Detect Obfuscated C2 via Network Traffic Analysis

3 analytic(s) · 1 technique(s) detected

Analytics

AN0144 Analytic 0144

Windows

Detects excessive outbound traffic to remote host over HTTP(S) from uncommon or previously unseen processes.

NSM:Flow HTTP

[OutboundByteThreshold] Defines threshold ratio of outbound to inbound bytes that signals possible obfuscation

[ProcessAllowlist] List of known legitimate network clients to exclude from anomaly checks

AN0145 Analytic 0145

Linux

Identifies custom or previously unseen userland processes initiating high-volume HTTP connections with low response volume.

auditd:SYSCALL connect

[UserProcessBaseline] Defines what is considered abnormal for a user-initiated process context

AN0146 Analytic 0146

macOS

Flags unexpected user applications initiating long-lived HTTP(S) sessions with irregular traffic patterns.

macos:unifiedlog network flow macos:unifiedlog process

[SessionDuration] Session length that exceeds average per-user expectations

Command & Control (1)