AN0423
Analytic 0423
Windows
Detects data access or staging events followed by outbound data flows using unencrypted protocols (e.g., FTP, HTTP) initiated by unexpected processes or to rare destinations.
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Sysmon
EventCode=1
WinEventLog:Security
EventCode=4663, 4670, 4656
NSM:Flow
http.log, ftp.log
[UnencryptedProtocolList]
Set of protocols considered suspicious for outbound data exfiltration (e.g., FTP, HTTP).
[DataTransferSizeThreshold]
Defines what amount of outbound data is considered abnormal for a host/user.
[ParentProcessDenylist]
Processes that should not launch FTP/HTTP clients (e.g., winword.exe launching ftp.exe).
AN0424
Analytic 0424
Linux
Detects file access or compression utilities followed by outbound connections using curl, wget, ftp, or custom binaries communicating over unencrypted protocols.
auditd:SYSCALL
execve
auditd:SYSCALL
connect
NSM:Flow
http.log, ftp.log
NSM:Flow
flow records
[SensitiveDirectoryWatchlist]
Flag access to paths known to store sensitive or regulated data.
[ProcessBaseline]
Define which binaries are allowed to communicate externally using HTTP/FTP.
[TimeWindow]
Correlates process/file/network within a defined time window.
AN0425
Analytic 0425
macOS
Detects abnormal outbound HTTP/FTP connections by local scripts or binaries outside of standard browser activity, following access to local documents or user data.
macos:osquery
socket_events
macos:osquery
process_events
macos:unifiedlog
log stream - file subsystem
NSM:Flow
http.log, ftp.log
[ScriptedClientAllowlist]
Defines allowed automated agents that may transmit HTTP or FTP data (e.g., backup tools).
[PayloadInspectionKeywordList]
Terms or patterns indicating structured or sensitive data leaving via HTTP/FTP.
AN0426
Analytic 0426
ESXi
Detects shell-based scripts accessing configuration files or snapshots and transmitting them over unencrypted protocols such as FTP or HTTP to non-management IPs.
esxi:hostd
event stream
NSM:Flow
flow records
NSM:Flow
http.log
[VMConfigAccessPathWatchlist]
Locations of VMX/CFG/SNAPSHOT files that should not be accessed by non-admin shells.
[OutboundProtocolProfile]
Expected network protocols for guest and host interfaces.
AN0427
Analytic 0427
Network Devices
Detects use of unencrypted protocols (e.g., TFTP, FTP, HTTP) to transfer configuration files, routing tables, or logs to untrusted IP addresses, especially using administrative commands like `copy run ftp:`.
networkdevice:cli
CLI command logs
networkdevice:syslog
flow records
NSM:Flow
PCAP inspection
[ProtocolCommandWatchlist]
Flag commands like `copy`, `archive tar`, or `upload` directed at external hosts.
[DestinationIPBlocklist]
Define external IP ranges unauthorized to receive router/switch configs.