AN1599
Analytic 1599
Windows
Suspicious process initiating outbound connections to web services without corresponding response or return traffic, indicative of one-way command channels.
WinEventLog:Sysmon
EventCode=3, 22
etw:Microsoft-Windows-WinINet
WinINet API telemetry
[DestinationDomain]
Can tune for popular web services (e.g., googleapis.com, github.com) based on threat actor tooling
[TimeWindow]
May adjust temporal window to catch beaconing patterns (e.g., every 10-30 mins)
[ProcessName]
Environment-specific tuning to exclude expected update or telemetry tools
AN1600
Analytic 1600
Linux
Curl, wget, or custom HTTP clients initiated by uncommon user accounts or cron jobs to popular web services, with no observed response parsing logic.
auditd:SYSCALL
execve
iptables:LOG
OUTBOUND
[ParentProcess]
May tune to detect unknown parents like custom scripts or reverse shells
[CommandLineArgs]
May adjust based on known curl/wget C2 behaviors
AN1601
Analytic 1601
macOS
Process using URLSession or similar API to fetch from web services without any response handling, indicative of one-way C2 channels.
macos:unifiedlog
process, network
macos:endpointsecurity
exec events
[UserContext]
Flag unexpected outbound activity from non-admin or system users
[EntropyScore]
Optional if script-based obfuscation is seen in web requests
AN1602
Analytic 1602
ESXi
ESXi shell or scheduled tasks initiating outbound HTTPS to known public services without inbound return or loggable response, used to fetch instructions.
esxi:hostd
CLI network calls
[ScheduledTaskName]
Can tune for task names used to execute curl-based outbound requests
[DestinationIP]
Scoped by environment to exclude known legitimate CDNs