AN0302
Analytic 0302
Windows
Atypical processes (e.g., powershell.exe, regsvr32.exe) encode large outbound traffic using Base64 or other character encodings; this traffic is sent over uncommon ports or embedded in protocol fields (e.g., HTTP cookies or headers).
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Sysmon
EventCode=1
NSM:Flow
Unusual Base64-encoded content in URI, headers, or POST body
[PayloadEntropyThreshold]
Adjust to accommodate legitimate compression or encryption patterns in normal web traffic
[ProcessAllowlist]
Define expected processes initiating outbound traffic to reduce false positives
[AnomalyScoreThreshold]
Set threshold for how far traffic deviates from baseline protocol structure or size
AN0303
Analytic 0303
Linux
Custom scripts or processes encode outbound traffic using gzip, Base64, or hex prior to exfiltration via curl, wget, or custom sockets. Encoding typically occurs before or during outbound connections from non-network daemons.
auditd:SYSCALL
execve
NSM:Flow
Base64 strings or gzip in URI, headers, or POST body
linux:syslog
Unusual outbound transfers from CLI tools like base64, gzip, or netcat
[TimeWindow]
Tune duration of multi-stage encoding + transfer operations to account for script variability
[UserContext]
Apply user allow/block list depending on which users normally perform CLI encoding
AN0304
Analytic 0304
macOS
Processes use built-in encoding utilities (e.g., `base64`, `xxd`, or `plutil`) to encode file contents followed by HTTP/HTTPS transfer via curl or custom applications.
macos:unifiedlog
base64 or curl processes chained within short execution window
macos:unifiedlog
HTTP POST with encoded content in user-agent or cookie field
[EncodedCommandLengthThreshold]
Minimum byte size of encoded strings to treat as suspicious
[SuspiciousProcessChainDepth]
Number of chained processes within a short window to treat as a correlated behavior
AN0305
Analytic 0305
ESXi
ESXi daemons (e.g., hostd, vpxa) are wrapped or impersonated to send large outbound traffic using gzip/Base64 encoding over SSH or HTTP. These actions follow suspicious logins or shell access.
esxi:shell
base64 or gzip use within shell session
esxi:vmkernel
Outbound traffic using encoded payloads post-login
ESXiLogs:authlog
Unexpected login followed by encoding commands
[AuthSourceTrustLevel]
Use to scope encoded traffic suspicion to accounts that should not initiate transfers
[ExfilBurstThreshold]
Threshold for bursty outbound traffic size deviation from baseline