AN0165
Analytic 0165
Windows
Unusual or uncommon processes initiate network connections to external destinations followed by file creation (tools downloaded).
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=1
[ParentProcessName]
Tune for known good updaters (e.g., ChromeUpdate, OneDrive)
[DestinationIPCategory]
Allow filtering by internal vs external IP blocks
[FilePathRegex]
Focus on uncommon file drop paths (e.g., C:\Users\Public\)
AN0166
Analytic 0166
Linux
Shell-based tools (curl, wget, scp) initiate connections to external domains followed by creation of executable files on disk.
auditd:SYSCALL
connect, execve, write
auditd:SYSCALL
file creation/modification
iptables:LOG
TCP connections
[ToolName]
Match on curl, wget, rsync, etc. based on environment
[DownloadExtension]
Tunable filter to limit to suspicious file types (.sh, .bin, .elf)
AN0167
Analytic 0167
macOS
Process execution of curl or wget followed by a network connection and a file created in temporary or user-specific directories.
macos:endpointsecurity
ES_EVENT_TYPE_NOTIFY_EXEC
macos:unifiedlog
file write/create
macos:unifiedlog
connection open
[DirectoryTargeted]
Restrict to high-risk directories like /Users/Shared, /tmp/
[ProcessPath]
May tune based on custom tooling or MDM activity
AN0168
Analytic 0168
ESXi
Command line interface or vCLI triggers remote transfer using wget or curl, writing files into datastore paths or local tmp directories.
esxi:hostd
command execution
esxi:vmkernel
file write
[ToolName]
Tune for wget, curl, netcat, and scripting languages in use
[DatastorePath]
Filter or prioritize specific paths (e.g., /vmfs/volumes/)
AN0169
Analytic 0169
Network Devices
Network device logs show anomalous inbound file transfers or uncharacteristic flows with high payload volume to network devices with storage or automation hooks.
NSM:Flow
connection metadata
snmp:syslog
firmware write/log event
[PayloadVolumeThreshold]
Tune based on expected update size vs anomalous bulk data transfers
[ProtocolUsed]
Flag unexpected protocols like TFTP, FTP, HTTP