AN0516
Analytic 0516
Windows
Correlate suspicious file transfers over SMB or Admin$ shares with process creation events (e.g., cmd.exe, powershell.exe, certutil.exe) that do not align with normal administrative behavior. Detect remote file writes followed by execution of transferred binaries.
WinEventLog:Security
EventCode=5140
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=1
[TimeWindow]
Time period between file transfer and execution used to correlate events
[UserContext]
Accounts allowed to perform legitimate administrative transfers
[FilePathWhitelist]
Exclude known legitimate software update directories
AN0517
Analytic 0517
Linux
Monitor scp, rsync, curl, sftp, or ftp processes initiating transfers to internal systems combined with file creation events in unusual directories. Correlate transfer activity with subsequent execution of those binaries.
auditd:SYSCALL
execve: Invocation of scp, rsync, curl, or sftp
auditd:FILE
create: New file created in system binaries or temp directories
[AllowedTools]
Define legitimate transfer utilities expected in the environment
[DestinationDirectories]
Restrict to suspicious or non-standard directories for transferred files
AN0518
Analytic 0518
macOS
Detect anomalous use of scp, rsync, curl, or third-party sync apps transferring executables into user directories. Correlate new file creation with immediate execution events.
macos:unifiedlog
Execution of scp, rsync, curl with remote destination
macos:unifiedlog
File created in ~/Library/LaunchAgents or executable directories
[SyncApplications]
Whitelisted apps like Dropbox or OneDrive if sanctioned
[EntropyThreshold]
Adjust threshold for unusual filenames/hashes transferred internally
AN0519
Analytic 0519
ESXi
Identify lateral transfer via datastore file uploads or internal scp/ssh sessions that result in new VMX/VMDK or script files. Correlate transfer with VM execution or datastore modification.
esxi:vmkernel
Upload of file to datastore
esxi:hostd
scp/ssh used to move file across hosts
[DatastoreWhitelist]
Known authorized paths for legitimate VM operations
[TransferProtocol]
Protocols allowed for intra-VM host transfers