AN1113
Analytic 1113
Windows
Detection of automated tools or scripts periodically transmitting data to external destinations using scheduled tasks or background processes.
WinEventLog:Security
EventCode=4688
WinEventLog:Sysmon
EventCode=3, 22
[TimeWindow]
Used to detect repeated exfil activity over intervals (e.g., every 5 minutes).
[DestinationIP]
Can be tuned to filter known internal or trusted destinations.
AN1114
Analytic 1114
Linux
Background scripts (e.g., via cron) or daemons transmitting data repeatedly to remote IPs or URLs.
auditd:SYSCALL
execve
NSM:Flow
Outbound Connections
[CronJobInterval]
Tunable time range for recurring tasks seen creating outbound connections.
[UserContext]
Tunable for scope — service accounts vs user accounts.
AN1115
Analytic 1115
macOS
Observation of LaunchAgents or LaunchDaemons establishing periodic external connections indicative of automated data transfer.
macos:unifiedlog
process: exec
macos:unifiedlog
network
macos:cron
cron/launchd
[LaunchInterval]
Frequency of task recurrence linked to external communication.
[DestinationPort]
Port number used for detection filtering.