Behavioral Detection Strategy for Exfiltration Over Symmetric Encrypted Non-C2 Protocol

ID: DET0503
Domains: Enterprise
Analytics: AN1389, AN1390, AN1391, AN1392
Version: 1.0
Created: 21 October 2025
Last Modified: 21 October 2025

Analytics

AN1389

Detects the execution of non-browser processes establishing outbound encrypted network connections using uncommon symmetric encryption protocols (e.g., AES via PowerShell or custom scripts) to alternate external destinations.

Log Sources
Data Component Name Channel
Network Connection Creation (DC0082) WinEventLog:Sysmon EventCode=3
Process Creation (DC0032) WinEventLog:Sysmon EventCode=1
Mutable Elements
Field Description
PayloadEntropyThreshold Flag high-entropy payloads sent over unexpected protocols.
TimeWindow Define allowable transfer window (e.g., abnormal traffic outside business hours).
ExecutableAllowlist List of known-good binaries for encrypted traffic (e.g., Chrome, Outlook).

AN1390

Detects command-line utilities or scripts using encryption libraries or symmetric algorithms (e.g., OpenSSL AES, GPG, Python + PyCrypto) in conjunction with outbound file transfers or traffic to external destinations.

Log Sources
Data Component Name Channel
Process Creation (DC0032) auditd:SYSCALL execve
Network Connection Creation (DC0082) auditd:SYSCALL connect
Network Traffic Flow (DC0078) NSM:Flow conn.log or flow data
Network Traffic Content (DC0085) NSM:Flow ssl.log (for TLS handshake analysis), dns.log (tunneling indicators)
Mutable Elements
Field Description
FileTransferIndicator Threshold for transferred data size or extension type.
LibraryCallTracking Hooks into use of encryption libraries like `libcrypto.so`, `pycrypto`, `gpg`.

AN1391

Detects symmetric key-based encryption operations (e.g., AES via Python, AppleScript, or OpenSSL) followed by unusual outbound connections from non-browser applications or scripted tools.

Log Sources
Data Component Name Channel
Process Creation (DC0032) macos:unifiedlog log stream process subsystem
Network Traffic Flow (DC0078) macos:osquery socket_events
Network Connection Creation (DC0082) macos:unifiedlog log stream network activity
Mutable Elements
Field Description
ApplicationProfileBaseline Expected outbound connection profiles per app.
EncryptionRoutinePattern Indicators of manual encryption operations (e.g., script strings invoking AES).

AN1392

Detects unexpected encrypted egress traffic from management services (e.g., hostd) or guest VMs utilizing symmetric encryption without traditional protocols (e.g., FTP with embedded AES ciphertext).

Log Sources
Data Component Name Channel
Network Traffic Flow (DC0078) esxi:vmkernel egress log analysis
Command Execution (DC0064) esxi:hostd execution + payload hints
Network Traffic Content (DC0085) NSM:Flow host switch egress data
Mutable Elements
Field Description
GuestVMExfilWatchlist VMs with data sensitivity labels or outside normal behavior.
ServiceEgressProfile Expected egress destinations and volume for core services.