AN0651
Analytic 0651
Windows
Detect the creation or modification of common media file formats (e.g., .jpg, .png, .wav) following suspicious process activity like compression or encryption, especially when paired with lateral movement or exfiltration behavior.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=3, 22
NSM:Flow
Session Transfer Content
[FileExtensionFilter]
Allows tuning of monitored file types (e.g., .jpg, .png, .docx).
[PayloadEntropyThreshold]
Threshold for flagging potential hidden data in outbound payloads.
[ExecutionToExfilTimeWindow]
Time window between media creation and network transmission.
AN0652
Analytic 0652
Linux
Unusual use of steganographic or media processing binaries (e.g., `steghide`, `ffmpeg`, `imagemagick`) followed by outbound communication to external IPs with high data output and media MIME types.
auditd:SYSCALL
execve
NSM:Flow
Captured File Content
NSM:Flow
Observed File Transfers
[ToolNameMatch]
Specify which binaries to monitor (e.g., steghide, outguess).
[OutboundTrafficPattern]
Adjust based on known normal file upload services.
AN0653
Analytic 0653
macOS
Abnormal usage of Preview, ImageMagick, or binary editors to alter images/documents, followed by exfiltration or outbound connections with mismatched file MIME types or payload structure.
macos:unifiedlog
File creation
macos:osquery
process_events
NSM:Flow
C2 exfiltration
[ParentProcessBaseline]
Allow tuning based on expected apps calling image-editing tools.
[TimeDelta]
Gap between file manipulation and outbound connection.
AN0654
Analytic 0654
ESXi
Suspicious modification of file artifacts (e.g., logs, ISO templates) on ESXi datastores, followed by beaconing or POST operations to external IPs potentially hiding payloads in file-like traffic.
esxi:vmkernel
Storage access and file ops
esxi:hostd
Service initiated connections
NSM:Flow
Transferred file observations
[FilenamePattern]
Tune for likely stego file names (e.g., wallpaper.jpg, template.iso).
[UnusualDestinationIP]
Destination outside vCenter management subnet.