Demo
Scenario:
CRITICAL: Score 13 & 12 High threats — C2 beacon UNLOGGED BY FIREWALL detected on wire

193.37.212.44 Russia

Suspicious / Score
High 12
First seen
2026-10-30T02:45:52+00:00
Last seen
2026-10-30T10:33:52+00:00
Source query
02-Lange_Connections 2 rules matched
Country / City
Russia / Moscow
ISP / Org / ASN
M24 LLC / M24 LLC / AS42424 M24 LLC
Hosting / Proxy
0 / 0
Prior DNS Resolution
No
Unlogged by Firewall
No
Open ports
22,443
Tags
<missing>
Abuse score
95
VT malicious
12
Enriched at
2026-10-30T10:33:52+00:00

Detection Rule History

Detection Rule First Detected Last Detected Hit Count Kibana Link
03-LowVolume_HighFreq 2026-10-30T10:33:52+00:00 2026-10-30T10:33:52+00:00 1
02-Lange_Connections 2026-10-30T02:45:52+00:00 2026-10-30T02:45:52+00:00 1

Internal Hosts Contacting this IP

Internal IP Has Agent? Prior DNS Resolve? Last Contact Time
10.5.20.80 No No 2026-10-30T10:33:52+00:00

Comment