AN0823
Analytic 0823
Windows
Detects suspicious DNS/ARP poisoning attempts, unauthorized modifications to registry/network configuration, or abnormal TLS downgrade activity. Correlates changes in system configuration with subsequent unusual network flows or authentication events.
WinEventLog:Security
EventCode=4663, 4670, 4656
WinEventLog:Sysmon
EventCode=3, 22
[MonitoredRegistryPaths]
Specific network stack and DNS registry keys that vary by enterprise configuration.
[DowngradeCipherList]
List of weak/legacy ciphers tuned per environment for TLS downgrade detection.
[TimeWindow]
Correlation period between config changes and abnormal network connections.
AN0824
Analytic 0824
Linux
Detects unauthorized edits to /etc/hosts, /etc/resolv.conf, or suspicious ARP broadcasts. Correlates file modifications with subsequent unexpected network sessions or service creation.
auditd:SYSCALL
open, write
NSM:Flow
Unexpected ARP replies or DNS responses inconsistent with authoritative servers
[MonitoredFiles]
List of system files shaping traffic flow (hosts, resolv.conf, PAM modules).
[ARPThreshold]
Rate/volume thresholds for ARP/DNS anomalies tuned per subnet.
AN0825
Analytic 0825
macOS
Detects unauthorized edits to system configuration profiles, unexpected certificate trust changes, or abnormal ARP/DNS patterns indicative of interception.
macos:unifiedlog
Configuration profile modified or new profile installed
NSM:Flow
TLS downgrade or inconsistent DNS answers
[ProfileIdentifiers]
Known good vs suspicious configuration profiles per enterprise baseline.
[TLSVersionThreshold]
Minimum TLS version accepted in network traffic inspection.
AN0826
Analytic 0826
Network Devices
Detects unauthorized firmware or configuration changes enabling adversary-in-the-middle positioning (e.g., route injection, DNS spoofing, SSL downgrade). Behavioral analytics focus on sudden changes to routing tables or image file integrity failures.
NSM:Flow
Unexpected route changes or duplicate gateway advertisements
networkdevice:config
Configuration file modified or replaced on network device
[RoutingPolicyBaseline]
Expected routing and BGP/OSPF paths for validation.
[FirmwareChecksum]
Baseline image checksum per device type used to detect tampering.