Detects non-standard processes (e.g., PowerShell, python.exe, rundll32.exe) making outbound connections using publish/subscribe protocols (e.g., MQTT, AMQP) over non-browser, encrypted channels, often beaconing to message brokers.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | WinEventLog:Sysmon | EventCode=3 |
| Network Traffic Content (DC0085) | NSM:Flow | mqtt.log / xmpp.log (custom log feeds) |
| Field | Description |
|---|---|
| UnusualProcessList | Detect suspicious processes initiating outbound pub/sub connections |
| TimeWindow | Define beaconing interval used for temporal correlation |
| ProtocolPortList | Custom MQTT/XMPP port use in non-standard ranges (e.g., 1883, 5222, 5672) |
Detects CLI tools (e.g., mosquitto_pub, nc, python scripts) interacting with pub/sub brokers using unusual topic names, high-frequency publication rates, or obfuscated payloads to non-standard hosts.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | execve |
| Network Traffic Content (DC0085) | NSM:Flow | mqtt.log or AMQP custom log |
| Field | Description |
|---|---|
| BrokerAllowList | Known-good brokers used by approved apps and daemons |
| TopicAnomalyScore | Payload length, entropy, or topic name patterns |
Detects osascript, curl, or custom binaries interacting with XMPP/MQTT brokers in unapproved destinations with encrypted payloads or frequent POST-like requests to broker URIs.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | macos:unifiedlog | log stream 'eventMessage contains pubsub or broker' |
| Network Traffic Flow (DC0078) | macos:osquery | socket_events |
| Field | Description |
|---|---|
| AppContextFilter | Applications not known to use pub/sub protocols |
| URIPathRegex | Custom path patterns to message brokers over HTTPS |
Detects pub/sub traffic over unusual ports, high-frequency topic publications, and connections to known-bad or dynamic broker endpoints outside allowlisted infrastructure.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Flow | mqtt.log, xmpp.log, amqp.log |
| Field | Description |
|---|---|
| BrokerReputationList | Dynamic blocklist or threat intel feed for C2 brokers |
| PayloadLengthThreshold | Exfil-style long topic messages vs telemetry-style short messages |