T1071.001 / ATT&CK

Windows Analytic 0075

Detects unexpected or high-volume HTTP/S/WebSocket communication from suspicious processes (e.g., PowerShell, rundll32) using uncommon user agents or mimicking browser traffic to unusual domains or IPs.

• NSM:Flow http.log, ssl.log
• WinEventLog:Sysmon EventCode=3, 22

Linux Analytic 0076

Detects curl, wget, Python requests, or custom HTTP clients communicating over non-standard ports, with repetitive or beacon-like patterns or POST-heavy behavior to rare domains.

• NSM:Flow http.log, conn.log
• auditd:SYSCALL execve

macOS Analytic 0077

Detects applications such as Automator, AppleScript, or LaunchDaemons invoking HTTP/S traffic to non-standard domains or using suspicious headers (e.g., Base64 in URIs or cookie fields).

• macos:osquery socket_events
• macos:unifiedlog log stream --predicate

ESXi Analytic 0078

Detects HTTP or HTTPS communication initiated by shell-based scripts or management daemons, especially those reaching public IPs over ports 80/443 using embedded curl or wget.

• NSM:Flow SPAN or port-mirrored HTTP/S
• esxi:shell /root/.ash_history or /etc/init.d/*

Network Devices Analytic 0079

Detects Web protocol misuse such as encoded HTTP headers, WebSocket upgrade requests with abnormal payloads, or TLS handshake anomalies suggesting embedded C2 channels.

• NSM:Flow http.log, ssl.log, websocket.log