CriticalALERT-4213engine: heuristic

Unusual Admin Share Access Across Hosts

analyst review

Raw alert — normalized QRadar offense

asset: billing-app-01
protocol: TCP :445
src_ip: 10.47.7.248
dest_ip: 10.20.6.21
magnitude: 9/10
severity: 8/10
credibility: 8/10
relevance: 9/10
src network: internal_corp
events / flows: 458 / 737

triggered rules

▹ Anomaly: Internal Host Scanning Peers
▹ Malware: Reverse Shell Signature Match

full offense JSON

{
  "offense_id": 4213,
  "description": "Unusual Admin Share Access Across Hosts :: Infiltration targeting billing-app-01",
  "offense_type": "Source IP",
  "offense_source": "10.47.7.248",
  "magnitude": 9,
  "severity": 8,
  "credibility": 8,
  "relevance": 9,
  "status": "OPEN",
  "source_network": "internal_corp",
  "destination_networks": [
    "internal_corp"
  ],
  "event_count": 458,
  "flow_count": 737,
  "start_time": "2025-11-03T02:54:00+00:00",
  "last_updated_time": "2025-11-03T03:42:00+00:00",
  "categories": [
    "Malware",
    "Botnet Communication"
  ],
  "rules": [
    "Anomaly: Internal Host Scanning Peers",
    "Malware: Reverse Shell Signature Match"
  ],
  "assigned_to": null,
  "dest_port": 445
}

AI triage

Likely port scan: Unusual Admin Share Access Across Hosts from internal host 10.47.7.248 against billing-app-01 (10.20.6.21) over TCP, 458 events observed.

MITRE ATT&CK

T1219Remote Access ToolsCommand and Controlconfidence 58%

Alert indicators (Unusual Admin Share Access Across Hosts; rules: Anomaly: Internal Host Scanning Peers) overlap most strongly with T1219 Remote Access Tools among the ATT&CK shortlist.

Priority — Critical

Scored Critical based on: QRadar magnitude 9/10; high severity (8/10); credibility 8/10.

Recommended next steps

1.Confirm the scan scope: how many destination ports/hosts were touched by the source IP.
2.Check whether any scanned port returned a SYN-ACK (successful connection) vs. all resets.
3.Block or rate-limit the source IP at the perimeter if it is external and unrecognized.
4.Search for follow-on activity from the same source (exploit attempts, logins).

Suggested hunting query (KQL)

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where SourceIP == "10.47.7.248" and DestinationIP == "10.20.6.21"
| summarize Events=count() by DestinationPort, Protocol
| order by Events desc

ATT&CK candidate shortlist — matched before the model was called, so it justifies from real technique IDs

T1219Remote Access Tools·7T1095Non-Application Layer Protocol·6.5T1071Application Layer Protocol·6T1021Remote Services·6T1059Command and Scripting Interpreter·6T1571Non-Standard Port·5.5T1570Lateral Tool Transfer·5.5