Detection Engine

Detection in XCloak comes from four independent, parallel sources — a rules engine, scheduled behavioral detectors, endpoint malware scanning, and threat intelligence matching.

Sigma-compatible rules engine

Rules are plain YAML, following the Sigma format. On first run, 102 rules across 12 MITRE ATT&CK tactics (Initial Access through Impact, plus cloud/container/supply-chain coverage) are seeded automatically into every new tenant.

The engine parses Sigma-style boolean conditions, filters by logsource product/service/category before evaluating field conditions — so a Windows-only rule never runs against a Linux syslog line — and caches the per-tenant ruleset bucketed by log format for fast pre-filtering on the ingest path.

Example rule

title: Suspicious regsvr32 Scriptlet Execution (LOLBin)
id: 7f2c1a4e-9b3d-4e11-9a2f-6c1d0e8b4f3a
status: stable
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\regsvr32.exe'
    CommandLine|contains|all:
      - '/i:'
      - 'scrobj.dll'
  condition: selection
level: high
tags:
  - attack.defense_evasion
  - attack.t1218.010

Behavioral detectors

12 scheduled detectors run per-tenant, each applying statistical and heuristic analysis to your log stream:

C2 Beacon Detector — Analyzes outbound connection timing using coefficient of variation (CV). Connections with suspiciously regular intervals (CV < 0.15 over 5+ samples) are flagged. Filters out known-benign processes and CDN destinations.

DNS Security — Multi-factor DGA scoring: Shannon entropy + English bigram deviation + digit ratio + consonant clusters + 25 suspicious TLD bonuses + DGA family pattern matching (Conficker, Necurs, Mirai-variant) + NXDOMAIN storm detection. Also detects DNS tunneling (long subdomain labels &gt;40 chars, high unique-domain query rate). Wired into the real-time DNS log pipeline. (T1568.002, T1071.004)

TLS Anomaly Detector — Weak ciphers (NULL/EXPORT/RC4/DES/ANON/MD5 — 12 patterns); deprecated TLS versions (SSLv3 → critical, TLS 1.0 → high per RFC 8996, TLS 1.1 → medium); self-signed cert detection; TLS on non-standard ports (port 80/25/53/110 → high); SNI/Host domain fronting (T1090.004). 1-hour dedup. (T1040, T1553.004, T1571)

HTTP Inspection — 35+ malicious User-Agent signatures (Cobalt Strike, Metasploit, Meterpreter, Empire, Havoc, njRAT, AsyncRAT, Remcos, Nikto, sqlmap, Gobuster, Nuclei, etc.); webshell path detection (c99.php, r57.php, /shell.php, /wp-content/uploads/shell, etc.); path traversal and null-byte injection; suspicious HTTP methods (PROPFIND, TRACK, TRACE, DEBUG); high-entropy User-Agents. 30-min dedup. (T1071.001, T1505.003, T1190, T1595)

Protocol Anomaly Detector — Protocol-on-wrong-port for 9 protocols (SSH on 443/80 → high); DNS tunneling via long subdomain labels and TCP DNS volume; ICMP tunnel via large payloads; HTTP CONNECT to RFC 1918 addresses; DNS-over-TCP flood; SMTP on non-standard ports. (T1071.004, T1571, T1095, T1572, T1048.002)

Port Scan Detector — Detects vertical (many ports, one host), horizontal (one port, many hosts), and SYN sweep patterns. Also detects SMB port spray (445 to many hosts).

Data Exfiltration — Triggers on: single session >100 MB, burst of >10 large transfers, outbound connections to known cloud storage domains (S3, GDrive, OneDrive, Dropbox, Box, Mega, iCloud), large off-hours transfers.

TLS/JA3 Fingerprinting — Matches TLS ClientHello JA3 hashes against a blocklist of 10 known-malicious fingerprints. Current list includes: Cobalt Strike, Metasploit Meterpreter, Dridex, TrickBot, Emotet, Tor Browser, AsyncRAT, NjRAT, QakBot, and a generic malware TLS heuristic.

Credential Attacks — Four detection modes: brute force (≥10 failures in 5 min from same src_ip + username); password spray (same src_ip targeting ≥5 different usernames); credential stuffing (same username from ≥5 different src_ips); successful brute force (success preceded by ≥5 failures in 10 min).

Privilege Escalation — Windows: Event IDs 4728/4732/4756 (group add), 4720 (new user), 4672 (special privileges). Linux: sudo commands, su invocations, SUID file execution, sudoers file modifications.

Ransomware Behavior — Three kill-chain stages monitored simultaneously: FIM (≥20 file modifications with crypto extensions within 5 min); kill-chain commands (vssadmin delete shadows, bcdedit /set recoveryenabled no, wmic shadowcopy delete); security service kill (termination of 25 AV/EDR process names).

Living-off-the-Land — Suspicious parent→child chains (Word/Excel/Outlook spawning PowerShell/cmd) and 10 LOLBin abuses: certutil -decode, regsvr32 /s /u /i, mshta vbscript:, bitsadmin /transfer, and others. Also detects encoded PowerShell (-enc, IEX, Invoke-Expression, DownloadString).

Impossible Travel — Calculates haversine distance between consecutive login events for the same user. Flags when implied travel speed exceeds 900 km/h. Falls back to /16 subnet comparison when GeoIP is unavailable.

UEBA — Per-user behavioral baseline updated every 24 h. Anomaly scoring across login hours, login locations, data access volume, command patterns, and privilege usage. Alerts on significant deviation from the user's own baseline.

Network Behavior Analytics — Per-agent baseline of connection volumes, destination diversity, and protocol distribution. Alerts on significant deviation.

YARA scanning

Runs on the agent, not centrally — the agent needs to see the actual file bytes on the endpoint. Matches are streamed back to the backend for centralized alerting.

Threat intelligence

IOC matching (IP, domain, hash, URL, email) runs asynchronously via a dedicated Kafka consumer rather than inline on ingest. Feed connectors support STIX/TAXII, MISP, AlienVault OTX, and flat-file feeds.

Writing custom rules

Manage rules from the dashboard under Sigma Rules, or via the API — see Sigma rule endpoints in the API reference.