AN1229
Analytic 1229
Windows
Suspicious process spawning (e.g., `rundll32`, `svchost`, `powershell`, or `netsh`) followed by network connection creation to internal hosts or uncommon external endpoints on high or non-standard ports.
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Sysmon
EventCode=1
NSM:Connections
Outbound Connection
[ParentProcessName]
Legitimate system processes that may rarely spawn network-capable child processes (e.g., `rundll32`, `svchost`).
[DestinationPort]
Watch for high-numbered ports or well-known proxy ports like 1080, 8080, 4444.
[TimeWindow]
Capture unusual spikes in outbound connections over a short period.
AN1230
Analytic 1230
Linux
User-space tools (e.g., `socat`, `ncat`, `iptables`, `ssh`) used in non-standard ways to establish reverse shells, port-forwarding, or inter-host connections. Often chained with uncommon outbound destinations or SSH tunnels.
auditd:SYSCALL
execve
NSM:Flow
Connection Tracking
[CommandLinePattern]
Shell piping into tools like `socat`, `ncat`, or `openssl` for tunnel creation.
[OutboundPortRange]
Flag connections made from internal systems to uncommon high ports externally.
[ProcessUserContext]
Capture low-privilege or unexpected users executing system-level network tools.
AN1231
Analytic 1231
macOS
AppleScript, LaunchAgents, or remote login services (`ssh`, `networksetup`) establishing proxy tunnels or dynamic port forwards to external IPs or alternate local hosts.
macos:unifiedlog
None
NSM:Firewall
pf firewall logs
NSM:Flow
connection attempts
[TargetDomain]
Identify suspicious domains often associated with CDN-routed or anonymized endpoints (e.g., Cloudflare, Fastly).
[AppleScriptUsage]
Alert when AppleScript or Automator tools are used for network tunneling tasks.
[LaunchAgentSource]
Monitor for LaunchAgents executing proxy tools or dynamic ports.
AN1232
Analytic 1232
ESXi
Direct use of `nc`, `socat`, or reverse tunnel scripts initiated by abnormal user contexts or unauthorized VIBs initiating connections from hypervisor to external systems.
esxi:shell
None
esxi:vmkernel
None
NSM:Flow
conn.log
[CLICommand]
Custom proxy or port forwarding scripts executed from ESXi shell.
[DestinationIP]
Unusual outbound connections from ESXi host, particularly to internet.
[UserContext]
Root or elevated users initiating unexpected tunnels.
AN1233
Analytic 1233
Network Devices
Dynamic or static port forwarding rules added to route traffic through an internal host, or configuration changes to proxy firewall rules not aligned with baselined policy.
NSM:Firewall
Policy Change / Rule Update
NSM:Flow
Flow Creation (NetFlow/sFlow)
networkdevice:cli
Interface commands
[RuleType]
Focus on new allow/permit rules with dynamic NAT or port forwarders.
[ChangeUser]
Flag any non-admins initiating proxy config changes.
[FlowVolumeDelta]
Detect sharp changes in bi-directional traffic patterns.