AN0922
Analytic 0922
Windows
Unusual process (e.g., `rundll32`, `mshta`, `wscript`, or custom payloads) initiates network connection to external IPs/domains that proxy C2 traffic, often over uncommon ports or high entropy HTTP/S connections.
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Sysmon
EventCode=1
WinEventLog:Microsoft-Windows-Windows Defender/Operational
Unusual external domain access
[DestinationASN]
Adjust for known benign but high-risk infrastructure (e.g., hosting providers like DigitalOcean, OVH, etc.).
[ParentProcess]
Detect suspicious lineage—proxy tools launched from script interpreters or LOLBins.
[EntropyThreshold]
Tune based on expected randomness in outbound request payloads.
AN0923
Analytic 0923
Linux
`curl`, `wget`, `ncat`, `socat`, or custom binaries initiate outbound traffic to Internet-based proxies (e.g., via VPS or CDN). Behavior may include reverse shell constructs or persistent outbound beacons.
auditd:SYSCALL
execve
NSM:Flow
conn.log or http.log
NSM:Flow
alert log
[CommandLinePattern]
Regex or command substring matches indicative of dynamic proxy setup.
[ExternalIPList]
Tunable list of IPs or ASNs related to known proxy/VPS abuse.
[UserContext]
Unexpected users running networking tools (e.g., www-data, apache).
AN0924
Analytic 0924
macOS
AppleScript or terminal sessions launch tools (`curl`, `nc`, `ssh`) to external IPs not commonly accessed. Outbound connections are made by LaunchAgents/LaunchDaemons, often masquerading as system services.
macos:unifiedlog
process logs
NSM:Flow
pf firewall logs
macos:osquery
launchd or network_events
[LaunchAgentPath]
Detect persistence used to restart proxy after reboot.
[ExternalPort]
Often high or non-standard ports, configurable for outbound proxy detection.
[ProcessReputation]
Flag unsigned or anomalous binaries making external connections.
AN0925
Analytic 0925
ESXi
ESXi shell or guest VM tools initiate external connections via scripted traffic forwarding to Internet-based proxies. Detected by firewall or shell audit logs showing outbound connection spikes from hypervisor or guest VM to remote proxy nodes.
esxi:shell
None
esxi:vmkernel
None
NSM:Flow
conn.log
[VMOutboundPatterns]
Detect when VMs communicate with Internet IPs not in workload profiles.
[ProxyHostPattern]
Regex for proxy-related tools/scripts executed on the host.
[ConnectionDirectionality]
Outbound only connections from ESXi to new IPs.
AN0926
Analytic 0926
Network Devices
Changes to NAT/firewall policies enabling outbound port forwarding from internal IPs to Internet-based proxy endpoints. Log spikes in outbound flows to CDN, VPS, or anomalous ASNs with few return packets.
Firewall Audit Logs
Outbound NAT Rule Changes
NSM:Flow
Outbound flow records
networkdevice:syslog
Dynamic route changes
[FlowThreshold]
Number of flows or bytes transferred per minute—flag surges to unrecognized ASNs.
[DestinationIPCategory]
Proxy destination categories: CDN, TOR exit node, anonymous hosting.
[ConfigChangeUser]
Track if unexpected user or automation changed NAT/forwarding rules.