(Qradar rules): Engineering a Firewall-Based C2 Detection Rule Using Threat Intelligence and Threshold Logic

Detection engineering is more than writing rules — it’s designing logic that separates noise from real threats. In this article, we’ll break down a Command-and-Control (C2) detection rule implemented in IBM QRadar using threat intelligence correlation and threshold-based logic

1- Rule Identity Rule ID : IEX_MLW.3/4-A1_A-TA0010.T1041-AG1_FW_Communication to C2 MITRE Mapping : Tactic: Command and Control (TA0010), Technique: Exfiltration Over C2 Channel (T1041) Primary Data Sources: Firewall logs (Check Point, Palo Alto, Cisco ASA, Juniper), Endpoint logs (Trend Micro, Forcepoint)

2- Detection Objective Detect persistent outbound communication from internal assets to known or suspected malicious infrastructure, leveraging threat intelligence feeds and firewall telemetry.

3- Threat Scenario

• Malware installed on internal host
• Attempts to communicate with C2 infrastructure
• Periodic beaconing, often with varying IPs
• Possible data exfiltration or remote command execution

**4-Data Sources *** IBM QRadar as SIEM

• Firewall telemetry (Check Point, Palo Alto, Cisco ASA, Juniper)
• Endpoint logs (Trend Micro OfficeScan, Forcepoint V-Series) *Reference sets dynamiclly populated with TI feeds

5-Rule Logic Breakdown

Step A — Local → Remote Context

• Rule only triggers when the source IP is internal and the destination IP is external
• Focuses on outbound communication from inside the network
• Eliminates internal lateral movement traffic
• Targets potential data exfiltration or malware C2 communication paths

Step B — Threat Intelligence Correlation

• Destination IP must exist in QRadar reference sets populated by threat intelligence feeds matches against: Validated C2 servers Malicious IP lists Known botnet infrastructure APT-linked infrastructure Malware delivery servers

Step C — Volume / Threshold Condition

Triggers only if ≥ 100 events occur Events must target the same Destination IP *Time window: 1 hour

Step D — Exclusion Logic (Noise Control Layer)

• Excludes known benign IP addresses (e.g., trusted DNS providers, approved business services)
• Excludes custom TCP packet states (e.g., first packet must be SYN)
• Excludes IPs stored in dedicated QRadar reference sets for legitimate infrastructure
• Filters out known internal exceptions

Apply IEX_MLW.3/4-A1_A-TA0010.T1041-AG1_FW_Communication to CnC on events which are detected by the Local system
and when the event(s) were detected by one or more of Check Point, Palo Alto PA Series, Trend Micro Office Scan, Forcepoint V Series, Cisco Adaptive Security Appliance (ASA), Juniper Junos OS Platform
and when the event context is Local to Remote
and when any of Destination IP are contained in any of RF - rf_domain_risklist - Recently Resolved to Malicious IP - AlphaNumeric (Ignore Case), RF - rf_domain_risklist - Recently Resolved to Suspicious IP - AlphaNumeric (Ignore Case), RF - rf_domain_risklist - Recently Resolved to Unusual IP - AlphaNumeric (Ignore Case), RF - rf_domain_risklist - Recently Resolved to Very Malicious IP - AlphaNumeric (Ignore Case), RF - rf_ip_risklist - Actively Communicating Validated C&C Server - IP, RF - rf_ip_risklist - Historical Malware Delivery - IP, RF - rf_ip_risklist - Historically Reported C&C Server - IP, RF - rf_ip_risklist - Malicious - IP, RF - rf_ip_risklist - Nameserver for C&C Server - IP, RF - rf_ip_risklist - Observed High-Impact Vulnerability - IP, RF - rf_ip_risklist - Previously Validated C&C Server - IP, RF - rf_ip_risklist - Recent Botnet Traffic - IP, RF - rf_ip_risklist - Recent Brute Force - IP, RF - rf_ip_risklist - Recent DDoS - IP, RF - rf_ip_risklist - Recent DNS Abuse - IP, RF - rf_ip_risklist - Recent Exploit Server - IP, RF - rf_ip_risklist - Recent Honeypot Sighting - IP, RF - rf_ip_risklist - Recent Malicious Infrastructure Admin Server - IP, RF - rf_ip_risklist - Recent Malicious Scanning Behavior - IP, RF - rf_ip_risklist - Recent Malware Delivery - IP, RF - rf_ip_risklist - Recent Multicategory Blocklist - IP, RF - rf_ip_risklist - Recent Open Proxies - IP, RF - rf_ip_risklist - Recent Phishing Host - IP, RF - rf_ip_risklist - Recent Positive Malware Verdict - IP, RF - rf_ip_risklist - Recent Spam Source - IP, RF - rf_ip_risklist - Recent SSH/Dictionary Attacker - IP, RF - rf_ip_risklist - Recent Suspected C&C Server - IP, RF - rf_ip_risklist - Recent Threat Researcher - IP, RF - rf_ip_risklist - Recent Tor Node - IP, RF - rf_ip_risklist - Recent Unusual IP - IP, RF - rf_ip_risklist - Recent Validated Malicious Relay Server - IP, RF - rf_ip_risklist - Recent Validated Vulnerability Scanner Server - IP, RF - rf_ip_risklist - Recently Communicating Validated C&C Server - IP, RF - rf_ip_risklist - Recently Communicating With Validated C&C Server - IP, RF - rf_ip_risklist - Recently Linked to APT - IP, RF - rf_ip_risklist - Recently Linked to Cyber Attack - IP, RF - rf_ip_risklist - Recently Linked to Intrusion Method - IP, RF - rf_ip_risklist - Recently Referenced by Insikt Group - IP, RF - rf_ip_risklist - Recently Reported by DHS AIS - IP, RF - rf_ip_risklist - Recently Reported by Insikt Group - IP, RF - rf_ip_risklist - Recently Reported C&C Server - IP, RF - rf_ip_risklist - Score - IP, RF - rf_ip_risklist - Suspected Malicious Packet Source - IP, RF - rf_ip_risklist - Suspected Phishing Host - IP, RF - rf_ip_risklist - Tor Node - IP, RF - rf_ip_risklist - Validated C&C Server - IP, RF - rf_ip_risklist - Very Malicious - IP, ocd-datalake-ddos-ip - AlphaNumeric, ocd-datalake-fraud-ip - AlphaNumeric, ocd-datalake-hack-ip - AlphaNumeric, ocd-datalake-leak-ip - AlphaNumeric, ocd-datalake-malware-ip - AlphaNumeric, ocd-datalake-phishing-ip - AlphaNumeric, ocd-datalake-scam-ip - AlphaNumeric, ocd-datalake-scan-ip - AlphaNumeric, ocd-datalake-spam-ip - AlphaNumeric
and NOT when the event matches TCP_Packet_State (custom) is any of First packet isn't SYN
and NOT when the event matches Destination IP is any of x
and NOT when any of Destination IP are contained in any of CTI_IP_Exclusions - IP
and NOT when the event matches Destination IP is any of [x or x or x]
and NOT when the destination IP is one of the following x, x, x, x
and when at least 100 events are seen with the same Destination IP in 1 hour(s)

Good Luck!