A machine learning job detected an unusually large spike in network activity to one destination country in the network logs. This could be due to unusually large amounts of reconnaissance or enumeration traffic. Data exfiltration activity may also produce such a surge in traffic to a destination country which does not normally appear in network traffic or business work-flows. Malware instances and persistence mechanisms may communicate with command-and-control (C2) infrastructure in their country of origin, which may be an unusual destination country for the source network.
Rule type: machine_learning
Rule indices: None
Risk score: 21
Runs every: 15m
Maximum alerts per execution: 100
- Threat Detection
Rule license: Elastic License v2