AN0531
Analytic 0531
Windows
Automated execution of native utilities and scripts to discover, enumerate, and exfiltrate files and clipboard content. Focus is on detecting repeated file access, scripting engine use, and use of command-line utilities commonly leveraged by collection scripts.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=11
[TimeWindow]
Defines the lookback period for identifying burst activity or patterns in process/file events.
[SuspiciousFileExtensions]
Tunable list of file extensions associated with collection (e.g., .pdf, .docx).
[ProcessCountThreshold]
The number of times a process executes before considered anomalous.
AN0532
Analytic 0532
Linux
Repeated or automated access to user document directories or clipboard using shell scripts or utilities like xclip/pbpaste. Detectable via auditd syscall logs or osquery file events.
auditd:SYSCALL
execve
auditd:SYSCALL
open
[AccessPath]
Tunable location for sensitive files like /home/*/Documents.
[ScriptInterpreterList]
Shells or scripting engines to monitor (e.g., bash, python, perl).
AN0533
Analytic 0533
macOS
Use of pbpaste, AppleScript, or third-party automation frameworks (e.g., Automator) to collect clipboard or file content in bursts. Observable via unified logs.
macos:unifiedlog
logMessage contains pbpaste or osascript
macos:unifiedlog
subsystem=launchservices
[AutomationTool]
Detectable script interpreters or clipboard tools (pbpaste, osascript).
[ClipboardCheckRate]
Threshold for how often clipboard access occurs within a given time window.
AN0534
Analytic 0534
SaaS
Suspicious sign-ins to Graph API or sensitive resources using non-browser scripting agents (e.g., Python, PowerShell), often for programmatic access to mailbox or OneDrive content.
azure:signinlogs
Operation=UserLogin
[UserAgentFilter]
Filter for scripting agents (e.g., Python, PowerShell) which may vary by org.
[ExpectedClientIPList]
Set of known internal or managed IPs to filter benign automation.
[DeviceProperties]
Expected managed device profiles used to detect unmanaged devices.