Forest Global Training Partners

Cyber Risks · Cisco Talos

Scarcity signals: Are rare activities red flags?

Summary: Cisco Talos analyzed PowerShell network connection telemetry from June 1 to December 31, 2024 across seven PowerShell process variants, extracting 742 unique base domains and defining rarity as five or fewer average contacts per full domain, which identified 550 rare domains (74.1% of the total). Rare domains were malicious at a rate of 1.64% versus 0.52% for non-rare domains, while frequently contacted domains like githubusercontent.com still hosted malicious subdomains such as raw.githubusercontent.com, where 5 of 10 connections involved commands like downloading PowerSploit or executing Invoke-Mimikatz.

Key Takeaway: The rarity heuristic is weak on its own: 74.1% of observed domains qualified as rare, and only 1.64% of those were malicious, so rarity alone flags a large volume of benign infrastructure. The githubusercontent.com case shows the inverse risk - a heavily used, trusted domain carried malicious subdomains that only subdomain-level and process-argument analysis surfaced.

Read the original at Cisco Talos ↗

Topics
Malware
Related