AN0750
Analytic 0750
Windows
Logon via RDP or WMI by a user account followed by uncommon command execution, file manipulation, or lateral network connections.
WinEventLog:Security
EventCode=4624, 4648
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=3, 22
[TimeWindow]
Correlation window between remote login and post-access activity
[LogonUser]
Limit to service accounts or privileged users for higher fidelity
[RemoteHostList]
Allowlisting known admin jumpboxes or deployment tools
AN0751
Analytic 0751
Linux
SSH session from new source IP followed by interactive shell or privilege escalation (e.g., sudo, su) and outbound lateral connection.
linux:syslog
sshd: Accepted password/publickey
auditd:SYSCALL
execve, USER_CMD
[SourceIP]
Limit to new/unexpected SSH source IPs
[CommandList]
Flag suspicious post-SSH command patterns
AN0752
Analytic 0752
macOS
Remote login via ARD or SSH followed by screensharingd process activity or modification of TCC-protected files.
macos:unifiedlog
eventMessage CONTAINS 'screensharingd' or 'AuthorizationRefCreate'
macos:osquery
process_events
[RemoteService]
Differentiate ARD vs SSH access patterns
[TargetedPath]
Tunable list of sensitive directories or TCC targets
AN0753
Analytic 0753
IaaS
Use of cloud-based bastion or VM console session followed by commands that initiate outbound SSH or RDP sessions from the cloud instance to other environments.
AWS:CloudTrail
AWS ConsoleLogin, StartSession
AWS:VPCFlowLogs
Outbound connections to port 22, 3389
[SourceAssetTag]
Limit detection to cloud admin/bastion hosts
[TargetPortList]
Define critical remote service ports to flag
AN0754
Analytic 0754
ESXi
vSphere API logins (vimService) or SSH to ESXi host followed by unauthorized shell commands or lateral remote logins from the ESXi host.
esxi:vmkernel
vim.fault.*, DCUI login, SSH shell
esxi:shell
Command execution trace
[SessionType]
Filter by DCUI, SSH, vSphere API
[CommandPattern]
Watch for remote access tool invocations (e.g., netcat, ssh)