liveBook · Manning

Outbound connection

As explained in Cyber Threat Hunting

An outbound connection is a network connection initiated from a local host toward a remote destination.

An outbound connection is a network connection initiated from a local host toward a remote destination. During threat hunting, outbound traffic from a compromised web server can connect decoded attacker commands to external infrastructure. section 4.2.3

Investigate outbound connections by:

  • Searching cloud firewall logs for TCP destinations on ports 80 and 443 within a narrow window around suspicious web access. section 4.2.3
  • Grouping events by source IP, destination IP, and destination port to expose connection counts and affected hosts. section 4.2.3
  • Expanding the time window and filtering known destination indicators to identify reconnects and later activity. section 4.2.3

Correlating web-shell commands

A web-server node connected to 34.125.53.119 on TCP/80 after downloading project-plan, then connected repeatedly to 34.152.29.228 while executing it with a shell and reconnect option. section 4.2.3

Listing 4.17 Searching cloud firewall logs for outbound connections on TCP/80 or 443
sourcetype=gcp:firewall
| src_ip := rename(jsonPayload.connection.src_ip)
| dest_ip := rename(jsonPayload.connection.dest_ip)
| dest_port := rename(jsonPayload.connection.dest_port)
| disposition := rename(jsonPayload.disposition)
| src_ip=10.154.0.* AND (dest_port=80 OR dest_port=443)
| groupby(field=[src_ip, dest_ip, dest_port], function=count())
| sort(field=_count, order=desc)

Use the Humio query to search cloud firewall logs for outbound TCP/80 and TCP/443 traffic from the Kubernetes nodes. section 4.2.3

How Cyber Threat Hunting covers it

How deep it goes
Explains timed searches, grouping, correlation, expansion, and IOC filtering, but does not detail network-protocol internals.
Examples
Uses Humio queries, cloud firewall event tables, decoded commands, destination IPs, connection counts, and findings timelines.
What it assumes
Assumes familiarity with firewall logs, IP addresses, ports, and suspicious web access; teaches the correlation workflow through concrete queries.
What you can do after
Diagnose/debug with Humio by correlating firewall events, suspicious commands, destination indicators, and timeline activity.
How it connects
Connects outbound connections with firewall logs, threat hunting, web shells, command execution, Kubernetes nodes, and indicators of compromise.
Cover of Cyber Threat Hunting
liveBookmanning.com
Read Cyber Threat Hunting on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.