AN0436
Analytic 0436
Windows
Unusual processes (e.g., powershell.exe, wscript.exe, mshta.exe) posting data to webhook endpoints (Discord, Slack, webhook.site) using HTTP POST/PUT requests. Defender perspective: suspicious process lineage followed by outbound HTTPS traffic to webhook domains.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Security
EventCode=4663, 4670, 4656
[WebhookDomains]
Domains to monitor such as discord.com/api/webhooks, slack.com/api, webhook.site.
[UploadSizeThreshold]
Threshold for abnormal data sent via webhook requests.
[ApprovedApps]
List of approved business apps using webhooks to reduce noise.
AN0437
Analytic 0437
Linux
Processes such as curl, wget, or custom scripts initiating POST requests to webhook endpoints with encoded or bulk data. Defender perspective: abnormal chaining of file compression or access followed by outbound data to webhook URLs.
auditd:EXECVE
curl -X POST, wget --post-data
auditd:SYSCALL
read/open of sensitive files
NSM:Flow
large HTTPS POST requests to webhook endpoints
[AllowedTools]
Expected command-line utilities allowed to interact with webhooks in enterprise environments.
[TimeWindow]
Expected timeframe for legitimate webhook traffic (e.g., CI/CD deployments).
AN0438
Analytic 0438
macOS
Unexpected apps or scripts (osascript, curl, Automator workflows) exfiltrating data via webhooks. Defender perspective: correlation of clipboard/file read operations followed by HTTPS POST traffic to webhook services.
macos:unifiedlog
execution of osascript, curl, or unexpected automation
macos:unifiedlog
file read of sensitive directories
macos:unifiedlog
HTTPS POST to known webhook URLs
[WebhookEndpoints]
Webhook URLs monitored for exfiltration.
[EntropyThreshold]
High entropy payloads may indicate encoded/encrypted exfiltration.
AN0439
Analytic 0439
ESXi
VMware services or management daemons generating HTTP POST requests to webhook endpoints, chained with unusual datastore or log access. Defender perspective: exfiltration from VM logs or disk images over webhook URLs.
esxi:hostd
datastore file access
esxi:vmkernel
HTTPS POST connections to webhook endpoints
[DatastoreExfilThreshold]
Minimum data volume to flag exfiltration attempts from VM files.
[ApprovedIntegrations]
Whitelisted CI/CD or automation webhooks tied to vSphere/ESXi.
AN0440
Analytic 0440
SaaS
Suspicious SaaS tenant activity involving webhook configurations pointing to external or untrusted domains. Defender perspective: repeated automated exports or suspicious webhook endpoint registrations.
m365:unified
Set-Mailbox, Add-InboxRule, RegisterWebhook
saas:api
Webhook registrations or repeated POST activity
[WebhookRegistrations]
Monitor new webhook creation events in SaaS environments.
[ExternalDomains]
Flag webhooks pointing to domains not owned by the enterprise.