T1071

← All KQL categories

MITRE ATT&CK Technique

T1071

2 queries tagged with this technique.
View on MITRE ATT&CK →

• Hunting Hunt C2 Beacon By Connection Window Rhythm

  Low-and-slow C2 beacon hunt that counts distinct hourly time windows a process was connected in — not raw connection volume.

• Hunting Hunt Outlook Calendar C2 Far Future Standing Meeting

  Project CAV3RN's Outlook calendar C2 — standing meetings scheduled decades in the future in fixed low-attention windows, carrying operator-agent traffic in the event body.