AN1483
Analytic 1483
Windows
Processes such as plink.exe, ssh.exe, or netsh.exe establishing outbound network connections where traffic patterns show encapsulated protocols (e.g., RDP over SSH). Defender observations include anomalous process-to-network relationships, large asymmetric data flows, and port usage mismatches.
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Sysmon
EventCode=1
[AllowedTools]
Whitelist legitimate tunneling tools (e.g., used by admins).
[DataAsymmetryThreshold]
Ratio of sent vs received bytes that indicates tunneling activity.
[TimeWindow]
Correlate process creation with network connection within N seconds.
AN1484
Analytic 1484
Linux
sshd, socat, or custom binaries initiating port forwarding or encapsulating traffic (e.g., RDP, SMB) through SSH or HTTP. Defender sees abnormal connect/bind syscalls, encrypted traffic on ports typically used for non-encrypted services, and outlier traffic volume patterns.
auditd:SYSCALL
socket/connect calls showing SSH processes forwarding arbitrary ports
linux:syslog
sshd sessions with unusual port forwarding parameters
linux:osquery
socat, ssh, or nc processes opening unexpected ports
[ForwardingFlags]
Specific sshd config flags indicating port forwarding.
[ProtocolBaseline]
Define expected application protocols by port to catch tunneling mismatches.
AN1485
Analytic 1485
macOS
launchd or user-invoked processes (ssh, socat) encapsulating traffic via SSH tunnels, VPN-style tooling, or DNS-over-HTTPS clients. Defender sees outbound TLS traffic with embedded DNS or RDP payloads.
macos:unifiedlog
process execution of ssh with -L/-R forwarding flags
macos:unifiedlog
encrypted outbound traffic carrying unexpected application data
[ExpectedDoHResolvers]
Known legitimate DoH resolvers used in environment.
[PayloadEntropyThreshold]
Flag excessive randomness in payloads on standard ports.
AN1486
Analytic 1486
ESXi
VMware daemons or user processes encapsulating traffic (e.g., guest VMs tunneling via hostd). Defender sees network services inside ESXi creating flows inconsistent with management plane traffic, such as SSH forwarding or DNS-over-HTTPS from management interfaces.
esxi:vpxd
ESXi processes relaying traffic via SSH or unexpected ports
esxcli:network
listening sockets bound with non-standard encapsulated protocols
[ESXiServiceProfiles]
Baseline allowed services and expected ports for ESXi management.