Suspicious process initiating outbound connections to web services without corresponding response or return traffic, indicative of one-way command channels.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | WinEventLog:Sysmon | EventCode=3 |
| Network Traffic Content (DC0085) | etw:Microsoft-Windows-WinINet | WinINet API telemetry |
| Field | Description |
|---|---|
| DestinationDomain | Can tune for popular web services (e.g., googleapis.com, github.com) based on threat actor tooling |
| TimeWindow | May adjust temporal window to catch beaconing patterns (e.g., every 10-30 mins) |
| ProcessName | Environment-specific tuning to exclude expected update or telemetry tools |
Curl, wget, or custom HTTP clients initiated by uncommon user accounts or cron jobs to popular web services, with no observed response parsing logic.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | execve |
| Network Traffic Flow (DC0078) | iptables:LOG | OUTBOUND |
| Field | Description |
|---|---|
| ParentProcess | May tune to detect unknown parents like custom scripts or reverse shells |
| CommandLineArgs | May adjust based on known curl/wget C2 behaviors |
Process using URLSession or similar API to fetch from web services without any response handling, indicative of one-way C2 channels.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | macos:unifiedlog | process, network |
| Process Creation (DC0032) | macos:endpointsecurity | exec events |
| Field | Description |
|---|---|
| UserContext | Flag unexpected outbound activity from non-admin or system users |
| EntropyScore | Optional if script-based obfuscation is seen in web requests |
ESXi shell or scheduled tasks initiating outbound HTTPS to known public services without inbound return or loggable response, used to fetch instructions.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | esxi:hostd | CLI network calls |
| Field | Description |
|---|---|
| ScheduledTaskName | Can tune for task names used to execute curl-based outbound requests |
| DestinationIP | Scoped by environment to exclude known legitimate CDNs |