AN1511
Analytic 1511
Windows
Processes that normally do not initiate network communications suddenly making outbound HTTPS connections with high outbound-to-inbound data ratios. Defender view: correlation between process creation logs (e.g., Word, Excel, PowerShell) and subsequent anomalous network traffic volumes toward common web services (Dropbox, Google Drive, OneDrive).
WinEventLog:Security
EventCode=4688
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Sysmon
EventCode=11
[MonitoredServices]
List of legitimate web services to baseline (Dropbox, OneDrive, Google Drive).
[ExfilVolumeThreshold]
Outbound data threshold for flagging unusual activity, tunable by environment.
[TimeWindow]
Aggregation period to calculate anomalies in outbound data volume.
AN1512
Analytic 1512
Linux
Processes (tar, curl, python scripts) accessing large file sets and initiating outbound HTTPS POST requests with payload sizes inconsistent with baseline activity. Defender perspective: detect abnormal sequence of file archival followed by encrypted uploads to external web services.
auditd:EXECVE
curl or wget with POST/PUT options
auditd:SYSCALL
open/read of sensitive directories (/etc, /home/*)
NSM:Flow
sustained outbound HTTPS sessions with high data volume
[MonitoredTools]
Suspicious command-line utilities used for exfiltration (curl, wget, python).
[DataVolumeThreshold]
Bytes transferred threshold per session to flag unusual uploads.
AN1513
Analytic 1513
macOS
Office apps or scripts writing files followed by xattr manipulation (to evade quarantine) and subsequent HTTPS uploads. Defender perspective: anomalous file modification + outbound TLS traffic originating from non-networking apps (Word, Excel, Preview).
macos:unifiedlog
execution of Office binaries with network activity
macos:unifiedlog
read/write of user documents prior to upload
macos:unifiedlog
outbound TLS connections to cloud storage providers
[WatchedApplications]
Applications not expected to perform bulk data transfers (Office apps, Preview).
AN1514
Analytic 1514
SaaS
Abnormal API calls from user accounts invoking file upload endpoints outside normal baselines (M365, Google Drive, Box). Defender perspective: monitor unified audit logs for elevated frequency of Upload, Create, or Copy operations from compromised accounts.
m365:unified
FileUploaded or FileCopied events
saas:box
API calls exceeding baseline thresholds
[APICallThreshold]
Maximum number of API calls per user/session before triggering alert.
[UserBaselineProfiles]
Baseline normal data transfer patterns by user/role.
AN1515
Analytic 1515
ESXi
ESXi guest OS or management interface processes establishing unexpected external HTTPS connections. Defender perspective: monitor vmx or hostd processes making outbound web requests with significant data transfer.
esxi:vmkernel
network session initiation with external HTTPS services
esxi:hostd
file copy or datastore upload via HTTPS
[DatastoreTransferThreshold]
Threshold for outbound transfers from ESXi datastores.