AN0988
Analytic 0988
Windows
Identifies suspicious outbound traffic volume mismatches from processes that typically do not generate network activity, particularly over C2 protocols like HTTPS, DNS, or custom TCP/UDP ports, following file or data access.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=3, 22
NSM:Flow
Flow/PCAP analysis for outbound payloads
WinEventLog:Security
EventCode=4663, 4670, 4656
[DataVolumeThreshold]
Set threshold for outbound transfer size exceeding typical C2 traffic (e.g., >1MB in <5min).
[KnownBenignProcesses]
List of approved processes that may exhibit high outbound traffic (e.g., updates).
AN0989
Analytic 0989
Linux
Monitors for processes reading sensitive files then immediately initiating unusual outbound connections or bulk transfer sessions over persistent sockets, particularly with encrypted or binary payloads.
auditd:SYSCALL
execve
auditd:SYSCALL
connect
NSM:Flow
conn.log + files.log + ssl.log
NSM:Flow
session stats with bytes_out > bytes_in
[OutboundEntropyScore]
Threshold for high-entropy payloads indicative of encoded or encrypted exfil data.
[ConnectionDuration]
Defines length of time over which transfer size must be aggregated to trigger detection.
AN0990
Analytic 0990
macOS
Detects unauthorized applications or scripts accessing sensitive data followed by establishing encrypted outbound communication to rare external destinations or with abnormal byte ratios.
macos:unifiedlog
eventMessage = 'open', 'sendto', 'connect'
macos:osquery
socket_events
macos:osquery
process_events
[ParentProcessAncestry]
Enables defenders to tune legitimate vs. suspicious lineage (e.g., launchd → curl is uncommon).
[ProtocolList]
Focus detection on unusual protocols (e.g., IRC, FTP, DNS over HTTPS).
AN0991
Analytic 0991
ESXi
Detects VMs sending outbound traffic through non-standard services or to unknown destinations. Exfiltration over reverse shells tunneled via VMkernel or custom payloads routed via hostd/vpxa.
esxi:vpxa
connection attempts and data transmission logs
esxi:vmkernel
network stack module logs
esxi:syslog
guest OS outbound transfer logs
[GuestOSAllowList]
Limit detection to sensitive or externally-exposed VMs handling confidential data.
[TransferSizeThresholdMB]
Minimum outbound transfer size before flagging anomalous C2-based exfiltration.
[ProtocolAllowList]
Define expected protocols for outbound data (e.g., disallow FTP/SCP over high ports).