SignalHunt
← All rules

FW-7004

high

Repeated Blocked Outbound Connections Followed by a Successful One

Detects the same external destination being blocked several times in a row and then successfully connected to - the network signature of C2 malware retrying a beacon until a firewall rule change, NAT exception, or misconfiguration lets the traffic through.

T1071

Detection logic

{
  "detection_type": "sequence",
  "groupby": "dst_ip",
  "timeframe_minutes": 15
}

Log source: category=firewall · Event ID(s): fw_deny, fw_allow

Required log fields

  • action
  • dst_ip
  • timestamp

Enabling this in your environment

Where: n/a - cross-action correlation within one log source

Log both allow and deny actions with a consistent dst_ip field across both, so the two sides of this sequence can be correlated.

Unlike WAF-5005, both steps here come from the same log source (firewall traffic logs) - the correlation challenge is time-windowing within one stream, not joining across sources.

False positives

  • A legitimate service reconnecting after a firewall rule was intentionally updated
  • A client retrying after a transient network issue, unrelated to the earlier blocks

References