AN1189
Analytic 1189
Windows
Detects unusual outbound connections to web services from uncommon processes using SSL/TLS, particularly those exhibiting high outbound data volume or persistence.
WinEventLog:Sysmon
EventCode=3, 22
NSM:Flow
SSL/TLS Inspection or PCAP
[ProcessName]
To tune for unexpected or uncommon executables initiating network connections
[DataTransferThreshold]
Volume of outbound data in short time window (e.g., >1MB in <5 min)
[TimeWindow]
Look for connections persisting outside of normal business hours
AN1190
Analytic 1190
Linux
Detects command-line tools, agents, or scripts making outbound HTTPS connections to popular web services like Discord, Slack, Dropbox, or Graph API in an unusual context.
auditd:SYSCALL
connect/sendto
NSM:Flow
conn.log, ssl.log
[ParentProcess]
Unusual parent-child process behavior initiating external comms (e.g., bash > curl)
[HostnamePattern]
Destination hostnames (e.g., *.dropboxapi.com, *.graph.microsoft.com)
[RequestFrequency]
Repeated requests at unusual intervals, suggesting beaconing
AN1191
Analytic 1191
macOS
Detects user agents or background services making unauthorized or unscheduled web API calls to cloud/web services over HTTPS.
macos:unifiedlog
process + network activity
macos:osquery
process_events, socket_events
[ProcessSignature]
Unsigned or user-modified apps communicating with cloud services
[ConnectionInterval]
Beacon-like pattern of regular outbound communication
AN1192
Analytic 1192
ESXi
Detects guest VMs or management agents issuing HTTP(S) traffic to external services without a valid patch management or backup justification.
esxi:vmkernel
network activity
vpxd.log
API communication
[RemoteIPRange]
Filter to detect only external/public destinations
[VMContext]
Exclude known backup or patch automation services