WEBPROXY-9005
highRepeated Blocked Requests to a Domain Followed by a Successful One
Detects the same domain being blocked several times in a row for the same client and then successfully reached - the proxy-visible signature of malware retrying a blocked callback domain until a policy exception, category re-classification, or DNS/domain-fronting change lets the connection through.
Detection logic
{
"detection_type": "sequence",
"groupby": "domain",
"timeframe_minutes": 15
}Log source: category=web_proxy · Event ID(s): proxy_request
Required log fields
- action
- domain
- src_ip
- timestamp
Enabling this in your environment
Where: n/a - cross-action correlation within one log source
Log both allowed and blocked actions with a consistent domain field across both, so the two sides of this sequence can be correlated from the same proxy log stream.
Mirrors FW-7004's blocked-then-allowed pattern at the application layer instead of the network layer - useful when the organization's egress control is enforced primarily by the proxy rather than the firewall.
False positives
- A user or admin who requested and received a legitimate policy exception for a previously miscategorized business domain
- A domain that was blocked due to a transient category-feed error and corrected shortly after