AN0400
Analytic 0400
Windows
Processes that typically do not perform cryptographic operations loading symmetric encryption libraries (e.g., bcryptprimitives.dll, aes.dll), then initiating outbound connections with high-entropy payloads. Defender correlates process creation, DLL load, and anomalous encrypted traffic patterns.
WinEventLog:Sysmon
EventCode=7
WinEventLog:Sysmon
EventCode=3, 22
[AllowedCryptoProcesses]
Processes normally expected to use symmetric crypto (e.g., disk encryption, secure messaging).
[EntropyThreshold]
Minimum payload entropy score for flagging unusual encrypted sessions.
[TimeWindow]
Correlation window between module load and encrypted connection creation.
AN0401
Analytic 0401
Linux
Unexpected processes (e.g., bash, python, custom binaries) dynamically loading libcrypto or performing AES/RC4 encryption operations, then initiating outbound sessions with abnormal byte entropy or asymmetric traffic patterns.
auditd:SYSCALL
execve or socket/connect system calls from processes using crypto libraries
linux:syslog
System daemons initiating encrypted sessions with unexpected destinations
linux:osquery
Process linked with libcrypto.so making external connections
[TrustedCryptoLibs]
Baseline expected crypto libraries to suppress false positives.
[TrafficAsymmetryRatio]
Ratio of sent/received bytes indicating possible hidden C2.
AN0402
Analytic 0402
macOS
Launchd jobs or user processes invoking symmetric crypto APIs from the Security framework and generating outbound connections carrying randomized payloads inconsistent with normal TLS patterns.
macos:unifiedlog
Process using AES/RC4 routines unexpectedly
macos:unifiedlog
Encrypted connection with anomalous payload entropy
[DoHResolvers]
Legitimate DNS-over-HTTPS endpoints to avoid FP.
[PayloadEntropyThreshold]
Define entropy level at which traffic should be flagged.
AN0403
Analytic 0403
ESXi
ESXi daemons (hostd, vpxa) unexpectedly using symmetric encryption routines for external connections. Defender identifies logs of service traffic with encrypted payloads inconsistent with VMware management baselines.
esxi:vpxd
Symmetric crypto routines triggered for external session
esxcli:network
Socket sessions with randomized payloads inconsistent with TLS
[AllowedMgmtHosts]
Baseline list of approved vCenter and update endpoints.
AN0404
Analytic 0404
Network Devices
Flows showing encrypted payloads with high entropy not matching TLS handshake patterns, particularly when occurring on non-standard ports. Defender observes NetFlow/IPFIX byte distribution anomalies or IDS/IPS detecting symmetric encryption patterns without associated key exchange.
NSM:Flow
Flow records with entropy signatures resembling symmetric encryption
NSM:Connections
Symmetric encryption detected without TLS handshake sequence
[PortProfiles]
Baseline expected encryption by port/protocol.
[TrafficVolumeThreshold]
Volume thresholds for distinguishing benign VPN traffic from hidden C2.