Question

During a proactive hunt, a SecOps engineer suspects that an attacker has deployed a backdoor listener on a small number of Linux servers in a fleet of 4,000 hosts. The engineer wants to use a single UDM search to surface network listener events where the combination of listening port and process binary appears on very few distinct hosts across the last 30 days, while ignoring ports that are common across the fleet. Which UDM search approach best supports this hypothesis?

Accepted Answer

Group network listener events by target.port and principal.process.file.full_path, aggregate a distinct count of principal.hostname, and return only groups where that count is at or below a low threshold.

Answer

Filter events to a single suspected host and list every listening port, then manually compare the output against a documented baseline of approved services.

Answer

Search for any event where target.port is greater than 1024, sorting the raw results by timestamp to spot the most recent listeners first.

Answer

Match the listening ports against a GTI IOC feed of known C2 ports and alert on any exact match to a documented indicator.