Untrusted processes creating outbound TLS/HTTPS connections with malformed certificates or header fields, often mismatched with target service behavior. Detects protocol impersonation attempts via traffic metadata analysis and host process lineage.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | WinEventLog:Sysmon | EventCode=3 |
| Network Traffic Content (DC0085) | NSM:Flow | SSL/TLS Handshake Analysis |
| Field | Description |
|---|---|
| IssuerOrgFilter | Organizations in certificate issuer fields to allowlist or monitor. |
| UserContext | Restrict detection to non-system users or external-facing applications. |
| HeaderSignatureMatch | Specific HTTP header anomalies or patterns (e.g., missing User-Agent). |
Detection of binaries spawning encrypted sessions using OpenSSL or curl to external services with mismatched ports/protocols. Identifies behavior where internal services simulate trusted cloud service traffic patterns.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | execve |
| Network Traffic Content (DC0085) | NSM:Flow | Network Capture TLS/HTTP |
| Field | Description |
|---|---|
| ProtocolMatchConfidence | Threshold for header-field mismatch against expected service behavior. |
| TimeWindow | Correlation window between process spawn and encrypted session. |
Unsigned or suspicious applications initiating network traffic claiming to be browser, mail, or cloud clients. Detects impersonation via TLS fingerprint and User-Agent string deviation.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | macos:unifiedlog | Outbound Traffic |
| Process Metadata (DC0034) | macos:osquery | Process Execution + Hash |
| Network Traffic Content (DC0085) | NSM:Content | HTTP Header Metadata |
| Field | Description |
|---|---|
| ParentProcessFilter | Limit detections to children of suspicious binaries. |
| HeaderAnomalyScore | Threshold for deviation from expected headers (User-Agent, Host). |
ESXi hosts initiating connections from non-standard daemons mimicking HTTP/HTTPS or SNMP traffic, but with irregular payload formats or expired/unsigned TLS certificates.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | esxi:hostd | Service-Based Network Connection |
| Network Traffic Content (DC0085) | NSM:Content | TLS Fingerprint and Certificate Analysis |
| Field | Description |
|---|---|
| TLSFingerprintMatch | Allows matching against known-good or known-bad JA3/JA3S hashes. |
| AllowedServicePorts | Tune for expected network ports per ESXi role. |