Detect Server in Microsoft Sentinel
Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, such as watering hole operations in Drive-by Compromise, enabling Phishing operations, or facilitating Command and Control. Instead of compromising a third-party server or renting a Virtual Private Server, adversaries may opt to configure and run their own servers in support of operations. Free trial periods of cloud servers may also be abused. Real-world examples include GALLIUM operating Taiwan-based exclusive servers, Kimsuky purchasing hosting servers with virtual currency and prepaid cards, Sandworm Team leasing servers through resellers to obscure attribution, Earth Lusca acquiring multiple servers with distinct roles per operation, Mustard Tempest hosting second-stage SocGholish payloads on short-lived acquired servers, and CURIUM creating dedicated servers for C2 and exfiltration. Because the adversary action of acquiring the server occurs entirely outside the target environment, detection must focus on identifying the operational use of adversary-controlled server infrastructure: C2 beaconing patterns, connections to known malicious hosting infrastructure, and suspicious DNS resolution to adversary-controlled domains.
MITRE ATT&CK
- Tactic
- Resource Development
- Technique
- T1583 Acquire Infrastructure
- Sub-technique
- T1583.004 Server
- Canonical reference
- https://attack.mitre.org/techniques/T1583/004/
KQL Detection Query
// Detect potential C2 beaconing to adversary-controlled server infrastructure
// Primary strategy: regular-interval outbound connections from non-browser processes to public IPs
let TimeWindow = 24h;
let MinConnections = 10;
let KnownGoodDomains = dynamic([
"microsoft.com", "windows.com", "windowsupdate.com", "office.com",
"live.com", "azure.com", "microsoftonline.com", "office365.com",
"akamaiedge.net", "akamaitechnologies.com", "cloudflare.com",
"cloudflare-dns.com", "amazonaws.com", "googleusercontent.com",
"googleapis.com", "apple.com", "icloud.com", "digicert.com",
"verisign.com", "ocsp.sectigo.com", "crl.microsoft.com",
"ctldl.windowsupdate.com", "login.microsoftonline.com"
]);
let SuspiciousProcesses = dynamic([
"powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe",
"rundll32.exe", "regsvr32.exe", "mshta.exe", "certutil.exe",
"bitsadmin.exe", "curl.exe", "wget.exe", "msiexec.exe",
"odbcconf.exe", "wmic.exe", "msbuild.exe", "csc.exe"
]);
DeviceNetworkEvents
| where Timestamp > ago(TimeWindow)
| where ActionType == "ConnectionSuccess"
| where RemoteIPType == "Public"
| where not(RemoteUrl has_any (KnownGoodDomains))
| where InitiatingProcessFileName !in~ (
"msedge.exe", "chrome.exe", "firefox.exe", "iexplore.exe",
"opera.exe", "brave.exe", "outlook.exe", "teams.exe",
"slack.exe", "zoom.exe", "onedrive.exe", "dropbox.exe",
"steam.exe", "msedgewebview2.exe", "MicrosoftEdgeCP.exe"
)
| summarize
ConnectionCount = count(),
FirstSeen = min(Timestamp),
LastSeen = max(Timestamp),
DistinctPorts = dcount(RemotePort),
Ports = make_set(RemotePort, 10),
Processes = make_set(InitiatingProcessFileName, 5)
by DeviceName, AccountName, RemoteIP, RemoteUrl
| where ConnectionCount >= MinConnections
| extend DurationMinutes = datetime_diff('minute', LastSeen, FirstSeen)
| where DurationMinutes > 30
| extend AvgIntervalMinutes = toreal(DurationMinutes) / toreal(ConnectionCount)
| extend IsSuspiciousProcess = Processes has_any (SuspiciousProcesses)
| extend IsBeaconInterval = AvgIntervalMinutes between (0.5 .. 60.0)
| where IsBeaconInterval or IsSuspiciousProcess
| extend RiskScore = case(
IsSuspiciousProcess and IsBeaconInterval, 3,
IsSuspiciousProcess, 2,
IsBeaconInterval and ConnectionCount > 30, 2,
1
)
| project
Timestamp = LastSeen,
DeviceName,
AccountName,
RemoteIP,
RemoteUrl,
ConnectionCount,
DurationMinutes,
AvgIntervalMinutes,
DistinctPorts,
Ports,
Processes,
IsSuspiciousProcess,
IsBeaconInterval,
RiskScore
| sort by RiskScore desc, ConnectionCount descDetects potential C2 beaconing to adversary-controlled server infrastructure using Microsoft Defender for Endpoint DeviceNetworkEvents. Since server acquisition itself occurs outside the target environment, this query focuses on usage patterns: regular-interval outbound connections from non-browser processes to public IPs, filtered against a known-good domain list covering major CDNs and cloud providers. Computes average connection intervals and flags processes associated with malicious activity. RiskScore 3 indicates both a suspicious initiating process and beacon-like timing; RiskScore 2 indicates one strong indicator; RiskScore 1 is a lower-confidence signal requiring additional corroboration.
Data Sources
Required Tables
False Positives & Tuning
- Monitoring and telemetry agents (Datadog, Elastic Agent, Splunk Universal Forwarder, Dynatrace OneAgent) making regular check-ins to cloud-hosted collection endpoints at consistent intervals
- Software update mechanisms (Chocolatey, WinGet, vendor update services) polling cloud update servers not covered by the known-good domain exclusion list
- Enterprise applications with cloud-hosted license servers or API backends making periodic heartbeat connections
- Remote management and monitoring tools (ConnectWise, N-able, TeamViewer, Splashtop) maintaining persistent outbound management connections
- Security tools performing regular threat intelligence feed updates, CRL checks, or OCSP queries to non-standard CA endpoints
- DevOps pipeline agents (GitHub Actions runner, Jenkins agent, GitLab runner) polling orchestration servers at regular intervals
Other platforms for T1583.004
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate C2 Beacon Check-in with Regular Interval Callback
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with the above CommandLine. Sysmon Event ID 3: Five Network Connection events to 127.0.0.1:8888 at approximately 30-second intervals from powershell.exe. If targeting a real test server: firewall and proxy logs showing repeated outbound connections from powershell.exe to the test server IP at regular intervals. Windows PowerShell ScriptBlock Log Event ID 4104 capturing the Invoke-WebRequest command.
- Test 2DNS Query Pattern Consistent with Adversary-Controlled Server Domain
Expected signal: Sysmon Event ID 22: DNS Query events for each of the five domains, showing QueryName, QueryStatus (most will return NXDOMAIN or error since these are test domains), and the querying process image path (powershell.exe). Windows DNS Client Operational log (Microsoft-Windows-DNS-Client/Operational Event ID 3008) may additionally capture failed lookup events.
- Test 3Outbound Connection to Non-Standard C2 Ports from LOLBin
Expected signal: Sysmon Event ID 3: Network connection attempt events from powershell.exe to 127.0.0.1 on ports 4444, 8080, and 8443. Note: Sysmon typically logs connection attempts even when the connection is refused (no listener). Sysmon Event ID 1: Process Create for the powershell.exe instance. For testing with a real server running nc -lvp 4444 or similar: successful connection events with DestinationIp and DestinationPort fields populated.
- Test 4Scheduled Task Persistence Simulating C2 Callback Persistence Mechanism
Expected signal: Security Event ID 4698: A scheduled task was created — captures task name (WindowsNetworkHealth), task content, and creating user. Sysmon Event ID 1: Process Create for schtasks.exe with the /Create parameters. When the task executes: Sysmon Event ID 1 for powershell.exe spawned by svchost.exe (Task Scheduler service) with parent command line referencing taskhost/taskhostw, carrying the -NoProfile -WindowStyle Hidden flags. Sysmon Event ID 3: Network connection from task-spawned powershell.exe to 127.0.0.1:8888.
References (10)
- https://attack.mitre.org/techniques/T1583/004/
- https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2
- https://cloud.google.com/blog/topics/threat-intelligence/scandalous-external-detection-using-network-scan-data-and-automation/
- https://threatconnect.com/blog/infrastructure-research-hunting/
- https://unit42.paloaltonetworks.com/purpleurchin-steals-cloud-resources/
- https://sysdig.com/blog/googles-vertex-ai-platform-freejacked/
- https://www.microsoft.com/en-us/security/blog/2019/12/12/gallium-targeting-global-telecom/
- https://www.sentinelone.com/labs/socgholish-campaigns-and-initial-access-kit/
- https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc.html
- https://www.trendmicro.com/en_us/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-an.html
Unlock Pro Content
Get the full detection package for T1583.004 including response playbook, investigation guide, and atomic red team tests.