Skip to main content
Sumo Logic

CSE Built-In Rules

See a list and descriptions of CSE's built-in rules.

This page lists and describes CSE's built-in rules.

AWS - Excessive OAuth Application Permissions Scope

Alert when an OAuth application has requested a high number of permissions to aspects of AWS.

AWS - New UserPoolClient Created

UserPoolClient {{application}} has been created in AWS. A UserPoolClient is an entity that has permission to call unauthenticated API operations (operations that do not have an authenticated user).

AWS CloudTrail - AWS ConsoleLogin without MFA from IP

An AWS console login was successful where the account did NOT use multi-factor authentication (MFA) to gain access. It is strongly recommended that all accounts used for console access require MFA to protect your AWS account in the event credentials are stolen.

AWS CloudTrail - Customer Master Key Disabled or Scheduled for Deletion

A Customer Master Key (CMK) was disabled or scheduled for deletion. The AWS Key Management Service (KMS) can be used to generate key pairs for encrypting and decrypting your data. Disabling or deleting keys can come with heavy destructive consequences as data encrypted with those keys cannot be decrypted. AWS forces users to either disable keys allowing them to be re-enabled at a later time or users must schedule a key deletion at a later time if the keys absolutely must be removed. The default time for scheduling a key deletion is 30 days.

AWS CloudTrail - EC2 Access Key Action Detected

Actions observed that create, import and delete access keys to EC2 could indicate an advisary is taking action on their objective to extend or otherwise manipulate access to EC2 instance(s).

AWS CloudTrail - IAM CreateUser Action Observed (IP)

Username affected: '{{changeTarget}}'. This signal fires for all observances of the CreateUser action in the IAM event source. Creating AWS users is likely a benign, infrequent activity. Hostile actors will create users to persist access. Use this signal in context of other activity to determine intent.

AWS CloudTrail - IAM CreateUser Action Observed (Username)

Username affected: '{{changeTarget}}'. This signal fires for all observances of the CreateUser action in the IAM event source. Creating AWS users is likely a benign, infrequent activity. Hostile actors will create users to persist access. Use this signal in context of other activity to determine intent.

AWS CloudTrail - IAM Policy Applied

A policy was attached to a user, group, or role. By default, IAM denies all access to all services for users, and policies must be applied to grant access to AWS services and resources. This signal could indicate a policy is granting additional access within your cloud environment.

AWS CloudTrail - IAM Privileged Policy Applied to Group (IP)

Privileged Policy: [{{fields['requestParameters.policyArn']}}] An Amazon default policy that carries a high level of access was noticed being applied to a group. This rule identifies both 'attach' and 'put' actions with this privileged policy. The difference between 'attach' and 'put' is that 'attach' actions apply a managed policy to an item, where a 'put' action indicates the policy is defined in-line and is part of the items definition. Applying privileged policies to items could indicate hostile action that attempts to increase the privilege level of a user or set of users. There are legitimate times when this will occur, consider this signal in context of other activities that may indicate suspicious behavior.

AWS CloudTrail - IAM Privileged Policy Applied to Group (Username)

Privileged Policy: [{{fields['requestParameters.policyArn']}}] An Amazon default policy that carries a high level of access was noticed being applied to a group. This rule identifies both 'attach' and 'put' actions with this privileged policy. The difference between 'attach' and 'put' is that 'attach' actions apply a managed policy to an item, where a 'put' action indicates the policy is defined in-line and is part of the items definition. Applying privileged policies to items could indicate hostile action that attempts to increase the privilege level of a user or set of users. There are legitimate times when this will occur, consider this signal in context of other activities that may indicate suspicious behavior.

AWS CloudTrail - IAM Privileged Policy Applied to Role (IP)

Privileged Policy: [{{fields['requestParameters.policyArn']}}] An Amazon default policy that carries a high level of access was noticed being applied to a role. This rule identifies both 'attach' and 'put' actions with this privileged policy. The difference between 'attach' and 'put' is that 'attach' actions apply a managed policy to an item, where a 'put' action indicates the policy is defined in-line and is part of the items definition. Applying privileged policies to items could indicate hostile action that attempts to increase the privilege level of a user or set of users. There are legitimate times when this will occur, consider this signal in context of other activities that may indicate suspicious behavior.

AWS CloudTrail - IAM Privileged Policy Applied to Role (Username)

Privileged Policy: [{{fields['requestParameters.policyArn']}}] An Amazon default policy that carries a high level of access was noticed being applied to a role. This rule identifies both 'attach' and 'put' actions with this privileged policy. The difference between 'attach' and 'put' is that 'attach' actions apply a managed policy to an item, where a 'put' action indicates the policy is defined in-line and is part of the items definition. Applying privileged policies to items could indicate hostile action that attempts to increase the privilege level of a user or set of users. There are legitimate times when this will occur, consider this signal in context of other activities that may indicate suspicious behavior.

AWS CloudTrail - IAM Privileged Policy Applied to User (IP)

Privileged Policy: [{{fields['requestParameters.policyArn']}}] An Amazon default policy that carries a high level of access was noticed being applied to a user. This rule identifies both 'attach' and 'put' actions with this privileged policy. The difference between 'attach' and 'put' is that 'attach' actions apply a managed policy to an item, where a 'put' action indicates the policy is defined in-line and is part of the items definition. Applying privileged policies to items could indicate hostile action that attempts to increase the privilege level of a user or set of users. There are legitimate times when this will occur, consider this signal in context of other activities that may indicate suspicious behavior.

AWS CloudTrail - IAM Privileged Policy Applied to User (Username)

Privileged Policy: [{{fields['requestParameters.policyArn']}}] An Amazon default policy that carries a high level of access was noticed being applied to a user. This rule identifies both 'attach' and 'put' actions with this privileged policy. The difference between 'attach' and 'put' is that 'attach' actions apply a managed policy to an item, where a 'put' action indicates the policy is defined in-line and is part of the items definition. Applying privileged policies to items could indicate hostile action that attempts to increase the privilege level of a user or set of users. There are legitimate times when this will occur, consider this signal in context of other activities that may indicate suspicious behavior.

AWS CloudTrail - IAM User Generating AccessDenied Errors Across Multiple Actions

An IAM account sent multiple requests to perform a wide distinct number of AWS actions in a short time frame while receiving the error code AccessDenied. This could indicate an account attempting to enumerate their access across the AWS account.

AWS CloudTrail - IAM User Generating AccessDenied Errors Across Multiple Actions from IP

An IAM account sent multiple requests to perform a wide distinct number of AWS actions in a short time frame while receiving the error code AccessDenied. This could indicate an account attempting to enumerate their access across the AWS account.

AWS CloudTrail - Logging Configuration Change Observed (IP)

Changing the configuration of logging to any mission-critical service or platform should be closely monitored. This signal identifies when AWS logging configurations have been changed. The severity of signals increases depending on the type of action observed. For instance disabling/deleting logs is a higher severity than enabling logs.

AWS CloudTrail - Logging Configuration Change Observed (Username)

Changing the configuration of logging to any mission-critical service or platform should be closely monitored. This signal identifies when AWS logging configurations have been changed. The severity of signals increases depending on the type of action observed. For instance disabling/deleting logs is a higher severity than enabling logs.

AWS CloudTrail - Multiple Failed Console Logins From a User

Multiple failed logins were detected from the same user within a short period of time. It is important to note that AWS CloudTrail does not log failed authentications for the root account user.

AWS CloudTrail - Multiple Failed Console Logins From an Source IP

Multiple failed logins were detected from the same source IP address within a short period of time. It is important to note that AWS CloudTrail does not log failed authentications for the root account user.

AWS CloudTrail - OpsWorks Describe Permissions Event (IP)

This event sourced from AWS OpsWorks occurrs rarely. It could indicate that an adversary is attempting to collect information for later attack. When successful, the Describe Permissions event returns information regarding a specified stack's permissions for access.

AWS CloudTrail - OpsWorks Describe Permissions Event (Username)

This event sourced from AWS OpsWorks occurrs rarely. It could indicate that an adversary is attempting to collect information for later attack. When successful, the Describe Permissions event returns information regarding a specified stack's permissions for access.

AWS CloudTrail - Permissions Boundary Lifted (IP)

Username affected: '{{changeTarget}}'. A Permissions Boundary was lifted against an IAM User or Role. This unusual action may increase the effect permissions to the asset by allowing all the actions granted in its permissions policies.

AWS CloudTrail - Permissions Boundary Lifted (Username)

Username affected: '{{changeTarget}}'. A Permissions Boundary was lifted against an IAM User or Role. This unusual action may increase the effect permissions to the asset by allowing all the actions granted in its permissions policies.

AWS CloudTrail - Public S3 Bucket Exposed From IP

An AWS request occurred to either create a new public bucket or to add a bucket access control list (ACL) to an existing bucket to make it public. While there are some use cases for AWS S3 public buckets, most are generally private. The security operations center should have a strong understanding of which buckets are allowed to be public.

AWS CloudTrail - Public S3 Bucket Exposed by User

An AWS request occurred to either create a new public bucket or to add a bucket access control list (ACL) to an existing bucket to make it public. While there are some use cases for AWS S3 public buckets, most are generally private. The security operations center should have a strong understanding of which buckets are allowed to be public.

AWS CloudTrail - Reconnaissance related event (IP)

This signal identifies a small number of CloudTrail API actions that when observed could indicate an actors intent to enumerate the environment. These events are generally benign, and occur during normal operations. Use this signal as context around an unfolding security story.

AWS CloudTrail - Reconnaissance related event (Username)

This signal identifies a small number of CloudTrail API actions that when observed could indicate an actors intent to enumerate the environment. These events are generally benign, and occur during normal operations. Use this signal as context around an unfolding security story.

AWS CloudTrail - Root Console Successful Login Observed

This signal detects when a successful root account login occurred within an AWS account. This privileged account should seldomly be used within an AWS cloud environment. Amazon's best practices state you should only use the root account to create the initial local IAM users and assigned one of the accounts administrative privileges or to perform rare tasks only available to the root user. The security operations center should be aware when the AWS root account is accessed.

AWS CloudTrail - SQS List Queues Event (IP)

This event sourced from AWS SQS occurrs rarely. It could indicate that an adversary is attempting to collect information for later attack. When successful, the List Queues event returns all SQS queues that may be valid targets for further probing/attack.

AWS CloudTrail - SQS List Queues Event (Username)

This event sourced from AWS SQS occurrs rarely. It could indicate that an adversary is attempting to collect information for later attack. When successful, the List Queues event returns all SQS queues that may be valid targets for further probing/attack.

AWS CloudTrail - Successful Console Login without MFA

An AWS console login was successful where the account did NOT use multi-factor authentication (MFA) to gain access. It is strongly recommended that all accounts used for console access require MFA to protect your AWS account in the event credentials are stolen.

AWS GuardDuty - Pass-Through Rule (Device Name)

The AWS GuardDuty service generated an alert for your cloud environment with the following details: {{description}}

AWS GuardDuty - Pass-Through Rule (IP)

The AWS GuardDuty service generated an alert for your cloud environment with the following details: {{description}}

AWS GuardDuty - Pass-Through Rule (User)

The AWS GuardDuty service generated an alert for your cloud environment with the following details: {{description}}

Abnormal Parent-Child Process Combination

This alert detects a Windows process spawned by a parent process that does not normally spawn it.

Active Directory Domain Enumeration

Potentially detects an attacker attempting to enumerate active users on the network. Attacks will use enumeration tools such as Bloodhound that will quickly query the domain controller by submitting multiple Kerberos ticket requests with forged device names to gather user and group information for those devices.

Active Directory Password Spray Attack (Track Hostname)

High number of failed logon attempts with in a 5 minute window from a single endpoint with unique usernames.

Active Directory Password Spray Attack (Track IP)

High number of failed logon attempts in a 5 minute window from a single endpoint with unique usernames.

Administrator Login via RDP

This rule looks for successful logins over RDP for administrator accounts.

AlphaSOC NFR

IP: {{srcDevice_ip}}, Potentially Malicious Domain: {{threat_referenceUrl}}, Signature: {{fields['signature']}}, Tags: {{fields['cs1']}}

Amazon VPC - Network Scan

Attackers will often perform reconnaissance against customer environments to better understand resources on the network. In doing this behavior they are usually blocked by firewall rules while performing their discovery. This rule looks for a single source IP address network traffic rejected by AWS security groups to at least 10 different destination IP addresses within a 5-minute window.

Amazon VPC - Port Scan

Attackers will often perform reconnaissance against customer environments to better understand resources on the network. In doing this behavior they are usually blocked by firewall rules while performing their discovery. This rule looks for a single source IP address network traffic rejected by AWS security groups to multiple distinct destination port numbers within a short time window.

AutoIT User Agent

AutoIT is automation software that is sometimes used for malware command and control.

Azure - Brute Force Login Attempt

Detection of a potentially brute force login attempt

Azure - Password Spraying (IP)

Detects potential password spray attacks against Azure user accounts

Azure - Policy Added (IP)

This rule is designed to monitor for conditional access policy additions. It is recommended to include or exclude certain policies from monitoring for better security value, expressions are below for inclusion and exclusion. AND application in ('policy','example') AND application not in ('policy','example')

Azure - Policy Added (User)

This rule is designed to monitor for conditional access policy additions. It is recommended to include or exclude certain policies from monitoring for better security value, expressions are below for inclusion and exclusion. AND application in ('policy','example') AND application not in ('policy','example')

Azure - Policy Deleted (IP)

This rule is designed to monitor for conditional access policy deletions. It is recommended to include or exclude certain policies from monitoring for better security value, expressions are below for inclusion and exclusion. AND application in ('policy','example'). AND application not in ('policy','example')

Azure - Policy Deleted (User)

This rule is designed to monitor for conditional access policy deletions. It is recommended to include or exclude certain policies from monitoring for better security value, expressions are below for inclusion and exclusion. AND application in ('policy','example')AND application not in ('policy','example')

Azure - Policy Updated (IP)

This rule is designed to monitor for conditional access policy updates. It is recommended to include or exclude certain policies from monitoring for better security value, expressions are below for inclusion and exclusion. AND application in ('policy','example') AND application not in ('policy','example')

Azure - Policy Updated (User)

This rule is designed to monitor for conditional access policy updates. It is recommended to include or exclude certain policies from monitoring for better security value, expressions are below for inclusion and exclusion. AND application in ('policy','example') AND application not in ('policy','example')

Azure - Unauthorized OAuth Application

Alert when a non-approved OAuth Application has been identified on Azure. This rule is disabled by default as a list of approved OAuth applications is required to be enabled. The approved applications should be added to the rule logic under the 'application not in' condition.

Azure - User Login From 2+ Countries Within 1 Hour

User logged in from 2+ countries in 1 hour. It is recommended to add filtering criteria to the expression to reduce false positives. For example, a match list containing known VPN IP addresses that should be filtered out from consideration in the expression.

Base32 in DNS Query

By using base32, binary and text data can be encoded in a way that is fully compliant with DNS protocol specifications. Since common standard base32 uses 2-7 and the letters a-z, entropy must be measured to distinguish from normal text. The presence of long base32 encoding in a DNS query may indicate tunneling of information out of a network. Some security vendors and internet providers also use this technique to operate cloud infrastructure or transport information through firewalled environments.

Bitsadmin to Uncommon TLD

Detects BITS connections to external domains with uncommon TLDs. Reference: https://isc.sans.edu/forums/diary/In...ctivity/23281/

Blocked Email Host

The originator's address is seen in the block list error message, which means an SMTP server sent a reply mentioning an SMTP block list. This is useful to detect local hosts sending SPAM with a high positive rate.

Blocked Email Message

An SMTP server sent a reply mentioning an SMTP block list.

Bluecoat Proxy - Suspicious DNS Query

This signal looks for DNS requests logged by your BlueCoat proxy server for domains which appear to be created by a Domain Generation Algorithm (DGA) or a domain associated with a dynamic DNS service.

Bluecoat Proxy - Suspicious or Malicious Categories

This rule triggers any time there is a Suspicious or Malicious Bluecoat category which could indicate there is a problem with the host making the connection.

Browser Exploitation Framework (BeEF) Hook

The Browser Exploitation Framework (BeEF) is a penetration-testing tool focusing on web browsers. This rule looks for HTTP communication that include the default BeEF cookie, which indicates a hooked browser.

Carbon Black Defense - High Threat Event (Hostname)

{{description}}

Carbon Black Defense - High Threat Event (IP)

{{description}}

Carbon Black Defense - High Threat Event (Username)

{{description}}

Carbon Black Defense - Low Threat Event (Hostname)

{{description}}

Carbon Black Defense - Low Threat Event (IP)

{{description}}

Carbon Black Defense - Low Threat Event (Username)

{{description}}

Carbon Black Defense - Medium Threat Event (Hostname)

{{description}}

Carbon Black Defense - Medium Threat Event (IP)

{{description}}

Carbon Black Defense - Medium Threat Event (Username)

{{description}}

Checkpoint Firewall

Templated rule for all security related Checkpoint Firewall Alerts.

Cisco AMP - Templated Events (Hostname)

Cisco AMP has raised the event {{action}} on the host {{device_hostname}}

Cisco AMP - Templated Events (IP)

Cisco AMP has raised the event {{action}} on the host {{device_hostname}}

Cisco Firepower - Attack Alert

Cisco Firepower is an IDS system which generates alerts based on network traffic. This rule creates CSE signals from the IDS alerts allowing Cisco Firepower IDS alerts to participate in the CSE Insight generation. This specific rule looks for IDS attacks where the source IP address is the attacker.

Cisco Firepower - IDS Attack Alert Diversity

5 or more diverse IDS attack signatures was observed within 5 minutes from a single source IP address. A single IP address producing a diverse signature alerts within a short period of time if often times a more interesting attack detection.

Cisco Firepower - IDS Attack Alert Spike

A spike of 50 IDS attack alerts in 10 minutes from the same source IP entity was observed.

Cisco Firepower - IDS Response Alert Diversity

5 or more diverse IDS response signatures was observed within 5 minutes from a single destination IP address. A single IP address producing a diverse signature alerts within a short period of time if often times a more interesting attack detection.

Cisco Firepower - IDS Response Alert Spike

A spike of 50 IDS response alerts in 10 minutes from the same destination IP entity was observed.

Cisco Firepower - Response Alert

Cisco Firepower is an IDS system which generates alerts based on network traffic. This rule creates CSE signals from the IDS alerts allowing Cisco Firepower IDS alerts to participate in the CSE Insight generation. This specific rule looks for IDS attacks where the destination IP address is the attacker.

Cisco Meraki Threat Events

Event Type: {{description}}; Endpoint IP: {{srcDevice_ip}}; Destination IP: {{dstDevice_ip}}

Cisco Stealthwatch Template Alerts

{{fields['fullmessage']}}

Cisco Umbrella - DNS Request Category: Adware

Cisco Umbrella detected a DNS request to a domain categorized as Adware.

Cisco Umbrella - DNS Request Category: Command and Control

Cisco Umbrella detected a DNS request to a domain categorized as Command and Control.

Cisco Umbrella - DNS Request Category: Cryptomining

Cisco Umbrella detected a DNS request to a domain categorized as Cryptomining.

Cisco Umbrella - DNS Request Category: DNS Tunneling VPN

Cisco Umbrella detected a DNS request to a domain categorized as Adware.

Cisco Umbrella - DNS Request Category: Dynamic DNS

Cisco Umbrella detected a DNS request to a domain categorized as Dynamic DNS.

Cisco Umbrella - DNS Request Category: Hacking

Cisco Umbrella detected a DNS request to a domain categorized as Hacking.

Cisco Umbrella - DNS Request Category: Malware

Cisco Umbrella detected a DNS request to a domain categorized as Malware.

Cisco Umbrella - DNS Request Category: Newly Seen Domains

Cisco Umbrella detected a DNS request to a domain categorized as Newly Seen Domains. It can be unusual for a host to communicate with a new domain under normal operations, but malware authors register domains specifically for malicious intent will have hosts connect to them shortly after registering them.

Cisco Umbrella - DNS Request Category: P2P/File sharing

Cisco Umbrella detected a DNS request to a domain categorized as P2P/File sharing.

Cisco Umbrella - DNS Request Category: Personal VPN

Cisco Umbrella detected a DNS request to a domain categorized as Personal VPN.

Cisco Umbrella - DNS Request Category: Phishing

Cisco Umbrella detected a DNS request to a domain categorized as Adware.

Cisco Umbrella - DNS Request Category: Potentially Harmful

Cisco Umbrella detected a DNS request to a domain categorized as Potentially Harmful.

Cisco Umbrella - DNS Request Category: Proxy/Anonymizer

Cisco Umbrella detected a DNS request to a domain categorized as Proxy/Anonymizer.

Cisco Umbrella - Proxy Logs with Cisco AMP Detections

Cisco Umbrella proxy logs with a Cisco AMP disposition of malicious was detected.

Connection to High Entropy Domain

An HTTP connection was made to a high entropy domain name. Entropy is a measure of randomness, DGA domains used by malware (i.e. g46mbrrzpfszonuk) often have high entropy.

CrowdStrike Threat Detection Alert (Hostname)

CrowdStrike: {{description}} on {{device_hostname}}

CrowdStrike Threat Detection Alert (IP)

CrowdStrike: {{description}} on {{device_ip}}

CrowdStrike Threat Detection Alert (Username)

CrowdStrike: {{description}} with user: {{user_username}}

Crypto Miner HTTP User Agent

This signal looks for HTTP requests where the user agent matches common names associated with crypto miners. It is common for attackers to install crypto miners on compromised hosts to use your CPU resources for their profit.

Cylance Protect - Event Severity 1

Cylance Protect event with the severity between -0.199 and -0.001

Cylance Protect - Event Severity 2

Cylance Protect event with the severity between -0.299 and -0.200

Cylance Protect - Event Severity 3

Cylance Protect event with the severity between -0.399 and -0.300

Cylance Protect - Event Severity 4

Cylance Protect event with the severity between -0.499 and -0.400

Cylance Protect - Event Severity 5

Cylance Protect event with the severity between -0.599 and -0.500

Cylance Protect - Event Severity 6

Cylance Protect event with the severity between -0.699 and -0.600

Cylance Protect - Event Severity 7

Cylance Protect event with the severity between -0.799 and -0.700

Cylance Protect - Event Severity 8

Cylance Protect event with the severity between -0.899 and -0.800

Cylance Protect - Event Severity 9

Cylance Protect event with the severity between -1.000 and -0.900

DCE-RPC Service Control Call - Destination Match

The Remote Procedure Call (RPC) protocol allows remote administrative commands to be executed. Creating/Deleting Services , when combined with other signals can be part of an attempt to expand influence inside a network using SMB and related protocols.

DCE-RPC Service Control Call - Source Match

The Remote Procedure Call (RPC) protocol allows remote administrative commands to be executed. Creating/Deleting Services , when combined with other signals can be part of an attempt to expand influence inside a network using SMB and related protocols.

DCERPC - SAMR Enumeration of All Users

Microsoft provides a protocol called SAMR which stands for Security Account Manager Remote Protocol. It is designed for developers to perform (RPC) remote procedure calls for interacting the account database for both local and remote Activity Directory domains. It contains a method called SamrEnumerateUsersInDomain which return a list of users in a domain. Attackers who have network access to the domain can use this method to enumerate a list of user accounts in Active Directory. This signal looks for an RPC connection using the SAMR protocol with the method SamrEnumerateUsersInDomain signifying a request to enumerate user accounts over the network.

DNS DGA Lookup Behavior - NXDOMAIN Responses

Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination for command and control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders to block, track, or take over the command and control channel, as there could potentially be thousands of domains that malware can check for instructions. This technique is described in https://attack.mitre.org/techniques/T1483/.

DNS Lookup of High Entropy Domain

DNS lookup of a high entropy domain name, which may be indicative of a domain generation algorithm (DGA) related domain. This technique is described at https://attack.mitre.org/techniques/T1483/.

DNS query for dynamic DNS provider

Dynamic DNS providers are often abused to host malware control servers and other malicious content. https://attack.mitre.org/techniques/T1311/ and https://attack.mitre.org/techniques/T1333/ describe the use of this technique by attackers.

Directory Traversal - Successful

Directory traversal is an attempt by an attacker to access files located on the host which are not intended to be returned by the web server. For example, attackers seeking usernames/passwords for the host will focus on paths like ../../etc/passwd, ../../../etc/shadow, etc. When successful, a directory traversal attack results in the attacker gaining access to sensitive information and identifying a mechanism of future attack. When unsuccessful, directory traversal is an indication of ongoing external reconnaissance.

Directory Traversal - Unsuccessful

Directory traversal is an attempt by an attacker to access files located on the host which are not intended to be returned by the web server. For example, attackers seeking usernames/passwords for the host will focus on paths like ../../etc/passwd, ../../../etc/shadow, etc. When successful, a directory traversal attack results in the attacker gaining access to sensitive information and identifying a mechanism of future attack. When unsuccessful, directory traversal is an indication of ongoing external reconnaissance.

Disabled Account Logon Attempt

Detects a disabled account being used for a logon attempt in a Windows environment.

Domain Resolution in Non-Standard TLD

DNS resolution of a domain that is not under an ICANN-standard TLD. These TLDs are provided by alternate DNS root servers such as OpenNIC. Their use on corporate networks is fundamentally suspicious and potentially a sign of abuse by threat actors.

Doublepulsar scan - likely not infected

Doublepulsar scans to check if the host is already infected before attempting to install the backdoor.

Duo Security - Excessive Authentication Failures From IP

An IP address was observed generating an excessive amount of authentication failures. This could indicate an attack or misconfigured system.

Duo Security - Multiple Authentication Failures From a User

A user account was observed generating an excessive amount of authentication failures. This could indicate an attack or misconfigured system.

Duo Security - Source IP Failing Authentication with Excessive Usernames

A source IP address was observed making excessive authentication failures using many different user accounts in a short period of time. This could indicate an attacker attempting a brute force attack.

Executable Downloaded - Content-Type Mismatch

This rule identifies scenarios where an attacker may have attempted to surreptitiously download an executable file by hiding it behind a different Content-Type, such as image/png. This technique has been observed in samples of Trickbot malware.

FTP Bruteforce Attempt

Multiple attempts to access an FTP server

FireEye CMS - Malware Callback

FireEye detected a malware callback with the following details: {{fields['channel']}}

FireEye CMS - Riskware Callback

This rule detects CMS Riskware Callback events

FireEye CMS Domain Matches

FireEye flagged the domain {{dns_queryDomain}}

FireEye CMS IPS Attack Events

FireEye IPS detected the threat {{threat_name}} from {{srcDevice_ip}} to {{dstDevice_ip}}

FireEye CMS IPS Response Events

FireEye IPS detected the threat {{threat_name}} from {{srcDevice_ip}} to {{dstDevice_ip}}

FireEye Web Infection Alert

FireEye detected a web infection to the following path: {{http_url}}

First Seen Access - SMB Share

Adversaries may access a networked system remotely using Server Message Block (SMB) to transfer files, and run transferred binaries through remote execution. Although not malicious on its own, this first-seen access to a DISK share over SMB can be an indicator of lateral movement.

Fortinet Critical App-Risk

This signal fires when Fortinet identifies a critical risk application in use within the network.

Fortinet High App-Risk

This signal fires when Fortinet detects a high risk application within the environment

Fortinet IDS Alerts

An {{severity}} Fortigate IDS alert triggered. Additional documentation can be found at {{threat_referenceUrl}}

G Suite - Access - Access Transparency

Google Access Transparency Activity Events

G Suite - Admin - User Settings - Turn Off 2SV

Admin disabled 2SV for user

G Suite - Admin Activity

The admin activity report returns information on the Admin console activities of all of your account's administrators.

G Suite - Drive - Drive Open To Public

Google Drive resource shared publicly

G Suite - Excessive OAuth Application Permissions Scope

Alert when an OAuth application has requested a high number of permissions to aspects of G Suite.

G Suite - Login - Account Warning

Google Accounts warnings

G Suite - Login - Government Attack Warning

Government-backed attack warnings

G Suite - Mobile - Suspicious Activity

Google G Suite alert for mobile suspicious activity

G Suite - SAML Failed Logons (Track IP)

An G Suite user has failed multiple authentications (via SAML) in a short period of time.

G Suite - SAML Failed Logons (Username)

An G Suite user has failed multiple authentications (via SAML) in a short period of time.

G Suite - Unauthorized OAuth Application

Alert when a non-approved OAuth Application has been identified on Google G Suite. This rule is disabled by default as a list of approved OAuth applications is required to be enabled. The approved applications should be added to the rule logic under the 'application not in' condition.

G Suite - User Accounts - 2SV Disabled

User disabled 2SV

G Suite - User Failed Logons (Track IP)

An G Suite user has failed multiple authentications in a short period of time.

G Suite - User Failed Logons (Track Username)

An G Suite user has failed multiple authentications in a short period of time.

G Suite - User Login From Two Different Countries

This signal triggers when there are two successful logins from the same user with different country codes indicating possible credential theft.

G Suite Alert Center - AppMaker Editor

Alerts from App Maker to notify admins to set up default SQL instance.

G Suite Alert Center - Data Loss Prevention

Alerts that get triggered on violations of Data Loss Prevention (DLP) rules.

G Suite Alert Center - Domain wide takeout - Customer takeout initiated

A takeout operation for the entire domain was initiated by an admin.

G Suite Alert Center - Gmail phishing

Proto for all phishing alerts with common payload

G Suite Alert Center - Gmail phishing - Misconfigured whitelist

Alert for setting the domain or IP that malicious email comes from as whitelisted domain or IP in Gmail advanced settings.

G Suite Alert Center - Google Operations

An incident reported by Google Operations for a G Suite application.

G Suite Alert Center - Google identity

Alerts for user account warning events.

G Suite Alert Center - Mobile device management - Device compromised

A mobile device compromised alert.

G Suite Alert Center - Mobile device management - Suspicious activity

A mobile suspicious activity alert.

G Suite Alert Center - Security Center Rules.

Alerts from G Suite Security Center rules service configured by admin.

G Suite Alert Center - State Sponsored Attack

A state-sponsored attack alert.

GitHub Raw URL Resource Request

Github.com is the most popular code repo site on the internet. Typically users of GitHub will look at the code from the Github.com website or clone it locally to their system. You can however request a raw version of a individual file directly. Attackers like to use GitHub as well to host their malicious code and will often download malicious files and scripts directly from the site which uses the domain raw.githubusercontent.com instead of github.com. This signal looks for HTTP requests to that raw domain to monitor individual file downloads from the site.

Global YARA Rule (DstIp)

{{fields.yaraRuleDescription}}

Global YARA Rule (SrcIp)

{{fields.yaraRuleDescription}}

HTTP CloudFlare Protocol Violation or Empty Response

Error code 520 is used as a catch-all status when the origin server returns something that is unexpected, not tolerated, or not interpreted. This can include protocol violations and empty responses.

HTTP External Request to PowerShell Extension

Attackers will often download a PowerShell script from an external web server to help maintain persistence or to invoke additional functionally on Windows machines. It is not common for internal computers to download PowerShell scripts over HTTP from an external web server, but in some rare cases software like Anti-Virus does perform this behavior.

HTTP Request to Domain in Non-Standard TLD

HTTP request to a domain that is not under an ICANN-standard TLD. These TLDs are provided by alternate DNS root servers such as OpenNIC. Their use on corporate networks is fundamentally suspicious and potentially a sign of abuse by threat actors.

HTTP Request to Possible DGA Domain

The CSE anomaly engine has determined that the observed domain may have been created using a domain generation algorithm (DGA).

HTTP Request with Single Header

HTTP requests typically have multiple headers. It is odd in some cases if the event only contains a single header. This produces a low severity signal when an HTTP event is observed containing only one header in the request.

HTTP Response Error Spike - External

HTTP web services provide response codes to client requests. The response code numbers in the 400s are used to indicate a client related error and response code numbers in the 500s represent server related errors. This rule looks for a web client receiving a large frequency of web errors within a short period of time. It is unusual for a web client to cause this many errors in a short period of time. Common occurrences for this behavior is scanning/probing activity or scripted web clients which are now encountering errors due to a misconfiguration or recent change. This rule alerts when a host external to the monitored network triggers the threshold.

HTTP Response Error Spike - Internal

HTTP web services provide response codes to client requests. The response code numbers in the 400s are used to indicate a client related error and response code numbers in the 500s represent server related errors. This rule looks for a web client receiving a large frequency of web errors within a short period of time. It is unusual for a web client to cause this many errors in a short period of time. Common occurrences for this behavior is scanning/probing activity or scripted web clients which are now encountering errors due to a misconfiguration or recent change. This rule alerts when a host on the monitored network triggers the threshold.

HTTP Shell Script Download Disguised as a Common Web File

Attackers who have compromised Unix/Linux machines will sometimes download additional payloads using clear text HTTP where a shell script is downloaded disguised with another file extension. This signal looks for HTTP requests to common web file extensions where the network sensor detected a shell script was returned.

HTTP request for single character file name

Many threats are served from websites using lazy single character based filenames like 1.exe, etc. These nondescript file names are rare with most legitimate content. This rule looks for requests to retrieve high risk file extensions from such paths.

Hexadecimal User-Agent

User-Agent strings with hexadecimal values are often indicative of malware.

Hexadecimal in DNS Query Domain

Encoding in hexadecimal is a way that attackers can bypass network security devices that are inspecting traffic. While hexadecimal often appears in subdomains, it much less frequent in domains.

High risk file extension download without hostname and referrer

Although executable and dynamic-link libraries (.exe, .dll) are regularly downloaded from the Internet, benign ones are normally downloaded with the hostname and referrer fields populated. Thus, downloads from an IP address without referrer carry an elevated risk.

Houdini/Iniduoh/njRAT User-Agent

User-Agent strings used by Houdini/Iniduoh/njRAT malware.

IP Address Scan - External

A scan of IP addresses

IP Address Scan - Internal

A scan of IP addresses

IRC traffic internal-to-external

IRC traffic is uncommonly used for business use in most organizations. IRC traffic that originates inside a network and is outbound to the internet is especially unusual and a common channel for command and control

IRC traffic over nonstandard ports

IRC traffic is uncommonly used for business use in most organizations. IRC traffic that originates inside a network and is outbound to the internet is especially unusual and a common channel for command and control. Combine this with the non-standard port observed and this pattern is considered high priority.

Interactive Logon with Service Account

Detects an interactive login using a service account. Service accounts should only be used by applications or services and not users. An interactive logon indicates a user has the service account credentials.

Internal Communication on Unassigned Low Ports - Destination Match

Many ports in the 0-1023 are unassigned by the IANA. These can be used as communication channels inside a network, as there are rarely legitimate services using these ports.

Likely doublepulsar Infected

Hosts infected with the Doublepulsar typically exhibit this type of SMB behavior

MS-LSAT Username Enumeration

The MS-LSAT Remote Protocol provides a number of RPC calls that can be used to map security principal SIDs to usernames. Attackers could use this technique to perform username enumeration and identify accounts on targeted systems.

Malicious PowerShell Get Commands

This rule detects commandlets from common PowerShell exploitation frameworks.

Malicious PowerShell Invoke Commands

Detects Commandlet names from well-known PowerShell exploitation frameworks.

Malicious PowerShell Keywords

This rule detects well known keywords from PowerShell exploitation frameworks.

McAfee Endpoint Security Alerts (Hostname)

McAfee Endpoint Security detected a security event named '{{threat_name}}' with the description '{{description}}'.

McAfee Endpoint Security Alerts (Username)

McAfee Endpoint Security detected a security event named '{{threat_name}}' with the description '{{description}}'.

McAfee Solidifier Deny Events (Hostname)

{{threat_name}} occurred for {{file_path}}

McAfee Solidifier Deny Events (IP Address)

{{threat_name}} occurred for {{file_path}}

McAfee Solidifier Deny Events (Username)

{{threat_name}} occurred for {{file_path}}

McAfee Web Gateway - Poor Reputation

The McAfee Web Gateway detected an HTTP connection to the following site with a poor reputation of "{{description}}": {{fields['urlCategories']}}

Microsoft ATA Alerts (Target Hostname)

{{fields['msg']}}

Microsoft ATA Alerts (Target Username)

{{fields['msg']}}

Mimecast - Message with Virus Detections from IP

Mimecast detected a message with one or more virus detections.

Mimecast - Message with Virus Detections to Recipient

Mimecast detected a message with one or more virus detections.

Mimecast - SPAM Message from IP

Mimecast detected an email message with an elevated SPAM score.

Mimecast - SPAM Message to Recipient

Mimecast detected an email message with an elevated SPAM score.

Mimecast - Targeted Threat Protection from IP

Mimecast's Targeted Threat Protection matched on an email message.

Mimecast - Targeted Threat Protection to Recipient

Mimecast's Targeted Threat Protection matched on an email message.

Network Share Scan

Detects multiple network share access attempts from one internal host to another. Attackers will often scan the network for open network shares in order to pivot between internal hosts.

Network Share Sweep

Detects multiple network share access attempts from one internal host to another for a single share. Attackers will often scan the network for specific open network shares, such as ADMIN$ used for PSEXEC, in order to pivot between internal hosts.

New Suspicious cmd.exe / regedit.exe / powershell.exe Service Launch (Hostname)

The Service Control Manager, or services.exe, has no legitimate reason to launch commands like cmd.exe, powershell.exe, or regedit.exe. Incidentally, a common way for malware to masquerade as something legitimate is to call itself service.exe.

New Suspicious cmd.exe / regedit.exe / powershell.exe Service Launch (User)

The Service Control Manager, or services.exe, has no legitimate reason to launch commands like cmd.exe, powershell.exe, or regedit.exe. Incidentally, a common way for malware to masquerade as something legitimate is to call itself service.exe.

New or Renamed Windows User Account Mimicking a Machine Account

A new or renamed user account which starts with a $ following machine account naming conventions. Attackers could use this to bypass detection logic where machine names are filtered from rules.

Noncompliant Protocol Tunnel Over Common Service Port

Tools or malware may be configured to send communications over a network by using a common service port to carry unrelated traffic. This is often done to bypass security controls or to obfuscate malicious traffic by mimicking a legitimate service. For example, this is often done with UDP based VPN tunnels connecting over port 53. https://attack.mitre.org/techniques/T1043/ describes the use of this technique by attackers.

O365 - Exchange DLP Policy Match

The user {{user_username}} triggered the Exchange DLP policy '{{fields['PolicyDetails.1.PolicyName']}}' on an email message. The incident ID is {{fields['IncidentId']}}

O365 - IP Failing Authentications with Multiple Usernames

An IP address has been observed failing multiple authentications in Office 365 while using many different usernames in a short period of time.

O365 - Multiple Failed Authentications (IP)

An IP address has generated multiple failed authentications sourced from Office 365.

O365 - Multiple Failed Authentications (User)

A user account has generated multiple failed authentications sourced from Office 365.

O365 - SecurityComplianceAlerts

Office 365 SecurityComplianceAlerts

O365 - SharePoint DLP Policy Match

The user {{user_username}} triggered the SharePoint DLP policy '{{fields['PolicyDetails.1.PolicyName']}}' and rule '{{fields['PolicyDetails.1.Rules.1.RuleName']}}' on a file. The file path is '{{fields['SharePointMetaData.FilePathUrl']}}' and the incident ID is {{fields['IncidentId']}}

O365 - Threat Intel ATP Detection

Office 365 Advanced Threat Protection has identified a file as {{fields['DetectionMethod']}} with a classification of {{fields['FileData.MalwareFamily']}}. The file in question is {{file_basename}}

O365 - Threat Intel Email Match (IP)

Office 365 threat intelligence flagged an email from {{fields['P2Sender']}} sent to {{user_username}}. The detection method used was '{{fields['DetectionMethod']}}'.

O365 - Threat Intel Email Match (User)

Office 365 threat intelligence flagged an email from {{fields['P2Sender']}} sent to {{user_username}}. The detection method used was '{{fields['DetectionMethod']}}'.

O365 - Threat Intel URL Match (IP)

Office 365 threat intelligence identified the user {{user_username}} clicked on a malicious URL {{fields['Url']}}.

O365 - Threat Intel URL Match (User)

Office 365 threat intelligence identified the user {{user_username}} clicked on a malicious URL {{fields['Url']}}.

O365 - User attempted login from 2+ countries in 1 hour

O365 - User logged in from 2+ countries in 1 hour

O365 - User successfully logged in from 2+ countries in 1 hour

User successfully logged in from 2+ countries in an hour.

O365 - Users Password Changed

The account {{user_username}} had its password changed by the account {{fields['UserId']}}

O365 - Users Password Reset

The account {{user_username}} was reset by the account {{fields['UserId']}}

Office Application or Browser Launching Shell

This alert detects a shell launched by an office product or browser that should not be spawning shell processes. Attackers may inject code into Office documents or abuse Windows utilities to spawn shells that will execute malicious commands.

Okta SSO - Source IP Authentication Failure Spike with Distinct Usernames

This signal looks for a spike in failed Okta authentications from the same source IP address trying multiple user accounts.

Okta SSO - User Failed Logons (Track IP)

An Okta user has failed multiple authentications in a short period of time.

Okta SSO - User Failed Logons (Track Username)

An Okta user has failed multiple authentications in a short period of time.

Okta SSO - User Login From Two Different Countries

This signal triggers when there are two successful logins from the same user with different country codes indicating possible credential theft.

Outbound TFTP Traffic

TFTP is rarely used externally and has been observed as a means to deliver malicious code from the outside.

Outbound Traffic to Countries Outside the United States

Traffic was observed leaving your network destined to some countries outside the United States within a time frame. This rule is shipped disabled by default as is intended for environments based in the United States with very tight network restriction policies.

Palo Alto - Traps Templated Events

Palo Alto Traps reported a {{fields['profile']}} event from the module {{fields['module_status_id']}}. Additional details include: {{fields['misc']}}

Palo Alto Correlation Event (IP)

The Palo Alto device {{fields['device_name']}} detected '{{fields['object_name']}}' from the IP address {{srcDevice_ip}}.

Palo Alto Correlation Event (User)

The Palo Alto device {{device_hostname}} detected '{{fields['object_id']}}' from the IP address {{srcDevice_ip}}.

Palo Alto Failed Authentication - Multiple Attempts from the Same IP

A source IP address failed authentication multiple times within a short period of time.

Palo Alto Failed Authentication - Multiple Attempts from the User

A user account failed authentication multiple times within a short period of time.

Palo Alto Failed Authentication - Multiple Usernames Attempted

A source IP address attempted and failed to authenticate multiple times while providing multiple usernames. This can indicate a dictionary attack where the attacker is attempting to log in with a list of commonly known usernames and passwords.

Palo Alto Firewall Threat (IP)

The Palo Alto firewall detected a threat type of '{{fields['sub_type']}}' categorized as '{{fields['category']}}' as a {{severity}} severity. The source zone is {{fields['source_zone']}} and the destination zone is {{fields['destination_zone']}}. The policy which detected the traffic is {{fields['rule_name']}}.

Palo Alto Firewall Threat (User)

The Palo Alto firewall detected a threat type of '{{fields['sub_type']}}' categorized as '{{fields['category']}}' as a {{severity}} severity. The source zone is {{fields['source_zone']}} and the destination zone is {{fields['destination_zone']}}. The policy which detected the traffic is {{fields['rule_name']}}.

Pastebin Raw URL Resource Request

Attackers will often host malicious code on pastebin.com and attempt to download their additional payloads if their initial attack is successful. They will download the post with the raw URI. Generally the malicious content hosted on Pastebin.com is quickly removed automatically by the poster setting an expire time.

Port Scan - External

External port scan. A host external to the monitored network was detected as showing behavior consistent with a scan for a port on multiple destination addresses in a short time.

Port Scan - Internal

Internal port scan. A host on the monitored network was detected as showing behavior consistent with a scan for a port on multiple destination addresses in a short time.

Possible Black Energy Command and Control

Black Energy is a botnet with HTTP based Command and Control communication

Possible Credential Abuse

This signal logic is designed to catch repetitive attempts to call (and presumably attempt to auth via) login pages for drupal, wordpress, and jira.

Possible DGA Domain

The CSE anomaly engine has determined that the observed domain may have been created using a domain generation algorithm (DGA).

Possible DNS Data Exfiltration

Some families of malware use data nested within the subdomain portion of a DNS query as a means of data exfiltration. This can be identified by looking for DNS queries where the full query is substantially longer than the top-level domain (e.g., ooo.nu6tgnzvgm2tmmbzgq4a.rkgotw5.5z5i6fjnugmxfowy.beevish.com is substantially longer than beevish.com). This technique is described in https://attack.mitre.org/techniques/T1001/.

Possible DNS over TLS (DoT) Activity

This rule detects attempted or successful connections to the standard service port for DoT services. DNS over TLS (RFC 7858, DoT) is a name resolution service that allows clients to resolve DNS records over encrypted and validated connections. DoT operates over standards compliant TLS and is specified to operate over port 853/tcp. In some environments this may be abused as a method to bypass security and policy controls. Some malicious actors leverage DoT to tunnel DNS traffic over TLS, and research has demonstrated the ability to carry out other DNS related abuse such as malware C2 over DoT as well.

Possible TOR Connection

The subject and issuer of the SSL certificate match the pattern for certificates used by TOR connections.

Potential Pass the Hash Activity

The behavior discovered here loosly matches the behavior of known pass the hash tools. A Pass the Hash (PtH) attack is a way for an attacker to move laterally through a type of credential theft. Because this behavior is known to occur in some environments during normal activity, tuning is recommended and attention payed to a possible spike in signals after enableing this rule.

Potential malicious JVM download

A document was downloaded and opened followed by a file download using a Java user-agent.

Potential malicious document executed

A document was downloaded and opened followed shortly by an executable or dll download shortly thereafter

Potentially vulnerable software detected

The software version has a known vulnerability

PowerShell Encoded Command

PowerShell can execute encoded Base64 strings with the Encoded Command cmdlet. Attackers will often use Base64 to obfuscate their payloads until they can decode and execute it with PowerShell.

PowerShell File Download

PowerShell scripts are commonly used as droppers, which will download additional tools onto a compromised host.

PowerShell Remote Administration

Remote Administration from Powershell is logged by default in the admin$temp folder. These commands should only be associated with IP addresses that are expected to carry out remote administration tasks.

PowerShell via SMB

PowerShell being accessed via SMB should never occur in a Windows environment, and indicates malicious activity.

Process Execution Inside Webserver Root Folder (Hostname)

A process was executed from inside a web hosting directory. This signal could indicate when adversaries upload a malicious file to the webserver and run the file as a process. Approved web applications that require process execution from inside the web hosting directory should be excluded from the rule and filtered out.

Process Execution Inside Webserver Root Folder (User)

A process was executed from inside a web hosting directory. This signal could indicate when adversaries upload a malicious file to the webserver and run the file as a process. Approved web applications that require process execution from inside the web hosting directory should be excluded from the rule and filtered out.

Proofpoint TAP - IP Sent Email with Malware

Proofpoint TAP detected an IP address sending an email with a malware score 75 or higher. Records indicating the email was permitted will have a higher signal score compared to those automatically blocked by Proofpoint.

Proofpoint TAP - IP Sent Email with Malware Link

Proofpoint TAP detected a user clicking on a link containing malware in an email sent from an IP address. This rule only includes messages where Proofpoint considers the malware link still active. Records indicating the link was permitted will have a higher signal score compared to those automatically blocked by Proofpoint.

Proofpoint TAP - IP Sent Email with Phishing Link

Proofpoint TAP detected a user clicking on a phishing link in an email sent from an IP address. This rule only includes messages where Proofpoint considers the phishing link still active. Records indicating the link was permitted will have a higher signal score compared to those automatically blocked by Proofpoint.

Proofpoint TAP - IP Sent Impostor Email

Proofpoint TAP detected an IP address sending an email with an impostor score 75 or higher. Records indicating the email was permitted will have a higher signal score compared to those automatically blocked by Proofpoint.

Proofpoint TAP - IP Sent Phishing Email

Proofpoint TAP detected an IP address sending an email with a phishing score 75 or higher. Records indicating the email was permitted will have a higher signal score compared to those automatically blocked by Proofpoint.

Proofpoint TAP - User Received Email with Malware

Proofpoint TAP detected a user receiving an email with a malware score 75 or higher. Records indicating the email was permitted will have a higher signal score compared to those automatically blocked by Proofpoint.

Proofpoint TAP - User Received Email with Malware Link

Proofpoint TAP detected a user clicking on a malware link in an email. This rule only includes messages where Proofpoint considers the malware link still active. Records indicating the link was permitted will have a higher signal score compared to those automatically blocked by Proofpoint.

Proofpoint TAP - User Received Email with Phishing Link

Proofpoint TAP detected a user clicking on a phishing link in an email. This rule only includes messages where Proofpoint considers the phishing link still active. Records indicating the link was permitted will have a higher signal score compared to those automatically blocked by Proofpoint.

Proofpoint TAP - User Received Impostor Email

Proofpoint TAP detected a user receiving an email with an impostor score 75 or higher. Records indicating the email was permitted will have a higher signal score compared to those automatically blocked by Proofpoint.

Proofpoint TAP - User Received Phishing Email

Proofpoint TAP detected a user receiving an email with a phishing score 75 or higher. Records indicating the email was permitted will have a higher signal score compared to those automatically blocked by Proofpoint.

PsExec Admin Tool Detection

Detects PSEXESVC.EXE being written to remote computer via SMB/CIFS. This is a service executable that is copied in place and started when a remote client connects to a host with PsExec.

RDP Brute Force - Success

Hydra and Ncrack are popular tools for attempting brute force attacks to access a targeted system. In this case, a brute force attempt against an RDP server has succeeded and the attacker has gained access to the targeted system.

RDP Brute Force Attempt

An attacker is making a brute force attempt to gain access to an RDP server.

RDP Error Messages

When setting up an RDP connection, there are a number of negotiation steps that happen. If a connection is enrypted, not all of these can be analyzed. Errors can indicate an operational issue or potential exploitation of a vulnerability in negotiation.

RDP Login from Localhost

RDP login with a localhost source address may indicate a tunneled login and an attacker attempting to move through the environment.

RDP external-to-internal

Access of Remote Desktop from the internet is not common and may represent an intrusion on the network.

RDP with non-standard client

While the product_id of the RDP client is not required, a missing one or one that does not look like a client access license can indicate an RDP attack with hacker software (ie NCRACK, hydra).

Request to Anomalous Web Server Software

Attackers often stage content during intrusions using external web infrastructure to host exploits, malware and other tooling. In rare cases attacker playbooks show the threat actor hosting web files by serving them using the SimpleHTTPServer server, a lightweight built-in web server module installed with Python. Occurrences of clients connecting to servers implemented using SimpleHTTPServer are anomalous and may indicate an active attack.

Request to DNS over HTTPS (DoH) Service Provider

DNS over HTTPS (RFC 8484, DoH) is a web based name resolution service that allows clients to resolve DNS records over web services. DoH operates over standards compliant HTTPS and is therefore typically encrypted and validated TLS over port 443/tcp. In some environments this may be abused as a method to bypass security and policy controls. Some malicious actors leverage DoH to tunnel DNS traffic over HTTPS, and research has demonstrated the ability to carry out other DNS related abuse such as malware C2 over DoH as well.

SMB - Remote execution and/or persistence via scheduled task using ATSVC

Remote execution and/or persistence via scheduled task using ATSVC named pipe.

SMB Brute Force Attempt

This rule looks for failed SMB login attempts.

SMB External to Internal File Share Access

This signal identifies external sources connecting to file shares. Do to the vulnerabilities and insecurities of SMB this type of traffic should be prohibited.

SMB Internal to External traffic

SMB/CIFS is a workgroup protocol for file sharing intended to be used among trusted systems on an internal LAN. A number of risks are associated with internal systems connecting to untrusted external SMB servers, including exploit delivery, credential harvesting, and data exfiltration. SMB access should be limited to the enterprise network to prevent participation in unknown SMB related attacks. Limited exceptions may exist, such as file server access over extranet connections.

SMB Scanning Detected

This rule looks for a host scanning other SMB hosts for specific commands similar to WannaCry

SMB write to hidden admin share

SMB is primarily used for remote file access across a network. SMB access to admin shares should be a rare occurrence, especially by a non-administrator account. Such access is often a part of an attack pivot once an attacker has compromised one machine in a network.

SQL Injection Attacker

SQL Injection attempt detected

SQL Injection Victim

Successful SQL Injection attack detected

SQL-Select-From

Requests to web applications containing SQL statement keywords may indicate attempts to compromise the web application or access data in a backend database engine in an unauthorized manner. This technique is described at https://attack.mitre.org/techniques/T1190/.

SSH Authentication Failures

Many SSH authentication failures from the same source IP in a short period of time can signal a brute-force attack.

SSH Interesting Hostname Login

"Interesting hostname" in this context include those that start with dns, ns, smtp, mail, pop, imap, www, and ftp. Using SSH to hosts that appear to be purposed as servers corresponding to one of these hostnames is considered suspicious.

SSH Password Brute Force

SSH Password brute force attack detected

SSH Password Brute Force Successful Login

SSH Login successful from a brute force password attack

SSH to non-standard port

SSH connections to a non-standard port.

SSL Certificate Expired

A server responded on a SSL or TLS service using an expired certificate.

SSL Certificate Expires Soon

A server responded on a SSL or TLS service using a certificate that will expire soon.

SSL Certificate Not Valid Yet

A server responded on a SSL or TLS service using a certificate with a future-dated NotValidBefore attribute.

SSL Heartbleed Attack

SSL Heartbleed Attack detected

SSL Heartbleed Attack Successful

SSL Heartbleed Attack Successful

SSL Heartbleed Many Requests

Indicates we saw many heartbeat requests without a reply. Might be an attack.

SSL Heartbleed Odd Length

SSL Heartbleed Odd Length

SSL Invalid Server Cert

A server responded on a SSL or TLS service using a certificate identified as invalid by the Network Sensor.

SYSVOL Share Sweep

When attempting to pivot within an internal AD network, attacks will query the Domain Controllers for passwords stored within group policy files. This is typically done by querying the SYSVOL share. A host querying the SYSVOL share is suspicious activity and could be indicative of this type of attack.

Scheduled Task Created via PowerShell

Attackers have been known to leverage PowerShell for scheduled task creation for the purpose of maintaining persistence in a Windows based environment.

Scheduled Task Creation with Suspicious Task Executable

Attackers may create scheduled tasks to execute commands in various scenarios. Inclusion of commonly abused or high risk Windows executables may be an indication of an attack.

Script/CLI UserAgent string

This pattern discovers HTTP communications from an internal source where a development library or command line client user-agent string was observed (e.g. Wget, cURL, etc.). Use of these techniques by attackers is described in https://attack.mitre.org/techniques/T1105/ and https://attack.mitre.org/techniques/T1064/.

Self-signed Certificates

A server responded on a SSL or TLS service using a self-signed certificate.

Server-Side Code Injection in URL

Attackers may use improper URL checking to inject code that is executed on a server. This may be used in DoS attacks or to execute commands to elevate privilege. The attack pattern is similar to Shellshock exploitation.

Shellshock

HTTP requests with headers indicating an attempt to exploit CVE-2014-6271 and related vulnerabilities in the Bash shell using Bashdoor/Shellshock attack. This vulnerability is most often triggered in CGI scripts implemented against vulnerable versions of the shell.

Sophos Endpoint Not Protected

Sophos detected a condition indicating that endpoint protection is not activated

Sophos HMPA Exploit Prevented

Sophos HMPA Exploit Prevented

Sophos PUA Detected

Sophos detected a potentially unwanted application (PUA) on the endpoint

Sophos SAV Disabled

Sophos real time protection disabled

Sophos Service Not Running

One or more Sophos services are missing or not running

Sophos Threat Detected

Sophos detected a medium severity threat on the endpoint

Sophos Web Control Violation

Sophos blocked access to a website for an undisclosed reason

Sophos Web Filtering - Blocked

Sophos blocked access to malicious web content

Successful Overpass the Hash Attempt (IP)

Identifies a suspicious windows logon of type 9 (NewCredentials). This signal is suspicious due to its similarity to the behavior observed when using Mimikatz's sekurlsa::pth tool.

Successful Overpass the Hash Attempt (Username)

Identifies a suspicious windows logon of type 9 (NewCredentials). This signal is suspicious due to its similarity to the behavior observed when using Mimikatz's sekurlsa::pth tool.

Sumo Logic Scheduled Searches - Hostname

{{description}}

Sumo Logic Scheduled Searches - IP

{{description}}

Sumo Logic Scheduled Searches - Username

{{description}}

Suricata IDS Alerts (Attack Signatures)

A Suricata IDS alert triggered and the source IP address is likely the initiator of the traffic based on when the source port is higher than the destination port.

Suricata IDS Alerts (Response Signatures)

A Suricata IDS alert triggered and the destination IP address is likely the initiator of the traffic based on when the source port is lower than the destination port.

Suspicious DC Logon

Suspicious DC login. Non ADMIN logging into a domain controller.

Suspicious Email Origin

The email has originitated from a suspicious location

Suspicious HTTP User-Agent

Common administrative tools may be used by malware authors and attackers who use live-off-the-land methods to operate on victim networks.

Suspicious PowerShell Keywords

Detects keywords that could indicate the use of a PowerShell exploitation framework.

Suspicious Registry Key Modification

This rule detects modifications to registry keys commonly targeted to achieve persistence.

Suspicious Shells Spawned by Web Servers (Hostname)

Web servers that spawn shell processes could be the result of a successfully placed web shell or an other attack

Suspicious Shells Spawned by Web Servers (User)

Web servers that spawn shell processes could be the result of a successfully placed web shell or an other attack

Suspicious Windows ANONYMOUS LOGON Account Created

Detects the creation of suspicious accounts similar to ANONYMOUS LOGON. These accounts could be created as a covering detection vs network type 3 logons for shared resources, such as folders or printers.

Symantec SEP Alerts (Target Hostname)

Symantec SEP alerted on behavior from the host {{device_hostname}}

Symantec SEP Alerts (Target IP)

Symantec SEP alerted on behavior from the host {{device_hostname}}

Symantec SEP Alerts (Target Username)

Symantec SEP alerted on behavior from the host {{device_hostname}}

Tanium - Templated Signals

A Tanium signal has been reported with the following tags '{{fields['Intel Labels']}}' based on the process '{{file_path}}'

The Audit Log was Cleared - 1102

Attackers may attempt to clear the Windows Security Event Log in an effort to hide records of their activity during an intrusion. This rule detects that action.

Threat Intel - Device IP Matched Threat Intel Domain Name

A record flagged a hostname or domain from a threat intelligence match list

Threat Intel - Device IP Matched Threat Intel File Hash

A record flagged a file hash from a threat intelligence match list

Threat Intel - Device IP Matched Threat Intel URL

A record flagged a URL from a threat intelligence match list

Threat Intel - Source IP Matched Threat Intel Domain Name

A record flagged a hostname or domain from a threat intelligence match list

Threat Intel Match - IP Address

A record flagged an IP address from a threat intelligence match list

Too Many Failed Login Attempts

Excessive failed login attempts were observed for accounts in a Windows domain

Too Many Kerberos Encryption Downgrade SPNs (Kerberoasting)

Kerberoasting is an attack method that allows an attacker to crack the passwords of service accounts in Active Directory offline and without fear of detection. This is facilitated by requesting service tickets that have data encrypted with weak encryption types (typically RC4). This technique is described in https://attack.mitre.org/techniques/T1208/.

Too many empty/refused DNS queries

The DNS request/response was empty or refused. This may be an indication of DNS tunneling. (Excludes IPv4/IPv6 multicast DNS and LLMNR traffic).

Trend Micro Deep Security File Integrity Monitoring Alerts (Device Hostname)

{{description}}

Trend Micro Deep Security File Integrity Monitoring Alerts (Device IP)

{{description}}

Trend Micro Deep Security File Integrity Monitoring Alerts (User)

{{description}}

User Account Created and Deleted in 24 Hours

User Account Created and Deleted in 24 Hours.

VBS file downloaded from Internet

Although Visual Basic scripts (.vbs) are sometimes regularly downloaded from the Internet, they are often part of malware establishment. They carry an elevated risk.

Varonis Alerts

Description: {{description}}, Outcome: {{fields['outcome']}}

WMI Launching Shell

A WMI process has been used to launch a SHELL on "{{device_hostname}}"

WMI Managed Object Format (MOF) Process Execution

Attackers will often utilize The Managed Object Format (MOF) compiler to conceal and execute their malicious code within the WMI Repository.

WMI Process Call Create

An attacker can use WMI to create malicious processes on the local or remote host to bypass application whitelisting, since WMI is an authorized Windows tool.

WMI Process Get Brief

An attacker can use WMI to execute scripts on a host by pointing to malicious XSL files.

Web Services Executing Common Web Shell Commands (Hostname)

This rule looks for web server executables attempting to use commands commonly associated with adversaries utilizing a successfully uploaded web shell.

Web Services Executing Common Web Shell Commands (IP)

This rule looks for web server executables attempting to use commands commonly associated with adversaries utilizing a successfully uploaded web shell.

Web Services Executing Common Web Shell Commands (User)

This rule looks for web server executables attempting to use commands commonly associated with adversaries utilizing a successfully uploaded web shell.

Websense - Blocked Activity Threshold

Websense blocked a large amount of activity originating from a single host within a short period of time.

Windows - Domain Trust Discovery (Hostname)

Suspicious Domain Trust Discovery Activity - T1482

Windows - Domain Trust Discovery (User)

Suspicious Domain Trust Discovery Activity - T1482

Windows - Excessive User Interactive Logons Across Multiple Hosts

A user performed a significant number of Windows interactive logins to multiple destination hosts in the past 24 hours. This behavior can be expected for some accounts, such as administrators in a Windows environment. Tuning this rule is highly recommended to filter out usernames where applicable.

Windows - Incoming LSASS Network Connection - Zerologon Behavior(CVE-2020-1472)

CVE-2020-1472 can be exploited by attackers to hijack enterprise servers due to Netlogon cryptographic weaknesses. The vulnerability allows an attacker to set a password for the computer account of an Active Directory Domain Controller, which can then be abused to pull credentials from the Domain Controller. This rule detects an incoming network connection made from the attacking machine to the victim Domain Controller to the LSASS process.

Windows - Local System executing whoami.exe (Hostname)

Local system account - Suspicious System Owner/User Discovery Activity - T1033 - requires commandline auditing 4688

Windows - Microsoft Office Add-In File Created

This rule detects when a Microsoft Office Add-In is created by monitoring certain directories with specific file extensions. This rule requires the setup of file creation auditing.

Windows - Network trace capture using netsh.exe (Hostname)

Detects capture of a network trace via the netsh.exe trace functionality - requires commandline auditing of Event ID 4688

Windows - Network trace capture using netsh.exe (User)

Detects capture of a network trace via the netsh.exe trace functionality - requires commandline auditing of Event ID 4688

Windows - Permissions Group Discovery (Hostname)

Suspicious Permissions Group Discovery Activity - T1069

Windows - Permissions Group Discovery (User)

Suspicious Permissions Group Discovery Activity - T1069

Windows - Powershell Scheduled Task Creation from PowerSploit or Empire

This rule detects the creation of a Windows scheduled task via PowerSploit or the default configuration of Empire.

Windows - Remote System Discovery (Hostname)

Suspicious Remote System Discovery Activity - T1018

Windows - Remote System Discovery (User)

Suspicious Remote System Discovery Activity - T1018

Windows - Scheduled Task Creation

A scheduled task was created in Windows or Azure. It is common for system administrators and approved software to create scheduled tasks, but adversaries are known to use them for persistence within a Windows environment. This rule is disabled by default due to the volume of events it can produce. Users should filter/exclude allowed scheduled tasks according to their environment before enabling the rule. The scheduled task name is logged in the "commandLine" field.

Windows - System Network Configuration Discovery (Hostname)

Suspicious System Network Configuration Discovery Activity - T1016

Windows - System Network Configuration Discovery (User)

Suspicious System Network Configuration Discovery Activity - T1016

Windows - User Adds Self to Security Group

The user account {{user_username}} has added themselves to the Windows security group {{changeTarget}}.This could indicate a user attempting to escalate their privileges.

Windows - WiFi Credential Harvesting with netsh (Hostname)

Harvesting of Wifi Credentials Using netsh.exe

Windows - WiFi Credential Harvesting with netsh (User)

Harvesting of Wifi Credentials Using netsh.exe

Windows Account Added To Privileged Security Group

This signal alerts on the elevation of privileges assigned to a domain user account according to Windows Event ID 4728, 4732, and/or 4756.

Windows Account Locked Out - 4740

This signal fires whenever Windows Event type 4740 is seen in the environment.

Windows Network Sniffing (Hostname)

Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

Windows Network Sniffing (User)

Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

Windows Process Name Impersonation

This alert detects a process executing with a name that closely resembles a default Windows process. Malware will often attempt to disguise its execution by using a similar name to blend in with standard processes.

Windows Service Executed from Nonstandard Execution Path

Windows services launching from locations outside of their standard installation path is a common malware persistence mechanism.

Windows Temp Directory Access Via SMB

This can be seen as suspicious, as you will not often see remote systems pulling files from the Windows Temp directory of other systems.

Windows User Account Created with Abnormal Naming Convention

'changeTarget' should be populated with a reguar expression that matches the user naming convention. This rule detects a user account that has been created that does not fit the normal naming convention established. If an unauthorized account has been created, it could be used to maliciously access additional systems.

Write-only SNMP attempt from external

Probing for the default SNMP write password is a way to bypass network security hardware

ZeroLogon Privilege Escalation Behavior

An attack against CVE-2020-1472 may create thousands of NetrServerReqChallenge & NetrServerAuthenticate3 requests in a short amount of time. https://github.com/SecuraBV/CVE-2020-1472

Zscaler - Elevated Risk Score Events

Zscaler generated a record with an elevated risk score of {{fields['riskscore']}} from the user {{user_username}} and IP address {{srcDevice_ip}}.

vpnoverdns.com DNS lookup

vpnoverdns.com is a free service providing VPN functionality over DNS. DNS resolutions for *.tun.vpnoverdns.com indicate usage of their VPN service. The service describes itself as "Data exfiltration, for those times when everything else is blocked.".