AN0002
Analytic 0002
Windows
Detects non-standard processes (e.g., PowerShell, python.exe, rundll32.exe) making outbound connections using publish/subscribe protocols (e.g., MQTT, AMQP) over non-browser, encrypted channels, often beaconing to message brokers.
WinEventLog:Sysmon
EventCode=3, 22
NSM:Flow
mqtt.log / xmpp.log (custom log feeds)
[UnusualProcessList]
Detect suspicious processes initiating outbound pub/sub connections
[TimeWindow]
Define beaconing interval used for temporal correlation
[ProtocolPortList]
Custom MQTT/XMPP port use in non-standard ranges (e.g., 1883, 5222, 5672)
AN0003
Analytic 0003
Linux
Detects CLI tools (e.g., mosquitto_pub, nc, python scripts) interacting with pub/sub brokers using unusual topic names, high-frequency publication rates, or obfuscated payloads to non-standard hosts.
auditd:SYSCALL
execve
NSM:Flow
mqtt.log or AMQP custom log
[BrokerAllowList]
Known-good brokers used by approved apps and daemons
[TopicAnomalyScore]
Payload length, entropy, or topic name patterns
AN0004
Analytic 0004
macOS
Detects osascript, curl, or custom binaries interacting with XMPP/MQTT brokers in unapproved destinations with encrypted payloads or frequent POST-like requests to broker URIs.
macos:unifiedlog
log stream 'eventMessage contains pubsub or broker'
macos:osquery
socket_events
[AppContextFilter]
Applications not known to use pub/sub protocols
[URIPathRegex]
Custom path patterns to message brokers over HTTPS
AN0005
Analytic 0005
Network Devices
Detects pub/sub traffic over unusual ports, high-frequency topic publications, and connections to known-bad or dynamic broker endpoints outside allowlisted infrastructure.
NSM:Flow
mqtt.log, xmpp.log, amqp.log
[BrokerReputationList]
Dynamic blocklist or threat intel feed for C2 brokers
[PayloadLengthThreshold]
Exfil-style long topic messages vs telemetry-style short messages