Release 15 - Out-of-the-box alerts
- Juan Tomás Alonso Nieto (Deactivated)
Detection name | Detection description | Devo table / Data source / Category | Update |
| Used to identify the default port for VNC connections |
| Logic updated |
| Detects when a single internal IP is scanning other internal IPs using different ports for each scan attempt. This is a low and slow technique intended to avoid triggering traditional port scan and port sweep alerts. |
| Updated to be viewable in Data Search |
| Detects TFTP to an external network address. TFTP is rared used externally and has been observed as a means to stage data remotely for exfiltration. |
| New Alert |
| Detects users downloading high risk files via requests without hostnames or referrers. Most legitimate downloads will have a valid hostname and referrer. |
| New Alert! |
| Detects for creation of files or folders that begin with "." or "/." by a user. This could indicate an attacker attempting to hide files on the system that are easily overlooked. [NOTICE] Requires the auditing of 'execve'. Â |
| Requires the auditing of 'execve'. |
| A record flagged a destination host from a threat intelligence match list. |
| Fixed field naming |
| Detects user accounts that are created and delete within a four time period. |
| Updated alert logic |
| Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution. Microsoft-Windows-Sysmon required. |
| Updated alert Logic |
| Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution. |
| Alert Logic Updated |
| Detects a new process which involves a Windows local system sensitive file. |
| Alert Logic Updated |
| Â |
| Alert Logic Updated |
| Detects a shell launched by an Office product or browser that should not be spawning shell processes. Attackers may inject code into Office documents or abuse Windows utilities to spawn shells that will execute malicious commands. |
| Alert Logic Updated |
| Control over the navigation of the users and systems of the networks is considered essential to avoid risks. Access to anonymous navigation networks must be monitored. |
| Alert Logic Updated |