AN0367
Analytic 0367
Windows
Detects unusual outbound file transfer behavior using protocols like FTP, SMB, SMTP, or DNS, involving non-standard processes, off-hour activity, or uncommonly high volume.
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Sysmon
EventCode=11
WinEventLog:Security
EventCode=4688
[DataVolumeThresholdMB]
Set threshold for outbound volume (e.g., >50MB in a single connection).
[ProtocolAllowList]
Allow-listed protocols in use for specific machines or users (e.g., FTP allowed for backups).
[TimeWindow]
Define allowed time-of-day windows (e.g., flag after-hours file transfer).
[ParentProcessAnomaly]
Identify anomalous parent-child process relationships (e.g., `winword.exe` spawning `ftp.exe`).
AN0368
Analytic 0368
Linux
Detects file exfiltration using tools like curl, scp, or custom binaries over protocols such as FTP, HTTP/S, or DNS tunneling, especially outside baseline user behavior.
auditd:SYSCALL
execve
auditd:SYSCALL
connect
auditd:SYSCALL
open
auditd:SYSCALL
write
NSM:Flow
NetFlow/Zeek conn.log
[ProtocolType]
Flag unexpected protocols (e.g., HTTP on port 53 or FTP traffic from non-standard tools).
[UserContext]
Scope for privilege escalation or service account behavior.
[FileExtensionSensitivity]
Track movement of file types of interest (e.g., `.csv`, `.sql`, `.key`).
AN0369
Analytic 0369
macOS
Detects non-native file transfer via curl, Python scripts, or AppleScript using uncommon protocols like FTP, SMTP, or DNS exfiltration through mDNSResponder abuse.
macos:unifiedlog
log stream (subsystem: com.apple.system.networking)
macos:osquery
process_events
macos:osquery
file_events
[ProtocolUnusualnessScore]
Weight rarely-used protocols in user space.
[ExecutableBaselining]
Track which binaries usually call curl/nc and alert on deviation.
AN0370
Analytic 0370
IaaS
Detects access to cloud APIs or CLI tools to move or sync files from sensitive buckets to external endpoints using protocols like HTTPS or S3 APIs.
AWS:CloudTrail
GetObject, CopyObject
AWS:VPCFlowLogs
Outbound data flows
[IAMRoleContext]
Detect unauthorized use of roles for cloud storage manipulation.
[GeoDestinationThreshold]
Alert on outbound flows to geo-locations not seen in training baseline.
AN0371
Analytic 0371
ESXi
Detects outbound traffic from hostd/vpxa or guest VM interfaces using unauthorized protocols such as FTP, HTTP POST bursts, or long-lived DNS tunnels.
esxi:hostd
logline inspection
esxi:vmkernel
protocol egress
[GuestTrafficBaseline]
Expected protocols used by VMs attached to host interfaces.
[ServiceAccountProfile]
Unexpected network activity from hypervisor processes or monitoring agents.