MediumALERT-4200engine: heuristic

Communication With Known Botnet IP

analyst review

Raw alert — normalized QRadar offense

asset: vpn-gw-01
protocol: TCP :6667
src_ip: 10.41.9.24
dest_ip: 10.20.1.2
magnitude: 6/10
severity: 6/10
credibility: 7/10
relevance: 7/10
src network: internal_corp
events / flows: 576 / 1,134

triggered rules

▹ Malware: Outbound Connection To Known C2
▹ Anomaly: Regular Beaconing Interval Detected

full offense JSON

{
  "offense_id": 4200,
  "description": "Communication With Known Botnet IP :: Bot targeting vpn-gw-01",
  "offense_type": "Source IP",
  "offense_source": "10.41.9.24",
  "magnitude": 6,
  "severity": 6,
  "credibility": 7,
  "relevance": 7,
  "status": "OPEN",
  "source_network": "internal_corp",
  "destination_networks": [
    "internal_corp"
  ],
  "event_count": 576,
  "flow_count": 1134,
  "start_time": "2025-11-03T03:43:00+00:00",
  "last_updated_time": "2025-11-03T03:47:00+00:00",
  "categories": [
    "Malware",
    "Botnet Communication"
  ],
  "rules": [
    "Malware: Outbound Connection To Known C2",
    "Anomaly: Regular Beaconing Interval Detected"
  ],
  "assigned_to": null,
  "dest_port": 6667
}

AI triage

Likely bot: Communication With Known Botnet IP from internal host 10.41.9.24 against vpn-gw-01 (10.20.1.2) over TCP, 576 events observed.

MITRE ATT&CK

T1071Application Layer ProtocolCommand and Controlconfidence 50%

Alert indicators (Communication With Known Botnet IP; rules: Malware: Outbound Connection To Known C2) overlap most strongly with T1071 Application Layer Protocol among the ATT&CK shortlist.

Priority — Medium

Scored Medium based on: QRadar magnitude 6/10; credibility 7/10.

Recommended next steps

1.Validate the destination against threat intel (known C2 / botnet infrastructure).
2.Isolate the internal host if beaconing is confirmed.
3.Pull the process/parent-process responsible for the outbound connection from EDR.
4.Check for lateral movement or additional beaconing from the same host.

Suggested hunting query (KQL)

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where SourceIP == "10.41.9.24"
| summarize Bytes=sum(SentBytes), Conns=count() by DestinationIP, DestinationPort
| order by Bytes desc

ATT&CK candidate shortlist — matched before the model was called, so it justifies from real technique IDs

T1071Application Layer Protocol·6T1571Non-Standard Port·5.5T1095Non-Application Layer Protocol·5.5T1105Ingress Tool Transfer·5T1568Dynamic Resolution·5T1583.005Botnet·3.5T1584.005Botnet·3.5