AN0787
Analytic 0787
Windows
Unexpected processes (e.g., powershell.exe, wscript.exe, office apps) initiating HTTP POST/PUT requests to text storage domains like pastebin.com or hastebin.com, particularly when preceded by file access in sensitive directories. Defender perspective: correlation of process lineage, large clipboard/file read operations, and outbound uploads to text storage services.
WinEventLog:Security
EventCode=4663, 4670, 4656
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Sysmon
EventCode=1
[TextStorageDomains]
Domains to monitor such as pastebin.com, hastebin.com, ghostbin.com.
[UploadSizeThreshold]
Minimum data size (e.g., >500KB) to trigger alerts for suspicious uploads.
[UserContext]
User accounts with legitimate business justification for posting to text storage sites.
AN0788
Analytic 0788
Linux
Use of curl, wget, or custom scripts to POST data to pastebin-like services. Defender perspective: identify chained behavior where files are compressed/read followed by HTTPS POST requests to text-sharing endpoints.
auditd:EXECVE
curl -d, wget --post-data
auditd:SYSCALL
read/open of sensitive file directories
NSM:Flow
large HTTPS POST requests to text storage domains
[AllowedTools]
Whitelist of tools (e.g., curl for package repos) to reduce false positives.
[WorkHours]
Expected time ranges for developer interactions with external paste sites.
AN0789
Analytic 0789
macOS
Processes such as osascript, curl, or office applications sending data to text storage APIs/domains. Defender perspective: anomalous clipboard or file reads by unexpected applications immediately followed by outbound HTTPS requests to pastebin-like services.
macos:unifiedlog
execution of curl, osascript, or unexpected Office processes
macos:unifiedlog
file read of sensitive directories
macos:unifiedlog
HTTPS POST requests to pastebin.com or similar
[WatchedApps]
Processes not normally associated with data uploads (e.g., Preview, Calculator).
[EntropyThreshold]
High entropy detection to flag encoded or encrypted data exfiltration.
AN0790
Analytic 0790
ESXi
ESXi services (vmx, hostd) generating outbound HTTPS POST requests to text storage sites. Defender perspective: anomalous datastore or log reads chained with traffic to pastebin-like destinations.
esxi:hostd
datastore/log file access
esxi:vmkernel
HTTPS POST connections to pastebin-like domains
[DatastoreExfilThreshold]
Threshold of bytes exfiltrated from ESXi datastore files.
[ApprovedDestinations]
Whitelist of domains approved for API communication to prevent false positives.