AN1070
Analytic 1070
Windows
Adversaries collecting local files via PowerShell, WMI, or direct file API calls often include recursive file listings, targeted file reads, and temporary file staging.
WinEventLog:Security
EventCode=4688
WinEventLog:Sysmon
EventCode=11
[TargetFilePathRegex]
Allows tuning for file extensions or paths of sensitive data (e.g., *.xls, *.db, *.pdf).
[ParentProcessFilter]
Used to scope monitoring to suspicious parent/child process trees like PowerShell or WMI spawning file reads.
AN1071
Analytic 1071
Linux
Adversaries using bash scripts or tools to recursively enumerate user home directories, config files, or SSH keys.
auditd:SYSCALL
open
auditd:SYSCALL
execve
[TimeWindow]
Time span to correlate multiple file access events indicative of scripted or bulk access.
[ScriptToolName]
List of tools (e.g., `find`, `grep`, `tar`, `scp`) that may be benign but are context-sensitive.
AN1072
Analytic 1072
macOS
Adversary use of bash/zsh or AppleScript to locate files and exfil targets like user keychains or documents.
macos:unifiedlog
process:spawn
fs:fsusage
read/write
[UserContext]
Useful for excluding known admin or scheduled jobs.
[TargetVolume]
Focus monitoring on removable drives or external paths.
AN1073
Analytic 1073
Network Devices
Collection of device configuration via CLI commands (e.g., `show running-config`, `copy flash`, `more`), often followed by TFTP/SCP transfers.
networkdevice:cli
command logging
[CommandScope]
Defines list of configuration or diagnostic commands to monitor.
[AuthenticatedUserList]
Helps reduce false positives by whitelisting known admins.
AN1074
Analytic 1074
ESXi
Adversaries accessing datastore or configuration files via `vim-cmd`, `esxcli`, or SCP to extract logs, VMs, or host configurations.
esxis:vmkernel
Datastore Access
esxi:hostd
Command Execution
[AccessPathRegex]
Regex for filtering targeted VM paths or files like *.vmdk, *.vmx.
[InteractiveShellUsage]
Tune to distinguish between interactive and script-driven data access.