AN1148
Analytic 1148
Windows
Monitor DNS queries, proxy logs, and user-agent strings for anomalous patterns associated with adversary attempts to hide infrastructure. Defenders may observe DNS resolutions to short-lived domains, abnormal WHOIS registration data, or filtering of known defensive/responder IP addresses.
WinEventLog:Security
EventCode=5156, 5157
dns:query
Excessive lookups for domains with suspicious WHOIS or short TTL values
[SuspiciousDomains]
List of domains registered with privacy-protected or suspicious WHOIS metadata.
[ResponderIPs]
Known incident response or scanning infrastructure IP ranges.
AN1149
Analytic 1149
Linux
Detect adversaries filtering traffic or modifying server responses to evade scanning. Monitor iptables, nftables, or proxy configurations that deny or redirect requests from known scanning agents or defensive tools.
auditd:SYSCALL
execve: Execution of commands modifying iptables/nftables to block selective IPs
NSM:Flow
Altered response metadata or blocked content based on user-agent or geolocation
[BlockedAgents]
User-agent strings or scanning tools to monitor for selective filtering.
AN1150
Analytic 1150
macOS
Monitor unified logs for manipulation of proxy configurations, DNS resolution, or filtering rules. Adversaries may redirect responses or use trusted domains that later resolve to malicious C2 infrastructure.
macos:unifiedlog
System process modifications altering DNS/proxy settings
NSM:Flow
Suspicious changes in TLS certificate responses or redirected domains
[TrustedHostingProviders]
Known hosting/CDN providers often abused to hide malicious C2 infrastructure.
AN1151
Analytic 1151
Network Devices
Inspect network telemetry for adversary attempts to blend malicious traffic with legitimate flows using VPNs, proxies, or geolocation spoofing. Defensive teams may observe anomalous tunnels, encrypted sessions to suspicious domains, or geo-mismatched IP activity.
NSM:Flow
Encrypted tunnels or proxy traffic to non-standard destinations
[GeoIPRanges]
Regions to monitor for unexpected or mismatched geolocation activity.
AN1152
Analytic 1152
ESXi
Monitor VM-level DNS and network traffic logs for adversary-controlled domains or selective response behavior (e.g., dropped requests from security scanners).
esxi:vmkernel
DNS lookups resolving to domains with rapid changes in registration metadata
esxi:vmkernel
Suspicious traffic filtered or redirected by VM networking stack
[MonitoredVMs]
Targeted virtual machines where adversaries may attempt to hide C2 traffic.