AN1496
Analytic 1496
Windows
Processes not typically associated with encryption loading asymmetric crypto libraries (e.g., rsaenh.dll, crypt32.dll) and subsequently initiating outbound TLS/SSL connections with abnormal certificate chains or handshakes. Defender correlates process creation, module load, and unusual encrypted sessions.
WinEventLog:Sysmon
EventCode=7
WinEventLog:Sysmon
EventCode=3, 22
[AllowedCryptoProcesses]
Whitelist browsers, mail clients, or apps expected to use asymmetric crypto.
[CertificateAuthorityList]
Baseline CA list for validating abnormal certs.
[HandshakeTimeout]
Detection of incomplete or malformed handshakes.
AN1497
Analytic 1497
Linux
Processes (e.g., bash, python, custom binaries) dynamically linking libcrypto/libssl for RSA key exchange, then creating external connections with abnormal certificate validation or handshake anomalies. Defender observes syscall traces and outbound asymmetric key exchanges from non-SSL-native processes.
auditd:SYSCALL
execve or socket/connect system calls for processes using RSA handshake
linux:syslog
Non-standard processes negotiating SSL/TLS key exchanges
linux:osquery
Processes linked with libssl/libcrypto performing network activity
[ExpectedCryptoLibs]
Baseline libraries that normally handle asymmetric crypto.
[TrafficAsymmetryRatio]
Threshold for client-heavy data sending vs server.
AN1498
Analytic 1498
macOS
Applications or launchd services invoking RSA or public-key routines from the Security framework, followed by outbound SSL/TLS sessions with unrecognized certs or anomalous handshakes. Defender observes unified logs of API calls and suspicious network entropy.
macos:unifiedlog
Process invoking SecKeyCreateRandomKey or asymmetric crypto APIs
macos:unifiedlog
TLS connections with abnormal handshake sequence or self-signed cert
[TrustedDoHEndpoints]
Known legitimate DoH/SSL endpoints.
[PayloadEntropyThreshold]
Entropy scoring for outbound payloads.
AN1499
Analytic 1499
ESXi
VMware services (hostd, vpxa) unexpectedly negotiating asymmetric crypto sessions to external endpoints outside vCenter or update servers. Defender sees encrypted handshakes in logs inconsistent with baseline ESXi communication patterns.
esxi:vpxd
ESXi process initiating asymmetric handshake with external host
esxcli:network
Socket inspection showing RSA key exchange outside baseline endpoints
[BaselineMgmtHosts]
Expected external endpoints (vCenter, update repos).
AN1500
Analytic 1500
Network Devices
Encrypted sessions detected with asymmetric key exchange anomalies on non-standard ports or with invalid/malformed certs. Defender correlates NetFlow/IPFIX with IDS/IPS detecting RSA exchanges outside expected TLS flows.
NSM:Flow
Flow records with RSA key exchange on unexpected port
IDS:TLSInspection
Malformed certs, incomplete asymmetric handshakes, or invalid CAs
[PortProfiles]
Define expected ports for asymmetric cryptography (e.g., 443, 993).
[CertValidationPolicy]
Thresholds for rejecting untrusted/self-signed certs.