any accounts associated with the source machine.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.


## Rule Query

```eql
sequence by source.port, source.ip, destination.ip with maxspan=5s
 [network where data_stream.dataset == "suricata.eve" and event.kind == "alert" and
  event.severity != 3 and source.ip != null and destination.ip != null and
  not rule.name in ("ET INFO SMB2 NT Create AndX Request For a Powershell .ps1 File", "ET SCAN MS Terminal Server Traffic on Non-standard Port")]
 [network where event.module == "endpoint" and event.action in ("disconnect_received", "connection_attempted") and
  not process.executable in ("System", "C:\\Program Files (x86)\\Admin Arsenal\\PDQ Inventory\\PDQInventoryService.exe") and 
  not process.executable : "C:\\Windows\\AdminArsenal\\PDQInventory-Scanner\\service-*\\exec\\PDQInventoryScanner.exe"]
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Command and Control
  - Id: TA0011
  - Reference URL: [[https://attack.mitre.org/tactics/TA0011/](https://attack.mitre.org/tactics/TA0011/)](https://attack.mitre.org/tactics/TA0011/)
- Technique:
  - Name: Application Layer Protocol
  - Id: T1071
  - Reference URL: [[https://attack.mitre.org/techniques/T1071/](https://attack.mitre.org/techniques/T1071/)](https://attack.mitre.org/techniques/T1071/)
- Technique:
  - Name: Non-Standard Port
  - Id: T1571
  - Reference URL: [[https://attack.mitre.org/techniques/T1571/](https://attack.mitre.org/techniques/T1571/)](https://attack.mitre.org/techniques/T1571/)

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Discovery
  - Id: TA0007
  - Reference URL: [[https://attack.mitre.org/tactics/TA0007/](https://attack.mitre.org/tactics/TA0007/)](https://attack.mitre.org/tactics/TA0007/)
- Technique:
  - Name: Network Service Discovery
  - Id: T1046
  - Reference URL: [[https://attack.mitre.org/techniques/T1046/](https://attack.mitre.org/techniques/T1046/)](https://attack.mitre.org/techniques/T1046/)