T1572 / ATT&CK

Windows Analytic 1483

Processes such as plink.exe, ssh.exe, or netsh.exe establishing outbound network connections where traffic patterns show encapsulated protocols (e.g., RDP over SSH). Defender observations include anomalous process-to-network relationships, large asymmetric data flows, and port usage mismatches.

• WinEventLog:Sysmon EventCode=3, 22
• WinEventLog:Sysmon EventCode=1

Linux Analytic 1484

sshd, socat, or custom binaries initiating port forwarding or encapsulating traffic (e.g., RDP, SMB) through SSH or HTTP. Defender sees abnormal connect/bind syscalls, encrypted traffic on ports typically used for non-encrypted services, and outlier traffic volume patterns.

• auditd:SYSCALL socket/connect calls showing SSH processes forwarding arbitrary ports
• linux:syslog sshd sessions with unusual port forwarding parameters
• linux:osquery socat, ssh, or nc processes opening unexpected ports

macOS Analytic 1485

launchd or user-invoked processes (ssh, socat) encapsulating traffic via SSH tunnels, VPN-style tooling, or DNS-over-HTTPS clients. Defender sees outbound TLS traffic with embedded DNS or RDP payloads.

• macos:unifiedlog process execution of ssh with -L/-R forwarding flags
• macos:unifiedlog encrypted outbound traffic carrying unexpected application data

ESXi Analytic 1486

VMware daemons or user processes encapsulating traffic (e.g., guest VMs tunneling via hostd). Defender sees network services inside ESXi creating flows inconsistent with management plane traffic, such as SSH forwarding or DNS-over-HTTPS from management interfaces.

• esxi:vpxd ESXi processes relaying traffic via SSH or unexpected ports
• esxcli:network listening sockets bound with non-standard encapsulated protocols