AN1294
Analytic 1294
Windows
Untrusted processes creating outbound TLS/HTTPS connections with malformed certificates or header fields, often mismatched with target service behavior. Detects protocol impersonation attempts via traffic metadata analysis and host process lineage.
WinEventLog:Sysmon
EventCode=3, 22
NSM:Flow
SSL/TLS Handshake Analysis
[IssuerOrgFilter]
Organizations in certificate issuer fields to allowlist or monitor.
[UserContext]
Restrict detection to non-system users or external-facing applications.
[HeaderSignatureMatch]
Specific HTTP header anomalies or patterns (e.g., missing User-Agent).
AN1295
Analytic 1295
Linux
Detection of binaries spawning encrypted sessions using OpenSSL or curl to external services with mismatched ports/protocols. Identifies behavior where internal services simulate trusted cloud service traffic patterns.
auditd:SYSCALL
execve
NSM:Flow
Network Capture TLS/HTTP
[ProtocolMatchConfidence]
Threshold for header-field mismatch against expected service behavior.
[TimeWindow]
Correlation window between process spawn and encrypted session.
AN1296
Analytic 1296
macOS
Unsigned or suspicious applications initiating network traffic claiming to be browser, mail, or cloud clients. Detects impersonation via TLS fingerprint and User-Agent string deviation.
macos:unifiedlog
Outbound Traffic
macos:osquery
Process Execution + Hash
NSM:Content
HTTP Header Metadata
[ParentProcessFilter]
Limit detections to children of suspicious binaries.
[HeaderAnomalyScore]
Threshold for deviation from expected headers (User-Agent, Host).
AN1297
Analytic 1297
ESXi
ESXi hosts initiating connections from non-standard daemons mimicking HTTP/HTTPS or SNMP traffic, but with irregular payload formats or expired/unsigned TLS certificates.
esxi:hostd
Service-Based Network Connection
NSM:Content
TLS Fingerprint and Certificate Analysis
[TLSFingerprintMatch]
Allows matching against known-good or known-bad JA3/JA3S hashes.
[AllowedServicePorts]
Tune for expected network ports per ESXi role.