AN0030
Analytic 0030
Windows
Processes generating large outbound connections with disproportionate send/receive ratios, often to uncommon ports or hosts, potentially inserting meaningless data into protocol payloads.
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Sysmon
EventCode=10
NSM:Flow
TCP/UDP
[PayloadEntropyThreshold]
Tunable threshold for Shannon entropy of network payloads.
[TimeWindow]
Duration of outbound data transfer to evaluate disproportionate upload size.
[UserContext]
Filter based on user accounts allowed to generate outbound traffic.
AN0031
Analytic 0031
Linux
Outbound traffic with anomalous payload sizes and patterns from non-networking processes, often observed via packet inspection or connection logs.
auditd:SYSCALL
execve network tools
NSM:Flow
TCP session tracking
[EntropyScore]
Adjust based on expected entropy of typical outbound data.
[ProcessWhitelist]
Exclude known good binaries that generate high network output.
[DataRatioThreshold]
Minimum ratio of bytes_sent to bytes_received.
AN0032
Analytic 0032
macOS
Previously unseen applications generating outbound connections with atypical data flow characteristics, such as excessive data with no return response.
macos:unifiedlog
connection attempts
macos:osquery
process_events
NSM:Flow
session behavior
[ParentProcessCheck]
Allow filtering based on parent-child relationship for benign services.
[HostWhitelist]
Known legitimate C2-like patterns (e.g., Apple telemetry).
AN0033
Analytic 0033
ESXi
Anomalous traffic from ESXi host management daemons (like hostd or vpxa) embedding non-standard payloads in management protocols (e.g., HTTPS) or beaconing behavior.
esxi:vmkernel
Network activity
esxi:hostd
System service interactions
[TLSFingerprintMismatch]
Detects mismatched TLS client behavior vs expected for hostd/vpxa.
[UnusualDestinationPorts]
Highlight traffic from ESXi hosts to uncommon ports outside vCenter ranges.