Detects FTP, SMB, or TFTP traffic initiated by suspicious processes like PowerShell, cmd.exe, or rundll32.exe—especially with large outbound file transfers or unbalanced traffic volume.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | WinEventLog:Sysmon | EventCode=3 |
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 |
| Network Traffic Content (DC0085) | NSM:Flow | ftp.log, smb_files.log |
| Field | Description |
|---|---|
| ProcessImageFilter | Limit to non-standard FTP clients or suspicious binaries (e.g., cmd, mshta) |
| DataFlowDirectionThreshold | Ratio of outbound:inbound bytes; e.g., >90% outbound |
| FilenamePattern | Suspicious file extensions or naming (e.g., .zip, .rar, random hash names) |
Detects usage of FTP, SCP, or TFTP by non-interactive shells or automation scripts transferring large data volumes to untrusted IPs.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | execve |
| Network Traffic Content (DC0085) | NSM:Flow | ftp.log, conn.log |
| Field | Description |
|---|---|
| TransferSizeThreshold | Bytes sent in FTP upload or SCP push |
| CommandLinePatternMatch | e.g., scp -r /var/log/* or ftp upload scripts |
Detects Automator, AppleScript, or Terminal executing curl, lftp, or TFTP for binary transfer to untrusted IPs or unusual ports.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | macos:osquery | socket_events |
| Command Execution (DC0064) | macos:unifiedlog | log stream --predicate |
| Field | Description |
|---|---|
| FilePathAccessed | e.g., ~/Documents, ~/Library/logs/ |
| NetworkPortAnomaly | Non-standard FTP/TFTP ports used (e.g., FTP over 443) |
Detects file movement or outbound TFTP/FTP transfers from ESXi host initiated via shell commands or injected scripts, particularly from scratch partitions or /tmp.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | esxi:shell | /root/.ash_history |
| Network Traffic Content (DC0085) | NSM:Flow | mirror/SPAN port |
| Field | Description |
|---|---|
| TransferTargetDomainOrIP | Public IPs or domains not belonging to known ESXi mgmt infra |
| SourceDirectoryFilter | Monitor transfers from /tmp/, /etc/, /vmfs/volumes/ |
Detects internal hosts generating large outbound FTP/TFTP/SMB sessions to external IPs, or file transfers using non-standard ports and application mismatches (e.g., FTP over port 80).
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Flow | ftp.log, conn.log, smb_files.log |
| Field | Description |
|---|---|
| AppLayerProtocolMatch | e.g., FTP/SMB observed over uncommon ports |
| OutboundDataRateThreshold | Bytes transferred outside trusted subnets >100MB |