SOP-34: Outbound Threat Intelligence Matched Connection Response

Rudra Verma, Senior Security Architect & Researcher · 2026-08-15

Threat Intelligence (TI) indicator matches occur when an internal host makes an outbound connection to an IP address, domain, or URL that appears in a curated threat feed. Microsoft Sentinel ingests indicators from MDTI, MISP, Recorded Future, and built-in Microsoft TI into the ThreatIntelligenceIndicator table, enabling join-based detection against live network events.

This SOP covers two paths: direct TI indicator join against DeviceNetworkEvents and CommonSecurityLog, and beacon interval analysis to confirm automated C2 communication rather than a one-time user browsing event.

☰ Table of Contents

01 Background 02 Identification 03 Containment 04 Eradication 05 Escalation

🛠

01 — BACKGROUND

TECHNIQUE OVERVIEW

Outbound TI-Matched Connection

T1071 / T1041

A TI-matched connection means an internal asset has made or attempted a network connection to an indicator (IP, domain, URL, or hash) that is listed in a threat intelligence feed as malicious. This is a high-fidelity signal because the connection is to a known-bad endpoint. The key triage question is whether it was a one-time browser event (lower risk) or a recurring beacon from an automated process (confirmed C2 channel).

Field	Value
MITRE Technique	T1071 — Application Layer Protocol (C2 over HTTP/HTTPS/DNS)
Sub-technique	T1041 — Exfiltration Over C2 Channel
Log Sources	ThreatIntelligenceIndicator, DeviceNetworkEvents, CommonSecurityLog, ASimNetworkSession
Key Indicators	TI IP/domain match, recurring connection at fixed interval (beacon), non-browser process making HTTP/S
TI Feed Sources	Microsoft MDTI, MISP, Recorded Future, AlienVault OTX, Mandiant, built-in Sentinel TI
Detection Priority	CRITICAL — direct match to known adversary infrastructure

TI indicator quality varies by feed. A match to a low-confidence or aged indicator (ConfidenceScore <50 or ExpirationDateTime past) should be treated as PARTIAL until verified. Always check IndicatorProvider and ConfidenceScore before declaring confirmed.

🔍

02 — IDENTIFICATION

2 INDICATORS

▶ Investigation Workflow

ThreatIntelligenceIndicator Join — IP & Domain Match

T1071

WHY CHECK

Joining network events against the ThreatIntelligenceIndicator table confirms the remote endpoint is actively tracked as malicious infrastructure — elevating a generic network alert to a confirmed adversary contact event.

📍 Portal Navigation — Microsoft Sentinel

portal.azure.com› Microsoft Sentinel› Logs

1Open Sentinel → Logs → confirm ThreatIntelligenceIndicator table has recent entries (check last ingestion time).
2Paste the KQL below; set time range to Last 24 hours.
3Review ConfidenceScore — scores >70 from MDTI or Recorded Future are high-confidence matches. Scores <50 require manual enrichment.
4Review InitiatingProcessFileName — if not a browser (chrome.exe, msedge.exe, firefox.exe), treat as automated/malicious process.
5Check ThreatType and Tags fields on the indicator — tags like "C2", "Cobalt Strike", or "Emotet" escalate priority immediately.

Field / Value	Meaning	Action
ConfidenceScore > 70	High-quality TI match from a curated feed — reliable indicator of adversary infrastructure	ESCALATE
ThreatType = C2	Indicator explicitly tagged as command-and-control infrastructure	ESCALATE
Non-browser process	Automated connection to TI indicator — implant beaconing rather than user browsing	ESCALATE
ConfidenceScore < 50	Low-quality indicator — may be aged, shared, or from a low-fidelity feed	ENRICH

DETECTS: Internal hosts making outbound connections to IPs and domains that match active entries in the ThreatIntelligenceIndicator table with confidence score above 50.

KQL — Microsoft Sentinel

let TI = ThreatIntelligenceIndicator | where TimeGenerated > ago(7d) | where Active == true | where ConfidenceScore > 50 | where isnotempty(NetworkIP) or isnotempty(DomainName) | project TI_IP = NetworkIP, TI_Domain = DomainName, ThreatType, Tags, ConfidenceScore, IndicatorProvider; DeviceNetworkEvents | where Timestamp > ago(24h) | join kind=inner TI on $left.RemoteIP == $right.TI_IP | project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ThreatType, Tags, ConfidenceScore, IndicatorProvider | order by ConfidenceScore desc

DETECTS: Same TI indicator join in Splunk — outbound connections from internal hosts matched against a threat intel lookup table.

SPL — Splunk

index=* sourcetype=network | lookup threat_intel_ips dest_ip as dest_ip OUTPUT threat_type, confidence, tags | where isnotnull(threat_type) AND confidence > 50 | stats count as connections, values(dest_port) as ports, values(process) as processes by src_ip dest_ip threat_type confidence tags | sort -confidence

ThreatIntelligenceIndicator entries expire. Always filter Active == true and check ExpirationDateTime. A match to an expired indicator from a shared feed may be a retired sinkhole IP now used for legitimate traffic.

C2 Beacon Interval Analysis

T1041

WHY CHECK

C2 implants (Cobalt Strike, Sliver, Havoc) check in with their server at regular intervals — typically every 60s, 5 min, or 15 min. A recurring connection pattern to a TI-matched IP at a consistent interval confirms automated beaconing rather than a one-time user event.

📍 Portal Navigation — Microsoft Sentinel Logs

portal.azure.com› Microsoft Sentinel› Logs

1Open Sentinel → Logs → filter time range to Last 6 hours.
2Paste the KQL below using the source IP from the TI match in I1.
3Review AvgIntervalMinutes — values of 1, 5, 15, or 60 minutes suggest Cobalt Strike or Sliver default sleep intervals.
4Check StdDevSeconds — very low standard deviation (under 30s) confirms automated beaconing. Human browsing is irregular.
5If beacon confirmed, immediately isolate the host without waiting for further analysis — active C2 means the attacker may receive interactive commands at any moment.

DETECTS: Regular connection intervals to TI-matched remote IPs — identifies automated C2 beaconing by measuring the time gap between successive connections and their statistical consistency.

KQL — Microsoft Sentinel (DeviceNetworkEvents)

DeviceNetworkEvents | where Timestamp > ago(6h) | where RemoteIP == "REPLACE_WITH_TI_IP" | sort by DeviceName asc, Timestamp asc | extend PrevTimestamp = prev(Timestamp, 1) | where isnotempty(PrevTimestamp) | extend IntervalSeconds = datetime_diff('second', Timestamp, PrevTimestamp) | where IntervalSeconds > 0 and IntervalSeconds < 7200 | summarize ConnectionCount = count(), AvgIntervalMinutes = round(avg(IntervalSeconds) / 60, 1), StdDevSeconds = round(stdev(IntervalSeconds), 0), MinInterval = min(IntervalSeconds), MaxInterval = max(IntervalSeconds) by DeviceName, RemoteIP, InitiatingProcessFileName | where ConnectionCount > 5 | order by StdDevSeconds asc

DETECTS: Beacon interval analysis in Splunk — measures the consistency of outbound connection timing to identify automated C2 callbacks.

SPL — Splunk

index=* sourcetype=network dest_ip="REPLACE_WITH_TI_IP" | sort src_ip _time | streamstats window=2 range(_time) as interval by src_ip dest_ip | where interval > 0 AND interval < 7200 | stats count as conn_count, avg(interval) as avg_interval_sec, stdev(interval) as stddev_sec by src_ip dest_ip | eval avg_interval_min=round(avg_interval_sec/60,1) | where conn_count > 5 | sort stddev_sec

Cobalt Strike default sleep is 60 seconds with 0% jitter (stddev near 0). Sliver defaults to 60s with random jitter. If stddev <10 and avg interval is 60s, 300s, or 900s — these are textbook C2 beacons requiring immediate isolation.

🚫

03 — CONTAINMENT

IMMEDIATE ACTION

Verdict & Escalation Decision

DECISION GATE

▶ Triage Verdict — Select One

CONFIRMED High-confidence TI match AND non-browser process OR beacon pattern detected → Isolate host immediately, block indicator in Defender, escalate to SEV1 IR

PARTIAL TI match but browser process, single connection, or low confidence indicator → Block indicator at firewall, investigate browsing history, re-check in 2 hours

FALSE POSITIVE Expired indicator, sinkhole IP, or legitimate CDN misidentified → Whitelist IP, update TI feed exclusion, close ticket

A confirmed C2 beacon means the attacker may have an interactive shell. Act within 15 minutes of confirmation — every minute of delay allows additional lateral movement or data staging.

Block TI Indicator & Isolate Host

CONTAINMENT

📍 Portal Navigation — Defender for Endpoint Indicators

security.microsoft.com› Settings› Endpoints› Indicators → IP Addresses

1Go to Settings → Endpoints → Indicators → IP Addresses → Add indicator → enter the TI-matched IP. Set action to Block and remediate.
2Isolate the affected host: Assets → Devices → [host] → Actions → Isolate device.
3In Sentinel, run the beacon analysis KQL for the past 24 hours to determine dwell time and identify all hosts that contacted the TI IP.
4Check if any other hosts beaconed to the same C2 IP — scope the incident to all affected endpoints.
5Open a SEV1 IR ticket and brief L2 with: TI indicator, ConfidenceScore, IndicatorProvider, affected hosts, beacon interval, and first-seen timestamp.

🗑

04 — ERADICATION

CLEANUP

Remove Implant & Cut C2 Channel

ERADICATION

1Run a full Defender AV scan on all isolated hosts — identify and quarantine the implant binary.
2Review InitiatingProcessFileName and its parent process — trace the full execution chain back to the initial access event in Device Timeline.
3Check for injected process activity: look for svchost.exe, explorer.exe, or rundll32.exe making outbound connections — indicates process injection.
4Remove persistence: check scheduled tasks, registry run keys, WMI subscriptions, and startup folders for entries created around the first-seen timestamp.
5Add TI IP to DNS RPZ blocklist or internal firewall rule to block all internal hosts, not just the isolated one.
6Share the confirmed C2 IP with your TI platform (MISP/Sentinel) to enrich the indicator with your internal confidence data.

Eradication Complete When

No DeviceNetworkEvents connections to TI IP from any internal host in past 1 hour
Implant process terminated and binary quarantined
Persistence mechanisms removed (scheduled tasks, registry, WMI)
TI IP blocked at network perimeter (firewall / DNS RPZ)
All affected hosts identified and isolated for forensic review

📢

05 — ESCALATION

ESCALATION PATHS

ES1

Escalation Matrix

ESCALATION

Condition	Severity	Action	Notify
Confirmed C2 beacon to high-confidence TI IP	SEV1	Isolate host, full IR, scope all affected hosts	SOC Lead → CISO → IR Team
Multiple hosts beaconing to same C2	SEV1	Full IR, assume lateral movement in progress	SOC Lead → CISO → All stakeholders
Single connection, browser process, low TI confidence	SEV3	Block indicator, monitor 24 hours, user awareness	SOC Lead (async)
Expired TI indicator, confirmed sinkhole	INFO	Update TI exclusion, tune detection rule	None

If the TI indicator is tagged with a nation-state threat actor (APT28, APT41, Lazarus Group) — escalate directly to CISO and Legal regardless of beacon confirmation status. Nation-state TTPs require executive awareness even at the suspected stage.

Stay Threat-Ready

Follow CyberHawk Threat Intel for daily SOC analyst playbooks, detection engineering guides, and threat intelligence.

📺 YouTube 🎤 TikTok 🐦 X / Twitter 📡 Telegram

All SOPs Blog Web App (Free)

They can't exploit you if you are the Exploit.