AN1004
Analytic 1004
Windows
Unusual or unauthorized external remote access attempts (e.g., RDP, VPN, Citrix) → repeated failed logins followed by a successful session from uncommon geolocations or outside business hours → subsequent internal lateral movement or data exfiltration activities.
WinEventLog:Security
EventCode=4776, 4625
WinEventLog:Application
VPN, Citrix, or remote access gateway logs showing external IP addresses
WinEventLog:Sysmon
EventCode=3, 22
[BusinessHours]
Normal business hours for logon activity.
[KnownRemoteIPs]
List of approved external IPs or VPN endpoints.
[FailedLogonThreshold]
Number of failed logons before raising suspicion (e.g., >5).
[GeoIPWhitelist]
Geographic regions allowed for remote access.
[TimeWindow]
Time window to correlate failed attempts and success (e.g., 15m).
AN1005
Analytic 1005
Linux
Repeated SSH, VPN, or RDP gateway authentication attempts from external IPs → subsequent successful logon → remote shell or lateral movement activity (e.g., scp/sftp).
auditd:SYSCALL
ssh logins or execve of remote commands
NSM:Connections
Failed password or accepted password for SSH users
NSM:Flow
connection: Inbound connections to SSH or VPN ports
[KnownSSHClients]
Legitimate IPs or client fingerprints for SSH/VPN.
[FailedLogonThreshold]
Number of failed SSH logins to trigger alert.
[TimeWindow]
Correlation window for failed attempts and success.
AN1006
Analytic 1006
macOS
Unexpected inbound or outbound VNC/SSH/Screen Sharing connections from external sources → repeated failed logins followed by success → remote interactive sessions or abnormal file transfers.
macos:unifiedlog
Remote login (ssh) or screen sharing authentication attempts
macos:unifiedlog
Inbound connections to VNC/SSH ports
PF:Logs
External traffic to remote access services
[KnownVNCServers]
List of approved VNC/SSH sources.
[TimeWindow]
Time correlation between failed attempts and success.
AN1007
Analytic 1007
Containers
Connections to exposed container services (e.g., Docker API, Kubernetes API server) from unauthorized external IPs → abnormal container creation/start → lateral activity within cluster nodes.
ApplicationLog:API
Docker/Kubernetes API access from external sources
kubernetes:audit
Unauthorized container creation or kubelet exec logs
NSM:Flow
External access to container ports (2375, 6443)
[AllowedCIDRs]
Approved external IP ranges for container APIs.
[TimeWindow]
Correlation window for API calls and container starts.