AN1389
Analytic 1389
Windows
Detects the execution of non-browser processes establishing outbound encrypted network connections using uncommon symmetric encryption protocols (e.g., AES via PowerShell or custom scripts) to alternate external destinations.
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Sysmon
EventCode=1
[PayloadEntropyThreshold]
Flag high-entropy payloads sent over unexpected protocols.
[TimeWindow]
Define allowable transfer window (e.g., abnormal traffic outside business hours).
[ExecutableAllowlist]
List of known-good binaries for encrypted traffic (e.g., Chrome, Outlook).
AN1390
Analytic 1390
Linux
Detects command-line utilities or scripts using encryption libraries or symmetric algorithms (e.g., OpenSSL AES, GPG, Python + PyCrypto) in conjunction with outbound file transfers or traffic to external destinations.
auditd:SYSCALL
execve
auditd:SYSCALL
connect
NSM:Flow
conn.log or flow data
NSM:Flow
ssl.log (for TLS handshake analysis), dns.log (tunneling indicators)
[FileTransferIndicator]
Threshold for transferred data size or extension type.
[LibraryCallTracking]
Hooks into use of encryption libraries like `libcrypto.so`, `pycrypto`, `gpg`.
AN1391
Analytic 1391
macOS
Detects symmetric key-based encryption operations (e.g., AES via Python, AppleScript, or OpenSSL) followed by unusual outbound connections from non-browser applications or scripted tools.
macos:unifiedlog
log stream process subsystem
macos:osquery
socket_events
macos:unifiedlog
log stream network activity
[ApplicationProfileBaseline]
Expected outbound connection profiles per app.
[EncryptionRoutinePattern]
Indicators of manual encryption operations (e.g., script strings invoking AES).
AN1392
Analytic 1392
ESXi
Detects unexpected encrypted egress traffic from management services (e.g., hostd) or guest VMs utilizing symmetric encryption without traditional protocols (e.g., FTP with embedded AES ciphertext).
esxi:vmkernel
egress log analysis
esxi:hostd
execution + payload hints
NSM:Flow
host switch egress data
[GuestVMExfilWatchlist]
VMs with data sensitivity labels or outside normal behavior.
[ServiceEgressProfile]
Expected egress destinations and volume for core services.