AN0633
Analytic 0633
Windows
Processes initiating outbound connections on uncommon ports or using protocols inconsistent with the assigned port. Correlating process creation with subsequent network connections reveals anomalies such as svchost.exe or Office applications using high, atypical ports.
WinEventLog:Security
EventCode=5156, 5157
WinEventLog:Sysmon
EventCode=1
[PortThresholds]
Define what constitutes a 'non-standard port' based on organizational baselines (e.g., allow 443/80/22 but flag 8088/587/3389 changes).
[ProcessAllowList]
Processes normally allowed to use non-standard ports (e.g., custom apps).
[TimeWindow]
Correlate process creation and network activity within N seconds.
AN0634
Analytic 0634
Linux
Unusual daemons or user processes binding/listening on ports outside of standard ranges, or initiating client connections using mismatched protocol/port pairings.
auditd:SYSCALL
socket/connect syscalls
linux:syslog
processes binding to non-standard ports or sshd configured on unexpected port
linux:osquery
process listening or connecting on non-standard ports
[AllowedServices]
Exclude ports intentionally configured for enterprise apps.
[PayloadEntropyThreshold]
Define thresholds for anomalous payload entropy to catch tunneled traffic.
AN0635
Analytic 0635
macOS
Applications making outbound connections on non-standard ports or launchd services bound to ports inconsistent with system baselines.
macos:unifiedlog
outbound TCP/UDP traffic over unexpected port
macos:unifiedlog
launchd services binding to non-standard ports
[BaselinePortProfiles]
Define expected macOS service port usage (e.g., AirDrop, Bonjour).
AN0636
Analytic 0636
ESXi
VM services or management daemons communicating on ports not defined by VMware defaults, such as vpxa or hostd processes initiating traffic over high-numbered or unexpected ports.
esxi:vpxd
ESXi service connections on unexpected ports
esxcli:network
listening sockets bound to non-standard ports
[ESXiAllowedPorts]
Default VMware service ports that should not be flagged.