AN0075
Analytic 0075
Windows
Detects unexpected or high-volume HTTP/S/WebSocket communication from suspicious processes (e.g., PowerShell, rundll32) using uncommon user agents or mimicking browser traffic to unusual domains or IPs.
NSM:Flow
http.log, ssl.log
WinEventLog:Sysmon
EventCode=3, 22
[ProcessNameExclusions]
Filter out legitimate browser/network utilities
[UserAgentAnomalies]
Detect non-browser user-agents or spoofed headers
[OutboundByteRatioThreshold]
Flag when outbound > inbound volume by 90%+
AN0076
Analytic 0076
Linux
Detects curl, wget, Python requests, or custom HTTP clients communicating over non-standard ports, with repetitive or beacon-like patterns or POST-heavy behavior to rare domains.
NSM:Flow
http.log, conn.log
auditd:SYSCALL
execve
[CommandLinePatternMatch]
curl or wget in scripts with suspicious domains or silent flags
[BeaconIntervalWindow]
Fixed-timed HTTP callbacks with 60±5s jitter
AN0077
Analytic 0077
macOS
Detects applications such as Automator, AppleScript, or LaunchDaemons invoking HTTP/S traffic to non-standard domains or using suspicious headers (e.g., Base64 in URIs or cookie fields).
macos:osquery
socket_events
macos:unifiedlog
log stream --predicate
[SuspiciousParentProcess]
Non-browser parent of web traffic (e.g., AppleScript, bash)
[URIEntropyThreshold]
Unusually encoded data in GET/POST URIs
AN0078
Analytic 0078
ESXi
Detects HTTP or HTTPS communication initiated by shell-based scripts or management daemons, especially those reaching public IPs over ports 80/443 using embedded curl or wget.
NSM:Flow
SPAN or port-mirrored HTTP/S
esxi:shell
/root/.ash_history or /etc/init.d/*
[ShellScriptMatch]
Match on commands like `wget https://*`, `curl -s`
[ExternalConnectionFilter]
Public IPs or external DNS hostnames
AN0079
Analytic 0079
Network Devices
Detects Web protocol misuse such as encoded HTTP headers, WebSocket upgrade requests with abnormal payloads, or TLS handshake anomalies suggesting embedded C2 channels.
NSM:Flow
http.log, ssl.log, websocket.log
[HeaderEncodingPattern]
Base64, hex, or UTF-16 encoding in URI, cookie, or host
[TLSFingerprintMismatch]
JA3 hash deviation from known clients