AN1015
Analytic 1015
Windows
Execution of utilities (e.g., ping, tracert, Test-NetConnection) or scripted methods to test Internet connectivity by interacting with external IPs/domains.
WinEventLog:Sysmon
EventCode=1
WinEventLog:PowerShell
EventCode=4103, 4104, 4105, 4106
WinEventLog:Security
EventCode=5156, 5157
[DestinationIP]
Tunable external IP ranges or domains used to verify Internet access (e.g., 8.8.8.8, example.com)
[TimeWindow]
Cluster rapid test connections with command execution in < 60 seconds
[UserContext]
Filter out known admin/script contexts to reduce false positives
AN1016
Analytic 1016
Linux
Execution of ping, traceroute, or curl/wget against public IPs/domains to verify Internet reachability.
auditd:EXECVE
execve
linux:syslog
network
[DomainPatterns]
Regex for common test domains like example.com, google.com
[ProtocolType]
Adjust focus to ICMP, HTTP, or mixed protocol testing
AN1017
Analytic 1017
macOS
Execution of ping, traceroute, or network utility tools to external destinations; may include `scutil` or system_profiler.
macos:unifiedlog
process
[ExecutionFrequency]
Rare use of ICMP utilities may be tuned based on user/host baselines
[EnrichmentLevel]
Tune data joins with parent process and user activity context
AN1018
Analytic 1018
ESXi
Execution of `ping`, `vmkping`, or `curl` from shell or through automation jobs/scripts to verify Internet egress.
esxi:shell
None
esxi:hostd
process
[SSHSessionOrigin]
Distinguish external SSH sessions from internal admin maintenance
[TargetIP]
Egress test destination may be filtered to known CDNs/test nodes