AN1413
Analytic 1413
Windows
Detects non-browser processes that establish encrypted outbound connections (e.g., TLS/SSL) to unfamiliar or atypical destinations for the host/user, following a data staging or compression event.
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Sysmon
EventCode=1
WinEventLog:Security
EventCode=4663, 4670, 4656
NSM:Flow
ssl.log - Certificate Analysis
[TimeWindow]
Correlates file access, encryption, and network transmission within a timeframe (e.g., 5 minutes).
[CertificateIssuerDenylist]
Blocks or flags untrusted certificate authorities in SSL/TLS handshakes.
[BinaryAllowlist]
Whitelist for known-good applications allowed to use encrypted outbound traffic.
AN1414
Analytic 1414
Linux
Detects staged file access (e.g., archive or obfuscation), followed by an encrypted outbound connection (TLS/HTTPS) from unusual processes such as curl/wget, Python scripts, or custom binaries.
auditd:SYSCALL
execve
auditd:SYSCALL
connect
NSM:Flow
ssl.log, conn.log
auditd:SYSCALL
open, read
[ConnectionDestinationScope]
Restrict outbound connections to non-corporate domains or IPs.
[FileAccessExtensionList]
List of extensions considered sensitive or exfil-worthy (e.g., .zip, .db, .xlsx).
[SSLClientProcessBaseline]
Define normal encrypted-traffic-capable binaries.
AN1415
Analytic 1415
macOS
Detects abnormal encrypted network connections (via TLS/HTTPS) initiated by non-browser binaries, particularly after sensitive file access or compression events.
macos:osquery
socket_events
macos:osquery
process_events
macos:unifiedlog
log stream - file provider subsystem
NSM:Flow
ssl.log, x509.log
[OutboundTrafficVolumeThreshold]
Trigger detection for large amounts of outbound encrypted data.
[FileSensitivityContext]
Tagging and prioritizing high-value directories/files in detection logic.
AN1416
Analytic 1416
ESXi
Detects unexpected encrypted outbound connections from management components or guest VMs using TLS, particularly after data volume spikes or script-based orchestration from within guest environments.
esxi:hostd
event stream
esxi:vmkernel
egress logs
[VMToEgressPathWatchlist]
Expected traffic routes for monitored VMs.
[TLSClientAppIdentifier]
Applications allowed to initiate TLS sessions from hypervisor level.