AN1118
Analytic 1118
Windows
Recurring network exfiltration initiated by scheduled or script-based processes exhibiting time-based regularity and consistent external destinations.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:System
EventCode=106, 200
[TimeWindow]
Duration threshold to consider a connection repetitive (e.g., same hour daily)
[DestIPAllowlist]
Known external destinations to exclude (e.g., approved SFTP/backup servers)
[ParentProcessBaseline]
Allowlisted job runners or scripts known to schedule legitimate transfers
AN1119
Analytic 1119
Linux
Detection of cron-based or script-based recurring transfers where the same script, user, or destination reappears at predictable intervals.
auditd:SYSCALL
execve
linux:cron
cron activity
NSM:Flow
Outbound Connections
[ScriptPathRegex]
Path patterns for shell scripts responsible for scheduled transfers
[CronIntervalThreshold]
Minimum repetition frequency (e.g., 24h for daily jobs)
[ExfilUserContext]
Suspicious or unexpected users launching scheduled transfers
AN1120
Analytic 1120
macOS
LaunchAgent or launchd recurring jobs initiating data transfer to consistent external IPs or domains with repeat timing signatures.
macos:endpointsecurity
ES_EVENT_TYPE_NOTIFY_EXEC
macos:launchd
launchd.plist and logs
macos:unifiedlog
networkd or com.apple.network
[AgentPathPatterns]
Regex for job locations like ~/Library/LaunchAgents/
[RepeatIntervalDelta]
Time-based logic to determine schedule (e.g., ~24h ± 5m)
[UserHomeJobs]
Transfers originating from non-admin user context