AN0100
Analytic 0100
Windows
Suspicious processes initiating encrypted HTTPS connections to common web service domains, followed by abnormal data upload behavior or automated posting behavior indicative of C2 bidirectional traffic.
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Sysmon
EventCode=1
etw:Microsoft-Windows-WinINet
HTTPS Inspection
[TimeWindow]
Timeframe for evaluating multiple network connections tied to the same process
[DomainPattern]
Regex or string patterns used to identify common Web service infrastructure (e.g., *.googleapis.com)
[PayloadSizeThreshold]
Minimum data upload size before flagging anomaly
[ProcessNameExclusionList]
Known benign updaters or service processes to reduce false positives
AN0101
Analytic 0101
Linux
Non-interactive system processes making encrypted HTTPS connections to well-known web services followed by high outbound traffic volume or scripted upload patterns.
auditd:SYSCALL
execve
NSM:Flow
conn.log
NSM:Flow
ssl.log
[UploadDirectionality]
Bias detection toward sessions with larger upload vs download volume
[HostnameRegexList]
List of known public Web services used for dead drops or C2 (e.g., GitHub, Twitter)
[ScriptParentName]
Shell interpreter or automated job parent used for filtering (e.g., /usr/bin/python)
AN0102
Analytic 0102
macOS
Scripting engines (e.g., osascript, Python) initiating HTTPS requests to social media or content-sharing platforms, paired with automated response handling indicative of two-way communication.
macos:unifiedlog
log stream --info --predicate 'subsystem == "com.apple.cfprefsd"'
NSM:Connections
web domain alerts
[ScriptEngineList]
Scripting interpreters to monitor for unusual HTTP traffic (e.g., osascript, ruby, bash)
[SocialMediaDomainPatterns]
Patterns or domains used for C2 dead drops and responses (e.g., pastebin.com, twitter.com)
[BurstConnectionRate]
Threshold for number of short-lived HTTPS connections in a short window