Detects unusual outbound connections to web services from uncommon processes using SSL/TLS, particularly those exhibiting high outbound data volume or persistence.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | WinEventLog:Sysmon | EventCode=3 |
| Network Traffic Content (DC0085) | NSM:Flow | SSL/TLS Inspection or PCAP |
| Field | Description |
|---|---|
| ProcessName | To tune for unexpected or uncommon executables initiating network connections |
| DataTransferThreshold | Volume of outbound data in short time window (e.g., >1MB in <5 min) |
| TimeWindow | Look for connections persisting outside of normal business hours |
Detects command-line tools, agents, or scripts making outbound HTTPS connections to popular web services like Discord, Slack, Dropbox, or Graph API in an unusual context.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | auditd:SYSCALL | connect/sendto |
| Network Traffic Content (DC0085) | NSM:Flow | conn.log, ssl.log |
| Field | Description |
|---|---|
| ParentProcess | Unusual parent-child process behavior initiating external comms (e.g., bash > curl) |
| HostnamePattern | Destination hostnames (e.g., *.dropboxapi.com, *.graph.microsoft.com) |
| RequestFrequency | Repeated requests at unusual intervals, suggesting beaconing |
Detects user agents or background services making unauthorized or unscheduled web API calls to cloud/web services over HTTPS.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | macos:unifiedlog | process + network activity |
| Network Connection Creation (DC0082) | macos:osquery | process_events, socket_events |
| Field | Description |
|---|---|
| ProcessSignature | Unsigned or user-modified apps communicating with cloud services |
| ConnectionInterval | Beacon-like pattern of regular outbound communication |
Detects guest VMs or management agents issuing HTTP(S) traffic to external services without a valid patch management or backup justification.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | esxi:vmkernel | network activity |
| Network Traffic Flow (DC0078) | vpxd.log | API communication |
| Field | Description |
|---|---|
| RemoteIPRange | Filter to detect only external/public destinations |
| VMContext | Exclude known backup or patch automation services |