AN0204
Analytic 0204
Windows
Anomalous process (e.g., `rundll32`, `svchost`, `cmd`) initiates connections to internal peer hosts not seen in typical communication baselines, used to proxy or forward traffic internally, often using SMB, RPC, or high ports.
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Sysmon
EventCode=1
Windows Firewall Log
SMB over high port
[InternalConnectionPattern]
Tune based on known host-to-host communications that are rare (e.g., workstation-to-workstation).
[DestinationPort]
Focus on unusual internal traffic on ports like 1080, 8080, 4444, or SMB over non-standard ports.
[TimeWindow]
Correlate unusual traffic bursts with new process execution.
AN0205
Analytic 0205
Linux
`socat`, `ssh`, `iptables`, or `ncat` invoked from user space or cron jobs to create port forwarding, reverse shells, or inter-host tunnels between compromised Linux systems. Behavior is typically paired with socket activity and high entropy traffic.
auditd:SYSCALL
execve
NSM:Connections
Internal connection logging
NSM:Flow
conn.log
[UserContext]
Alert on unexpected users executing inter-host relay tools (e.g., `www-data`, `backup`).
[PortRange]
Adjust to watch for commonly misused internal TCP/UDP ports.
[ProcessPattern]
Shell pipelines or wrapped invocations like `bash -c 'socat ...'`
AN0206
Analytic 0206
macOS
Execution of AppleScript or Automator services launching `ssh -L`, `socat`, or `launchctl` items that dynamically reroute traffic from one Mac endpoint to another. LaunchAgents used to establish permanent internal tunnels.
macos:unifiedlog
None
NSM:Flow
pf firewall logs
macos:osquery
Process Events and Launch Daemons
[LaunchAgentPath]
Directory where proxying LaunchDaemons may be dropped, e.g., `/Library/LaunchDaemons/`.
[PortBindings]
Dynamic port forwards often use ephemeral or non-standard service ports.
[AppleScriptUsage]
May trigger on less common scripting interfaces for traffic redirection.
AN0207
Analytic 0207
ESXi
ESXi shell execution of tools/scripts (`nc`, `socat`, `perl`) relaying network traffic to other internal hosts, especially when initiated by unauthorized users or VMs.
esxi:shell
/var/log/shell.log
esxi:vmkernel
/var/log/vmkernel.log
NSM:Flow
conn.log
[CLICommandPattern]
Watch for chained shell commands building local-to-local connections.
[VMInitiator]
Correlate to which VM initiated the traffic tunnel; unexpected VM behavior may be suspicious.
[ConnectionDirectionality]
Unusual east-west communication patterns among VMs.
AN0208
Analytic 0208
Network Devices
Configuration of internal NAT or proxy rules that redirect traffic between client segments internally (e.g., site-to-site port forwarding). Often used to relay internal beaconing or move traffic laterally through trust zones.
Firewall Audit Logs
Config Change
NSM:Flow
Inter-segment traffic
networkdevice:cli
Policy Update
[ProxyTarget]
Internal subnets or endpoint roles allowed for port forwarding.
[ConfigChangeUser]
Detect changes made outside scheduled or authorized windows.
[FlowThreshold]
Volume of data relayed through proxy exceeds historical norms.