AN0895
Analytic 0895
Windows
Processes such as PowerShell, Git, or curl initiating outbound HTTPS POST requests to known code repository APIs (e.g., github.com, gitlab.com) immediately following large file reads. Defender view: correlation between file access of sensitive directories (e.g., Documents, Finance) and abnormal data uploads to repository domains.
WinEventLog:Security
EventCode=4663, 4670, 4656
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Sysmon
EventCode=1
[MonitoredDomains]
List of external code repository domains to monitor (github.com, gitlab.com, bitbucket.org).
[ExfilVolumeThreshold]
Threshold for outbound data volume per session to flag suspicious uploads.
AN0896
Analytic 0896
Linux
Processes like git, curl, or python scripts executing commands that package files (tar, gzip) followed by HTTPS uploads to code repository endpoints. Defender view: detect unusual git push activity or scripted HTTPS requests outside normal developer work hours.
auditd:EXECVE
git push, curl -X POST
auditd:SYSCALL
open/read of sensitive directories
NSM:Flow
large outbound HTTPS uploads to repo domains
[WorkHours]
Baseline normal developer activity periods to reduce false positives.
[RepoDomainList]
Known allowed internal or external repository domains.
AN0897
Analytic 0897
macOS
Office or scripting applications initiating unusual HTTPS traffic to code repository APIs with high outbound-to-inbound ratios. Defender perspective: monitor for sensitive file access in combination with network connections to github.com, gitlab.com, or bitbucket.org.
macos:unifiedlog
execution of curl, git, or Office processes with network connections
macos:unifiedlog
read of user document directories
macos:unifiedlog
outbound HTTPS connections to code repository APIs
[MonitoredApplications]
Applications not expected to upload large data sets to repos (Word, Excel, Preview).
AN0898
Analytic 0898
ESXi
ESXi host processes (vmx, hostd) initiating HTTPS sessions toward external code repositories. Defender perspective: detect datastore reads followed by outbound web traffic inconsistent with administrative baselines.
esxi:hostd
datastore file access
esxi:vmkernel
HTTPS traffic to repository domains
[DatastoreTransferThreshold]
Amount of data moved from datastore to external services before raising alert.