title: Botnet Connection
id: bced670e-b1e7-5b9f-9968-917bb708c126
custom_id: wf-mal-002
status: stable
level: critical
description: |
    Detects connections to known botnet command-and-control infrastructure.
    WitFoo's threat intelligence enrichment classifies these connections
    based on IOC matching and behavioral patterns.
author: WitFoo
date: 2026-02-21
tags:
    - attack.command_and_control
    - attack.t1071.001
references:
    - https://attack.mitre.org/techniques/T1071/001/
logsource:
    product: witfoo
    service: artifact-exporter
detection:
    selection:
        messageType: "botnet_connection"
    condition: selection
fields:
    - clientIP
    - serverIP
    - serverPort
    - protocol
    - stixIndicatorIds
    - matchedLeadRules
falsepositives:
    - Sinkholed domains returning false positive connections
    - Threat intelligence feed false positives