Alert Types by XDR Event Name
The following information lists alert types alphabetically by their XDR event name. Details for each alert type can be viewed by clicking the More details link.
For alert types listed alphabetically by their display name, see Alert Types by Name.
XDR Event Name |
Display Name |
---|---|
ade_outbytes_anomaly |
Data Ingestion Volume Anomaly More details
Data Ingestion Volume AnomalyA sensor is sending an anomalously high or low volume of data, compared to its typical volume. Check the sensor. A low volume could indicate a sensor failure or other problems. For a high volume, determine the cause of the increase. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe data ingestion volume of every data sensor with sensor id (
A sample Interflow includes the sensor ID ( |
ade_outbytes_anomaly_flip |
Sensor Status Anomaly More details
Sensor Status AnomalyThe sensor has changed its status from "connected" to "disconnected". XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsFor each sensor, its connection status is checked periodically, if the status changes from “connected“ to “disconnected“, the anomaly is triggered. A sample Interflow includes the sensor ID ( |
anomalous_file_action |
File Action Anomaly More details
File Action AnomalyActions, such as move, copy, delete, or change attribute, were taken on a file or files an anomalous number of times. Investigate the actions and the user to see if this is expected. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe number of file actions for each user ( |
asset_violation |
Unapproved Asset Activity More details
Unapproved Asset ActivityAn asset has been marked as unapproved in one of the Investigate | Asset Activity tabs. Unapproved assets generate one alert per day until their approval status is changed with either the Approve or Ignore button in the Asset Activity tabs. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf an analyst marks an asset as unapproved in the Asset Activity tabs, a daily alert is triggered until the asset is either manually approved or ignored. |
aws_ami_public |
AWS AMI Made Public More details
AWS AMI Made PublicAn AWS AMI was made public. Check with the user to make sure this was intentional. XDR Kill Chain
XDR Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsFor each AWS account ( |
aws_malicious_activity |
Potentially Malicious AWS Activity More details
Potentially Malicious AWS ActivityThe Potentially Malicious AWS Activity rules are used to identify suspicious activity within AWS logs. Any one or more of these will trigger the Potentially Malicious AWS Activity alert type. Event NameThe Key Fields and Relevant Data Points
Link to Rule-Based Alert TypesRules Contributing to Potentially Malicious AWS Activity Alert Type |
aws_s3_ransomware |
AWS S3 Ransomware More details
AWS S3 RansomwarePossible AWS S3 ransomware was detected. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsFor each AWS account user name ( |
aws_stoplogging |
AWS Logging Stopped More details
AWS Logging StoppedAWS CloudTrail logging was stopped. Check with the user to make sure this was intentional. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsFor each AWS account ( |
aws_suspicious_bucket_enumeration |
Suspicious AWS Bucket Enumeration More details
Suspicious AWS Bucket EnumerationThe Suspicious AWS Bucket Enumeration rules are used to identify suspicious activity related to AWS Bucket Enumeration. Any one or more of these will trigger the AWS Bucket Enumeration alert type. Event NameThe Key Fields and Relevant Data Points
Link to Rule-Based Alert TypesRules Contributing to Suspicious AWS Bucket Enumeration Alert Type |
aws_suspicious_cloudtrail_logs_modification |
Suspicious Modification of AWS CloudTrail Logs More details
Suspicious Modification of AWS CloudTrail LogsThe Suspicious Modification of AWS CloudTrail Logs rules are used to identify suspicious activity within AWS Cloudtrail logs. Any one or more of these will trigger the Suspicious Modification of AWS CloudTrail Logs alert type. Event NameThe Key Fields and Relevant Data Points
Link to Rule-Based Alert TypesRules Contributing to Suspicious Modification of AWS CloudTrail Logs Alert Type |
aws_suspicious_ec2_activity |
Suspicious AWS EC2 Activity More details
Suspicious AWS EC2 ActivityThe Suspicious AWS EC2 Activity rules are used to identify suspicious activity within AWS EC2 logs. Any one or more of these will trigger the Suspicious AWS EC2 Activity alert type. Event NameThe Key Fields and Relevant Data Points
Link to Rule-Based Alert TypesRules Contributing to Suspicious AWS EC2 Activity Alert Type |
aws_suspicious_iam_activity |
Suspicious AWS IAM Activity More details
Suspicious AWS IAM ActivityThe Suspicious AWS IAM Activity rules are used to identify suspicious activity within AWS IAM logs. Any one or more of these will trigger the Suspicious AWS IAM Activity alert type. Event NameThe Key Fields and Relevant Data Points
Link to Rule-Based Alert TypesRules Contributing to Suspicious AWS IAM Activity Alert Type |
aws_suspicious_modification_of_route_table |
Suspicious Modification of AWS Route Table More details
Suspicious Modification of AWS Route TableThe Suspicious Modification of AWS Route Table rules are used to identify suspicious activity related to modification of AWS Route Table. Any one or more of these will trigger the Suspicious Modification of AWS Route Table alert type. Event NameThe Key Fields and Relevant Data Points
Link to Rule-Based Alert TypesRules Contributing to Suspicious Modification of AWS Route Table Alert Type |
aws_suspicious_modification_of_s3_bucket |
Suspicious Modification of S3 Bucket More details
Suspicious Modification of S3 BucketThe Suspicious Modification of S3 Bucket rules are used to identify suspicious activity within S3 Bucket logs. Any one or more of these will trigger the Suspicious Modification of S3 Bucket alert type. Event NameThe Key Fields and Relevant Data Points
Link to Rule-Based Alert TypesRules Contributing to Suspicious Modification of S3 Bucket Alert Type |
aws_suspicious_rds_event |
Suspicious AWS RDS Event More details
Suspicious AWS RDS EventThe Suspicious AWS RDS Event rules are used to identify suspicious activity related to AWS RDS Event. Any one or more of these will trigger the Suspicious AWS RDS Event alert type. Event NameThe Key Fields and Relevant Data Points
Link to Rule-Based Alert Types |
aws_suspicious_root_account_activity |
Suspicious AWS Root Account Activity More details
Suspicious AWS Root Account ActivityThe Suspicious AWS Root Account Activity rules are used to identify suspicious activity with AWS Root Account. Any one or more of these will trigger the Suspicious AWS Root Account Activity alert type. Event NameThe Key Fields and Relevant Data Points
Link to Rule-Based Alert TypesRules Contributing to Suspicious AWS Root Account Activity Alert Type |
aws_suspicious_route53_activity |
Suspicious AWS Route 53 Activity More details
Suspicious AWS Route 53 ActivityThe Suspicious AWS Route 53 Activity rules are used to identify suspicious activity within AWS Route 53 logs. Any one or more of these will trigger the Suspicious AWS Route 53 Activity alert type. Event NameThe Key Fields and Relevant Data Points
Link to Rule-Based Alert TypesRules Contributing to Suspicious AWS Route 53 Activity Alert Type |
aws_suspicious_vpc_flow_logs_modification |
Suspicious AWS VPC Flow Logs Modification More details
Suspicious AWS VPC Flow Logs ModificationThe Suspicious AWS VPC Flow Logs Modification rules are used to identify suspicious modification of AWS VPC Flow logs. Any one or more of these will trigger the Suspicious AWS VPC Flow Logs Modification alert type. Event NameThe Key Fields and Relevant Data Points
Link to Rule-Based Alert TypesRules Contributing to Suspicious AWS VPC Flow Logs Modification Alert Type |
azure_ad_add_app_multitenant |
Azure AD Apps Modified To Allow Multi-Tenant Access More details
Azure AD Apps Modified To Allow Multi-Tenant AccessAzure AD detected an application being modified to allow multi-tenant access. Check with the organization to be sure this was expected. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf Azure AD detects any user ( |
azure_ad_change_domain |
Azure AD Custom Domains Changed More details
Azure AD Custom Domains ChangedAzure AD detected a custom domain being changed. Check with the organization to be sure this was expected. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf Azure AD detects any user ( |
bad_process |
Process Anomaly More details
Process AnomalyA process has been launched an anomalously large number of times. Investigate the process and the user to see if this is expected. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe number of times a process ( |
bad_reputation_login |
Bad Reputation Login More details
Bad Reputation LoginA successful login was detected from an IP address with a history of malicious activity. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe login records are checked for every source IP address ( |
carbonblack_edr_anomaly |
Carbon Black: XDR Anomaly More details
Carbon Black: XDR AnomalyOn a specific device, an anomalously large number of VMware Carbon Black endpoint log records or a rarely seen type of record has been observed compared to the typical number in a measured interval. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe number of occurrences of Carbon Black endpoint (cloud) log, based on the “UNKNOWN“ threat category ( |
cloud_account_login_failure_okta |
Account MFA Login Failure Anomaly More details
Account MFA Login Failure AnomalyAn anomalously large number of Multi-Factor Authentication (MFA) user login failures was observed for an account. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsMulti-Factor Authentication login failures and successes are calculated periodically for every account ( |
cnc_reputation |
Command & Control Reputation Anomaly More details
Command & Control Reputation AnomalyAn anomalously large number of connections were made to known command and control servers. Investigate the connections and source hosts. If malicious, block the IP addresses of the command and control servers. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe number of connections for every destination IP ( |
command_anomaly |
Command Anomaly More details
Command AnomalyA command has been executed an anomalously large number of times compared to its typical executions or those of other commands. Investigate the command and the user to determine if this is expected. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe number of times a command ( |
country_communication_anomaly |
Outbound Destination Country Anomaly More details
Outbound Destination Country AnomalyA host that typically communicates with a small, consistent number of countries communicated with a new country. Investigate the destination, to see if it is benign. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsHosts ( |
cryptojacking |
Cryptojacking More details
CryptojackingAn unauthorized coin miner used a computer to mine cryptocurrency. Consider blocking the source IP address. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf an unauthorized coin miner is detected by IDS, an alert is triggered. A sample Interflow includes the IDS signature ( |
cylance_edr_anomaly |
CylanceOPTICS: XDR Anomaly More details
CylanceOPTICS: XDR AnomalyOn a specific device, a rarely seen or an anomalously large number of CylanceOPTICS endpoint log records has been observed, compared to the typical number in a measured interval or has been observed after several days of silence. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe number of occurrences of CylanceOPTICS log records ( |
dga_resolvable |
DGA More details
DGAA host is using a potential Domain Generation Algorithm (DGA). If the target domain is a malicious domain, the host might be compromised. Investigate the DGA domains and the host. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsWhenever a host ( If a monitored host ( |
dhcp_anomaly |
DHCP Server Anomaly More details
DHCP Server AnomalyA new DHCP server appeared in the network. This could be a hacker attempting to steer traffic. Investigate and consider telling employees to avoid this server. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf a DHCP server that has never been seen before appears in the network, an alert is triggered. The Interflow includes the DHCP server IP address ( |
dns_tunnel |
DNS Tunneling Anomaly More details
DNS Tunneling AnomalyAn anomalously large number of connections tunneling high-entropy traffic through DNS were made. This can indicate data exfiltration. Investigate the tunnel and source host. If malicious, block the source host. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe DNS queries ( |
dstip_bad_reps |
Bad Destination Reputation Anomaly More details
Bad Destination Reputation AnomalyA destination IP address with a bad reputation has received an anomalously large number of connections. Investigate the connections and consider blocking the destination IP address. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe number of connections for every destination IP address ( |
email_recent_domain_correlation |
Possible Phishing Site Visit from Email More details
Possible Phishing Site Visit from EmailA user visited a recently registered domain shortly after using email, indicating a possible phishing site visit. Check to see if the site is malicious. If so, check with the user to see if they are compromised. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf a user ( When an alert is triggered, a new correlation event is created. The Interflow includes the reference ID of the original record of the domain visit ( |
emerging_threat |
Emerging Threat More details
Emerging ThreatStellar Cyber detected one or more emerging threats in traffic. Investigate the IP address and consider blocking. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsStellar Cyber monitors traffic for emerging threats. An alert is triggered if emerging threats are observed in any of the following:
Note that only one of these is needed to trigger the alert. So, although the Interflow includes the source IP address ( |
encoded_powershell |
Encoded PowerShell More details
Encoded PowerShellA Windows host executed an encoded PowerShell script. Investigate the script contents to see if it is malicious. If so, consider quarantining the host. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf a Windows host ( |
encrypted_phishing_site |
Possible Encrypted Phishing Site Visit More details
Possible Encrypted Phishing Site VisitA possible phishing site visit to a recently registered domain was detected in encrypted traffic. Check with the user to determine whether their system is compromised. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf an encrypted connection to a recently registered site ( |
exploit_attempt_correlation |
Exploited C&C Connection More details
Exploited C&C ConnectionAn exploited host with vulnerabilities initiated a connection to the exploit attacker, which could indicate the host being compromised and performing C&C activities. See if the exploit was successful. Check the source host, and consider blocking. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsTwo events are involved in this alert type. In the first event, an attacker ( When an alert is triggered a new correlation event is generated. The Interflow of the correlation event includes the reference ID of the exploit event ( |
exploit_attempt_priv_priv |
Private to Private Exploit Anomaly More details
Private to Private Exploit AnomalyA private IP address initiated a large number of exploit attempts identified by a given signature or a rarely seen exploit attempt to another private IP address. Investigate that signature. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe occurrences of each malware ( |
exploit_attempt_priv_pub |
Private to Public Exploit Anomaly More details
Private to Public Exploit AnomalyA private IP address initiated a large number of exploit attempts identified by a given signature or a rarely seen exploit attempt to a public IP address. Investigate that signature. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe occurrences of each malware ( |
exploit_attempt_pub_priv |
Public to Private Exploit Anomaly More details
Public to Private Exploit AnomalyA public IP address initiated a large number of exploit attempts identified by a given signature or a rarely seen exploit attempt to a private IP address. Investigate that signature. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe occurrences of each malware ( |
exploit_attempt_pub_pub |
Public to Public Exploit Anomaly More details
Public to Public Exploit AnomalyA public IP address initiated a large number of exploit attempts identified by a given signature or a rarely seen exploit attempt to another public IP address. Investigate that signature. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe occurrences of each malware ( |
external_clear_password |
External Plain Text Passwords Detected More details
External Plain Text Passwords DetectedA plain text password was detected in unencrypted traffic. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf there are plain text passwords in unencrypted traffic records with a public source IP address (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_cloud_account_login_failure |
External Account Login Failure Anomaly More details
External Account Login Failure AnomalyAn anomalously large number of user login failures was observed for an account. Check with the user. This alert type has a relatively long detection delay of up to 40 minutes because it waits for login events from high latency data sources and is sensitive to the event order of user logins. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsLogin failures and successes are calculated periodically for every account (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_credential_stuffing |
External Credential Stuffing More details
External Credential StuffingAn anomalously large amount of username/password testing was detected on AWS, Okta, or Windows. Check the activity after successful logins, and consider blocking the source IP addresses. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsExternal credential stuffing is the constant testing of username/password combinations on the AWS, Okta, or Windows authentication functions. Login activity is monitored and if the number of failed logins is larger than normal for that service, an alert is triggered. The Interflow includes the service (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_database_command |
External SQL Shell Command More details
External SQL Shell CommandShell commands were detected over a SQL connection, which is a common way hackers try to gain shell access over vulnerable SQL applications. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsFor SQL query records, if special commands (such as
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_fw_action |
External Firewall Denial Anomaly More details
External Firewall Denial AnomalyA source host had actions blocked by a firewall too many times. Investigate the firewall rules that were violated. If suspicious, block the source IP address. XDR Kill ChainKill Chain Stage: Initial Attempts Tactic: [External] XDR NBA (XTA0002) Technique: XDR Firewall Anomaly (XT2002) Tags: [External; Network Traffic Analysis; Firewall Anomalies] Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe number of firewall denials for every source IP address (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_fw_policy_id |
External Firewall Policy Anomaly More details
External Firewall Policy AnomalyA rarely triggered firewall policy has been violated. Investigate that policy and track down the violation. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsA firewall policy violation (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_handshake_failure |
External Handshake Failure More details
External Handshake FailureThere were too many handshake failures between two hosts, which might indicate port scanning. Check the source host to see if this was expected and, if not, consider blocking the host. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf a host (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_ids_signature_spike |
External IDS Signature Spike More details
External IDS Signature SpikeA source IP address transmitted an anomalous number of different IDS signatures. Typically, this indicates host penetration or vulnerability scanning. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe number of unique IDS signatures (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_malware_activity |
External Other Malware More details
External Other MalwareMalware with uncategorized malicious activity was observed. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf ML-IDS or sandbox indicates malware that cannot be categorized as ransomware, spyware, trojan, PUA, or adware, an alert is triggered. A sample Interflow includes malicious activity for sandbox (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_mysql_anomaly |
External SQL Anomaly More details
External SQL AnomalyAn IP address sent an anomalously large number of queries to a SQL server. Investigate the queries. If suspicious, block the source IP address. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe number of SQL queries for every source IP address (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_non_std_port_anomaly |
External Non-Standard Port Anomaly More details
External Non-Standard Port AnomalyAn application had an anomalously large number of connections or a rarely seen connection on non-standard ports. Check the application to be sure this is benign. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe number of connections for an application (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_password_spray |
External Password Spraying More details
External Password Spraying.An anomalously large number of failed logins with unknown user names was observed on external Windows authentication services. Check the activity after successful logins, and consider blocking the source IP addresses. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf a potential password spraying attack is observed, an alert is triggered. The Interflow includes a source (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_pii_leak |
External PII Leaked More details
External PII LeakedPersonally identifiable information (social security numbers or credit cards) has been detected in the clear. Check the source to see if it is compromised. If so, consider blocking it. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf a personally identifiable information leak is detected by IDS, an alert is triggered. A sample Interflow includes the IDS signature (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_port_scan |
External IP / Port Scan Anomaly More details
External IP / Port Scan AnomalyA host has either generated an anomalous number of connections compared to the typical amount, or has triggered an anomalous number of connection failure responses, in the measured interval. This can indicate that an attacker is scanning for computers or ports to exploit. This alert type has two subtypes: Alert Subtype: Connection Failure Anomaly (Sensor Traffic) XDR Kill ChainEvent NameThe Key Fields and Relevant Data Points
Use Case with Data PointsFor every unique triplet (source IP address, destination IP address, and destination port) browsed by each source IP address ( Considering that a lateral scan (private to private) is more sensitive than a non-lateral scan, this alert type is divided into two parts. One focuses on lateral scan analysis, the other focuses on non-lateral scan analysis. The mechanism remains the same as before, with the trigger condition for lateral scan alert being more sensitive than non-lateral one. Validation / RemediationIf the source IP address is internal targeting an external address, check with the user if they are aware of the activity or if they are authorized to perform the activity. Inform the user's supervisor if the activity is unauthorized. If the source IP address is external targeting any addresses, check the reputation of the source IP address as in known malicious/scanner. Potential False PositivesSome legitimate activities such as vulnerability scans or penetration testing may trigger this alert type, if from an external IP address to an internal IP address. Alert Subtype: Connection Spike Anomaly (Firewall / Windows Traffic) XDR Kill ChainEvent NameThe Key Fields and Relevant Data Points
Use Case with Data PointsFor every unique (destination IP address and destination port) browsed by each source IP address ( Considering that a lateral scan (private to private) is more sensitive than a non-lateral scan, this alert type is divided into two parts. One focuses on lateral scan analysis, the other focuses on non-lateral scan analysis. The mechanism remains the same as before, with the trigger condition for lateral scan alert being more sensitive than non-lateral one. Validation / RemediationIf the source IP address is internal targeting an external address, check with the user if they are aware of the activity or if they are authorized to perform the activity. Inform the user's supervisor if the activity is unauthorized. If the source IP address is external targeting any addresses, check the reputation of the source IP address as in known malicious/scanner. Potential False PositivesSome legitimate activities such as vulnerability scans or penetration testing may trigger this alert type, if from an external IP address to an internal IP address.
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_protocol_account_login_failure |
External Protocol Account Login Failure Anomaly More details
External Protocol Account Login Failure AnomalyAn anomalously large number of login failures over SMB or FTP was observed. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data PointsUse Case with Data Points
For every user name (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_pua |
External PUA More details
External PUAUnwanted applications or malware that bombards the user with advertisements has been detected. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf ML-IDS or sandbox indicates potentially unwanted applications (PUA), an alert is triggered. A sample Interflow includes malicious activity for sandbox (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_ransomware |
External Ransomware More details
External RansomwareMalware that prevents you from accessing your system or files and demands ransom payment in order to regain access was detected. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf ML-IDS or sandbox indicates ransomware, an alert is triggered. A sample Interflow includes malicious activity for sandbox (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_rdp_bluekeep |
External RDP BlueKeep More details
External RDP BlueKeepDetects the use of a scanner by zerosum0x0 that discovers targets vulnerable to BlueKeep (CVE-2019-0708). Check the IP address and block if necessary. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf the scanner by zerosum0x0 is used, an alert is triggered. A sample Interflow includes the IDS signature (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_rdp_brute_force |
External RDP Brute Force Attack More details
External RDP Brute Force AttackAn anomalously large number of RDP connections to an RDP server was observed. Check the source IP addresses to see if they are unknown or malicious, and monitor any successful RDP logins. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsRDP connection activity is monitored and the number of connections are calculated periodically. If the number of connections to an RDP server (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_rdp_suspicious_outbound |
External RDP Suspicious Outbound More details
External RDP Suspicious OutboundNon-standard tools connecting to TCP port 3389 were detected. This could indicate lateral movement attempting to establish an RDP connection. Check the IP address and block if necessary. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsConnections to TCP port 3389 are monitored, and if non-standard tools connect, an alert is triggered. A sample Interflow includes the source IP address (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_scan_anomalies |
External Scanner Behavior Anomaly More details
External Scanner Behavior AnomalyAn anomalously large amount of scanning behavior was found. Cross-check with the IP/Port Scan Anomaly alert. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe number of occurrences of each scanner, based on IDS signature (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_smb_anomaly |
External SMB Write Anomaly More details
External SMB Write AnomalyAn IP address sent an anomalously large number of SMB write requests. Investigate the files that the IP address tried to write. If suspicious, block the source IP address. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe number of SMB write requests for every source IP address (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_smb_read_anomaly |
External SMB Read Anomaly More details
External SMB Read AnomalyAn IP address sent an anomalously large number of read requests to SMB protocol based service(s). Investigate the files that the IP address tried to read. If suspicious, block the source IP address. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe number of SMB read requests for every source IP address (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_smb_user_scan |
External SMB Username Enumeration More details
External SMB Username EnumerationAt least 5 different users SMB login attempts and 1 denied attempt or at least 10 different users SMB login attempts, were detected from the same source. Check the source IP address. If malicious, consider blocking it. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf one source IP address (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_spyware_activity |
External Spyware More details
External SpywareMalware that collects and shares information about a device without consent was detected. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf ML-IDS or sandbox indicates spyware activity, an alert is triggered. A sample Interflow includes malicious activity for sandbox (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_sql_db_dump |
External SQL Dumpfile Execution More details
External SQL Dumpfile ExecutionThe SQL XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf the SQL
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_suspected_malicious_user_agent |
External Suspected Malicious User Agent More details
External Suspected Malicious User AgentAn external HTTP connection was made by a user agent that has been identified as potentially malicious. Investigate the connection's destination. This alert type has two subtypes: XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf a seen user agent is identified as suspicious, an alert is triggered. The alert includes the suspicious user agent ( Alert Subtype: Predicted Malicious Agent The Predicted Malicious Agent alert subtype is the same as the External Suspected Malicious User Agent alert type above, with the following differences:
Alert Subtype: Known Malicious Agent Match The Known Malicious Agent Match alert subtype is the same as the External Suspected Malicious User Agent alert type above, with the following differences:
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_syn_flood |
External SYN Flood Victim More details
External SYN Flood VictimAn attacker sends a large amount of SYN requests to a target's system in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic. Check to see if the host is malicious or compromised. If so, consider blocking the source host. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf a host (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_syn_flood_attacker |
External SYN Flood Attacker More details
External SYN Flood AttackerAn attacker sends a large amount of SYN requests to a target's system in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic. Check to see if the host is malicious or compromised. If so, consider blocking the source host. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf a host (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_trojan_activity |
External Trojan More details
External TrojanMalware that disguises itself as legitimate software in order to gain access to a system or files has been detected. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf ML-IDS or sandbox indicates trojan activity, an alert is triggered. A sample Interflow includes malicious activity for sandbox (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_url_scan |
External URL Reconnaissance Anomaly More details
External URL Reconnaissance AnomalyAn anomalous number of HTTP 4xx errors was detected. This can indicate an attacker scanning for pages to exploit. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsFor every unique URL browsed by each source IP address (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_user_agent_anomaly |
External User Agent Anomaly More details
External User Agent AnomalyAn HTTP connection was made by a user agent that has never been observed by Stellar Cyber (or been seen very rarely). Investigate the connection destination. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsAll user agent (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_user_bytes_sum |
External User Data Volume Anomaly More details
External User Data Volume AnomalyA user had an anomalously large volume of traffic compared to its typical volume or that of its peers. Investigate the user to see if this is expected. Firewall and non-firewall data do not contribute to the same alert, so this alert will have either entirely firewall data or no firewall data. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe total traffic volume of each user identified by user ID ( The Interflow includes the source IP address (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_user_login_fail |
External User Login Failure Anomaly More details
External User Login Failure AnomalyAn anomalous number of login failures was observed for one of the following applications: SSH, SMTP, FTP, RDP, SMB, databases, Active Directory, Office 365, Okta, AWS CloudTrail, or Google Workspace. For Okta, an anomalous number of multi-factor authentication (MFA) failures was observed. Check with the user. This alert type has a relatively long detection delay of up to 40 minutes because it waits for login events from high latency data sources and is sensitive to the event order of user logins. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsLogin failures and successes are calculated periodically for every source (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_user_success_brute_forcer |
External Brute-Forced Successful User Login More details
External Brute-Forced Successful User LoginA successful login was observed from an IP address that had previously seen a large number of login failures, or a successful login to a user account was observed from another IP address or IP addresses that had previously seen a large number of login failures to that account. Check with the user. This alert type has two subtypes: This alert type has a relatively long detection delay of up to 40 minutes because it waits for login events from high latency data sources and is sensitive to the event order of user logins. XDR Kill Chain
Event NameThe Alert Subtype: Source IP-Based The source IP-based alert subtype has the same XDR Kill Chain and Event Name as the user ID-based alert subtype, but differs in the Key Fields and Relevant Data Points and Use Case with Data Points. Key Fields and Relevant Data Points
Use Case with Data PointsThe login records are checked for every external source IP address (
A sample Interflow includes the source IP address ( The user ID-based alert subtype has the same XDR Kill Chain and Event Name as the source IP-based alert subtype, but differs in the Key Fields and Relevant Data Points and Use Case with Data Points. Key Fields and Relevant Data Points
Use Case with Data PointsThe login records to a user account (
A sample Interflow includes the source IP address (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_user_uncommon_app |
External User Application Usage Anomaly More details
External User Application Usage AnomalyA user who typically uses a small, consistent number of applications used a new application. Investigate the application, to see if it is benign. Check with the user to see if this was expected. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsAn alert is triggered under the following conditions:
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
external_vuln_exploit_correlation |
External Exploited Vulnerability More details
External Exploited VulnerabilityA host with a vulnerability discovered by a security scanning tool was exploited by an attack on that same vulnerability, indicating a high probability of success. Check the target to see if it was compromised. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsAn attacker ( When an alert is triggered, a new correlation event is generated. The Interflow of the correlation event includes the ID of the IDS exploit event (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
file_creation |
File Creation Anomaly More details
File Creation AnomalyA file or files were created an anomalously large number of times. Check with the user to see if this is expected. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe number of file creations for each user ( |
gsuite_account_manipulation |
Google Workspace Account Manipulation More details
Google Workspace Account ManipulationA Google Workspace user was suspended for a suspicious reason or because a password leak was detected. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsFor each Google Workspace account ( |
gsuite_attack_warning |
Google Workspace Attack Warning More details
Google Workspace Attack WarningAttacks to a Google Workspace account were detected. Check with the account holder. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsFor each Google Workspace account ( |
gsuite_suspicious_activities |
Google Workspace Suspicious Activities More details
Google Workspace Suspicious ActivitiesSuspicious activities were detected in a Google Workspace account. Check with the account holder. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsFor each Google Workspace account ( |
gsuite_user_suspended |
Google Workspace User Suspended More details
Google Workspace User SuspendedA Google Workspace user was suspended. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsFor each Google Workspace account ( |
hydra_password_guessing_hack_tool |
Hydra Password Guessing Hack Tool More details
Hydra Password Guessing Hack ToolA user on a Windows host executed a command-line script that launched either the hydra.exe command or a command using known Hydra style parameters, which may be an inappropriate use of the Hydra password guessing tool. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThis alert is triggered if a Windows host ( Validation / RemediationCheck the body of the Powershell script that is reported on the Windows host to identify whether the contents of the script are actually malicious. If malicious, consider quarantining the host. Potential False PositivesThe running of any executable named |
internal_clear_password |
Internal Plain Text Passwords Detected More details
Internal Plain Text Passwords DetectedA plain text password was observed in unencrypted traffic. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf there are plain text passwords in traffic records with a public source IP address (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_cloud_account_login_failure |
Internal Account Login Failure Anomaly More details
Internal Account Login Failure AnomalyAn anomalously large number of login failures from an internal source IP address to an internal destination IP address was observed for an account. Check with the user. This alert type has a relatively long detection delay of up to 40 minutes because it waits for login events from high latency data sources and is sensitive to the event order of user logins. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsLogin failures and successes between any internal IP addresses are calculated periodically for every account (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_credential_stuffing |
Internal Credential Stuffing More details
Internal Credential StuffingAn anomalously large amount of username/password testing was detected on an internal Windows authentication service. Check the activity after successful logins, and consider blocking the internal source IP addresses. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsInternal credential stuffing is the constant testing of username/password combinations on the AWS, Okta, or Windows authentication functions. Login activity is monitored and if the number of failed logins is larger than normal for that service, an alert is triggered. The Interflow includes the service (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_database_command |
Internal SQL Shell Command More details
Internal SQL Shell CommandShell commands were detected over a SQL connection, which is a common way hackers try to gain shell access over vulnerable SQL applications. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsFor SQL query records, if special commands (such as
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_fw_action |
Internal Firewall Denial Anomaly More details
Internal Firewall Denial AnomalyA internal source host had actions blocked by a firewall too many times. Investigate the firewall rules that were violated. If suspicious, block the internal source IP address. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe number of firewall denials for every internal source IP address (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_fw_policy_id |
Internal Firewall Policy Anomaly More details
Internal Firewall Policy AnomalyA rarely triggered firewall policy involving an internal source IP and internal destination IP has been violated. Investigate that policy and track down the violation. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsA firewall policy violation (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_handshake_failure |
Internal Handshake Failure More details
Internal Handshake FailureThere were too many handshake failures between two internal hosts, which might indicate port scanning. Check the source host to see if this was expected, and if not, consider blocking the host. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf an internal host (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_ids_signature_spike |
Internal IDS Signature Spike More details
Internal IDS Signature SpikeA source IP address transmitted an anomalous number of different IDS signatures. Typically, this indicates host penetration or vulnerability scanning. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe number of unique IDS signatures (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_malware_activity |
Internal Other Malware More details
Internal Other MalwareMalware with uncategorized malicious activity was detected. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf ML-IDS or sandbox indicates malware in internal traffic that cannot be categorized as ransomware, spyware, trojan, PUA, or adware, an alert is triggered. A sample Interflow includes malicious activity for sandbox (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_mysql_anomaly |
Internal SQL Anomaly More details
Internal SQL AnomalyAn internal IP address sent an anomalously large number of queries to an internal SQL server. Investigate the queries. If suspicious, block the source IP address. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe number of SQL queries for every internal source IP address (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_non_std_port_anomaly |
Internal Non-Standard Port Anomaly More details
Internal Non-Standard Port AnomalyAn application had an anomalously large number of connections or a rarely seen connection to an internal IP address on non-standard ports. Check the application to be sure this is benign. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe number of connections for an application (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_password_spray |
Internal Password Spraying More details
Internal Password SprayingAn anomalously large number of failed logins with unknown user names was observed on internal Windows authentication services. Check the activity after successful logins, and consider blocking the internal source IP addresses. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf a potential password spraying attack is observed, an alert is triggered. The Interflow includes a source (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_pii_leak |
Internal PII Leaked More details
Internal PII LeakedPersonally identifiable information (social security numbers or credit cards) has been detected in internal traffic in the clear. Check the source to see if it is compromised. If so, consider blocking it. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf a personally identifiable information leak is detected by IDS, an alert is triggered. A sample Interflow includes the IDS signature (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_port_scan |
Internal IP / Port Scan Anomaly More details
Internal IP / Port Scan AnomalyA host has either generated an anomalous number of connections compared to the typical amount, or has triggered an anomalous number of connection failure responses, in the measured interval. This can indicate that an attacker is scanning for computers or ports to exploit. Check with the user. This alert type has two subtypes: Alert Subtype: Connection Failure Anomaly (Sensor Traffic) XDR Kill ChainEvent NameThe Key Fields and Relevant Data Points
Use Case with Data PointsFor each internal source IP address ( Validation / RemediationCheck with the user related to the internal source IP address. Inform the user's supervisor if the activity is unauthorized. Potential False PositivesSome legitimate activities such as vulnerability scans or penetration testing may trigger this alert type. Alert Subtype: Connection Spike Anomaly (Firewall / Windows Traffic) XDR Kill ChainEvent NameThe Key Fields and Relevant Data Points
Use Case with Data PointsFor every unique triplet (source IP address, destination IP address, and destination port) browsed by each source IP address ( Considering that a lateral scan (private to private) is more sensitive than a non-lateral scan, this alert type is divided into two parts. One focuses on lateral scan analysis, the other focuses on non-lateral scan analysis. The mechanism remains the same as before, with the trigger condition for lateral scan alert being more sensitive than non-lateral one. Validation / RemediationCheck with the user related to the internal source IP address. Inform the user's supervisor if the activity is unauthorized. Potential False PositivesSome legitimate activities such as vulnerability scans or penetration testing may trigger this alert type.
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_protocol_account_login_failure |
Internal Protocol Account Login Failure Anomaly More details
Internal Protocol Account Login Failure AnomalyAn anomalously large number of login failures over SMB or FTP was observed. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data PointsUse Case with Data Points
For every user name (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_pua |
Internal PUA More details
Internal PUAUnwanted applications or malware that bombards the user with advertisements in internal traffic has been detected. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf ML-IDS or sandbox indicates potentially unwanted applications (PUA) in internal traffic, an alert is triggered. A sample Interflow includes malicious activity for sandbox (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_ransomware |
Internal Ransomware More details
Internal RansomwareMalware that prevents you from accessing your system or files and demands ransom payment in order to regain access in internal traffic was detected. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf ML-IDS or sandbox indicates ransomware in internal traffic, an alert is triggered. A sample Interflow includes malicious activity for sandbox (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_rdp_bluekeep |
Internal RDP BlueKeep More details
Internal RDP BlueKeepDetects the use of a scanner by zerosum0x0 that discovers targets vulnerable to BlueKeep (CVE-2019-0708) between internal hosts. Check the IP address and block if necessary. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf the scanner by zerosum0x0 is used, an alert is triggered. A sample Interflow includes the IDS signature (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_rdp_brute_force |
Internal RDP Brute Force Attack More details
Internal RDP Brute Force AttackAn anomalously large number of RDP connections from internal host(s) to an RDP server was observed. Check the source IP addresses to see if they are unknown or malicious, and monitor any successful RDP logins. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsRDP connection activity is monitored and the number of connections calculated periodically. If the number of connections from internal host(s) to an RDP server (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_rdp_suspicious_outbound |
Internal RDP Suspicious Outbound More details
Internal RDP Suspicious OutboundNon-standard tools from an internal host connecting to TCP port 3389 in the other internal host were detected. This could indicate lateral movement attempting to establish an RDP connection. Check the IP address and block if necessary. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsConnections to TCP port 3389 are monitored, and if non-standard tools connect, an alert is triggered. A sample Interflow includes the source IP address (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_scan_anomalies |
Internal Scanner Behavior Anomaly More details
Internal Scanner Behavior AnomalyAn anomalously large amount of scanning behavior between internal hosts was identified. Cross-check with the IP/Port Scan Anomaly alert. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe number of occurrences of each scanner, based on IDS signature (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_smb_anomaly |
Internal SMB Write Anomaly More details
Internal SMB Write AnomalyAn internal IP address sent an anomalously large number of SMB write requests to other internal IP address(es). Investigate the files that the IP address tried to write. If suspicious, block the source IP address. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe number of SMB write requests to internal IP address(es) for every internal source IP address (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_smb_read_anomaly |
Internal SMB Read Anomaly More details
Internal SMB Read AnomalyAn internal IP address sent an anomalously large number of SMB read requests. Investigate the files that the IP address tried to read. If suspicious, block the source IP address. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe number of SMB read requests for every internal source IP address (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_smb_user_scan |
Internal SMB Username Enumeration More details
Internal SMB Username EnumerationAt least 5 different users SMB login attempts and 1 denied attempt or at least 10 different users SMB login attempts, were detected from an internal IP address to other internal IP address(es). Check the source IP address. If malicious, consider blocking it. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf an internal source IP address (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_spyware_activity |
Internal Spyware More details
Internal SpywareMalware that collects and shares information about a device without consent in internal traffic was detected. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf ML-IDS or sandbox indicates spyware activity in internal traffic, an alert is triggered. A sample Interflow includes malicious activity for sandbox (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_sql_db_dump |
Internal SQL Dumpfile Execution More details
Internal SQL Dumpfile ExecutionThe SQL XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf any SQL
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_suspected_malicious_user_agent |
Internal Suspected Malicious User Agent More details
Internal Suspected Malicious User AgentAn internal HTTP connection was made by a user agent that has been identified as potentially malicious. Investigate the connection's destination. This alert type has two subtypes: XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf a seen user agent is identified as suspicious, an alert is triggered. The alert will contain the suspicious user agent ( Alert Subtype: Predicted Malicious Agent The Predicted Malicious Agent alert subtype is the same as the Internal Suspected Malicious User Agent alert type above, with the following differences:
Alert Subtype: Known Malicious Agent Match The Known Malicious Agent Match alert subtype is the same as the Internal Suspected Malicious User Agent alert type above, with the following differences:
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_syn_flood |
Internal SYN Flood Victim More details
Internal SYN Flood VictimA large amount of SYN requests to an internal target were observed, which can indicate an attempt to consume server resources and make the target unresponsive. Check to see if the host is malicious or compromised. If so, consider blocking the source host. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf too many SYN packets (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_syn_flood_attacker |
Internal SYN Flood Attacker More details
Internal SYN Flood AttackerAn internal attacker sends a large amount of SYN requests to internal target system(s) in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf an internal host (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_trojan_activity |
Internal Trojan More details
Internal TrojanMalware that disguises itself as legitimate software in order to gain access to a system or files in internal traffic has been detected. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf ML-IDS or sandbox indicates trojan activity in internal traffic, an alert is triggered. A sample Interflow includes malicious activity for sandbox (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_url_scan |
Internal URL Reconnaissance Anomaly More details
Internal URL Reconnaissance AnomalyAn anomalous number of HTTP 4xx errors from an internal IP address to other internal IP addresses was detected. This can indicate an attacker scanning for pages to exploit. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsFor each internal source IP address (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_user_agent_anomaly |
Internal User Agent Anomaly More details
Internal User Agent AnomalyAn internal HTTP connection was made by an internal user agent that has never been observed by Stellar Cyber(or been seen very rarely). Investigate the connection destination. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsAll user agents (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_user_bytes_sum |
Internal User Data Volume Anomaly More details
Internal User Data Volume AnomalyA user had an anomalously large volume of internal traffic compared to its typical volume or that of its peers. Investigate the user to determine if this is expected. Firewall and non-firewall data do not contribute to the same alert, so this alert will have either entirely firewall data or no firewall data. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe total internal traffic volume of each user identified by user ID ( The Interflow includes the source IP address (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_user_login_fail |
Internal User Login Failure Anomaly More details
Internal User Login Failure AnomalyAn anomalous number of login failures between internal IP addresses was observed for one of the following applications: SSH, SMTP, FTP, RDP, SMB, databases, Active Directory, Office 365, Okta, AWS CloudTrail, Google Workspace, Salesforce, or This alert type has a relatively long detection delay of up to 40 minutes because it waits for login events from high latency data sources and is sensitive to the event order of user logins. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsLogin failures and successes between internal IP addresses are calculated periodically for every source (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_user_success_brute_forcer |
Internal Brute-Forced Successful User Login More details
Internal Brute-Forced Successful User LoginA successful login was observed from an IP address that had previously seen a large number of login failures, or a successful login to a user account was observed from another IP address or IP addresses that had previously seen a large number of login failures to that account. Check with the user. This alert type has two subtypes: This alert type has a relatively long detection delay of up to 40 minutes because it waits for login events from high latency data sources and is sensitive to the event order of user logins. XDR Kill Chain
Event NameThe Alert Subtype: Source IP-Based The source IP-based alert subtype has the same XDR Kill Chain and Event Name as the user ID-based alert subtype, but differs in the Key Fields and Relevant Data Points and Use Case with Data Points. Key Fields and Relevant Data Points
Use Case with Data PointsThe login records to an internal IP address (
A sample Interflow includes the source IP address ( The user ID-based alert subtype has the same XDR Kill Chain and Event Name as the source IP-based alert subtype, but differs in the Key Fields and Relevant Data Points and Use Case with Data Points. Key Fields and Relevant Data Points
Use Case with Data PointsThe login records to a user account (
A sample Interflow includes the source IP address (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_user_uncommon_app |
Internal User Application Usage Anomaly More details
Internal User Application Usage AnomalyAn internal user who usually runs a few applications with internal service IP addresses suddenly runs a new application. Investigate the application, to see if it is benign. Check with the user to see if this was expected. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsAn alert is triggered under the following conditions:
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
internal_vuln_exploit_correlation |
Internal Exploited Vulnerability More details
Internal Exploited VulnerabilityAn internal host with a vulnerability discovered by a security scanning tool was exploited by an attack on that same vulnerability, indicating a high probability of success. Check the target to see if it was compromised. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsAn attacker ( When an alert is triggered, a new correlation event is generated. The Interflow of the correlation event includes the ID of the IDS exploit event (
More on Internal versus External and Inbound vs Outbound
Stellar Cyber reports both internal and external versions of some alerts, with
different analysis and recommended actions for each. Similarly, IDS signatures report the direction of data flow as
|
long_session_anomaly |
Long App Session Anomaly More details
Long App Session AnomalyAn application had an anomalously long session compared to its typical session length or that of its peers. Investigate the application to see if this session was expected. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsEvery application's ( |
mal_access |
Malicious Site Access More details
Malicious Site AccessA host accessed a URL with a reputation for potentially hosting malware. Check the URL and, if malicious, consider blocking it. Check the host for compromise. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsWhen a host ( |
malware_on_disk |
Malware on Disk More details
Malware on DiskMalicious software or a potentially unwanted application found on a device and reported as not cleaned. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf either of the following occurs, an alert is triggered:
A sample Interflow includes the computer name ( |
mimikatz_dcsync |
Mimikatz DCSync More details
Mimikatz DCSyncAn attempt to replicate Active Directory for the first time on a domain controller, or the first time by that account, has occurred. Evaluate whether the replication is intended and, if not, consider disabling the account involved in the replication and investigate for further signs of compromise. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThis alert is triggered when replication of an Active Directory domain controller ( Validation / RemediationTo triage an alert of this type, consider first verifying whether the Active Directory replication event was expected. If the replication is not intended, then the alert has indicated that a DCSync attack is highly likely. This attack can be very severe, because all password hashes stored on the targeted domain controller might have been dumped. Disable the account involved in the replication as soon as possible and further investigate the account for any signs of compromise. There is no simple remediation for a confirmed DCSync attack. Evaluate the overall risks of credential leakage and apply appropriate corrective actions, including minimizing accounts with permissions to perform Active Directory replication, and forcing a change of credentials for accounts with weak passwords. Potential False PositivesThe following will trigger an alert:
|
mimikatz_mem_scan |
Mimikatz Credential Dump More details
Mimikatz Credential DumpA potential Mimikatz memory dump was detected. Check the process to determine whether the host is compromised. Consider quarantining the host. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data Points If a process ( |
network_uncommon_app |
Uncommon Application Anomaly More details
Uncommon Application AnomalyPrivate (internal assets) to public (Internet) traffic has revealed an application that has never been observed by Stellar Cyber (or been seen very rarely). Investigate that application and ensure that it is benign. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf an application ( |
network_uncommon_process |
Uncommon Process Anomaly More details
Uncommon Process AnomalyAn asset launched a process that has never been observed by Stellar Cyber (or been seen very rarely). This could indicate a malware attack. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf a process ( |
new_registered_domain |
Recently Registered Domains More details
Recently Registered DomainsA DNS request was detected for a site that was registered less than 90 days ago. Check the domain. If suspicious, notify users. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf a domain has been registered within the last 90 days, an alert is triggered. A sample Interflow includes the domain name ( |
office365_access_governance_alert |
Office 365 Access Governance Anomaly More details
Office 365 Access Governance AnomalyThis alert type is deprecated as of the 4.3.7 release. It is replaced by Microsoft 365 alert integration. See Microsoft 365: Valid Accounts (Privilege Escalation) and Microsoft 365: Account Manipulation. Office 365 generated an access governance alert, which might indicate a change in Exchange admin privileges. Check with the user to make sure this was expected. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsFor each Office 365 account ( |
office365_admin_audit_logging_disabled |
Office 365 Admin Audit Logging Disabled More details
Office 365 Admin Audit Logging DisabledOffice 365 admin audit logging was disabled, make sure this change was expected. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsOffice 365 monitors each Office 365 account ( |
office365_blocked_user |
Office 365 Blocked User More details
Office 365 Blocked UserThis alert type is deprecated as of the 4.3.7 release. It is replaced by Microsoft 365 alert integration. See Microsoft 365: Valid Accounts (Initial Access). The Office 365 Security Compliance Center discovered a user exceeding the sending limits of the service or outbound spam policies and blocked the user from sending email. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsOffice 365 monitors email sending actions for each Office 365 account ( |
office365_content_filter_policy_changed |
Office 365 Content Filter Policy Changed More details
Office 365 Content Filter Policy ChangedThe Microsoft Exchange content policy was changed. An overly permissive content policy can allow spammers to send your organization unwanted email. Make sure this change was expected. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsOffice 365 monitors all Office 365 accounts ( |
office365_data_exfiltration_attempt |
Office 365 Data Exfiltration Attempt Anomaly More details
Office 365 Data Exfiltration Attempt AnomalyThis alert type is deprecated as of the 4.3.7 release. It is replaced by Microsoft 365 alert integration. See Microsoft 365: Exfiltration Over Web Service. The Office 365 Security Compliance Center discovered a data exfiltration attempt. Office 365 then blocked, quarantined, encrypted, or applied a hold on the possible exfiltration. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsOffice 365 periodically checks each Office 365 account ( |
office365_data_loss_prevention |
Office 365 Data Loss Prevention More details
Office 365 Data Loss PreventionThis alert type is deprecated as of the 4.3.7 release. It is replaced by Microsoft 365 alert integration. See Microsoft 365: Exfiltration Over Web Service. The Office 365 Security Compliance Center discovered data loss. Office 365 then blocked, quarantined, encrypted, or applied a hold on the possible exfiltration. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsOffice 365 periodically checks each Office 365 account ( |
office365_malware_filter_policy_changed |
Office 365 Malware Filter Policy Changed More details
Office 365 Malware Filter Policy ChangedThe Microsoft Exchange malware filter policy changed. An overly permissive malware filter policy can allow attackers to send malicious attachments to your organization. Make sure this change was expected. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsOffice 365 monitors all Office 365 accounts ( |
office365_multi_file_restore |
Office 365 Multiple Files Restored More details
Office 365 Multiple Files RestoredOffice 365 detected that multiple files were restored in a short period. Check with the user. XDR Kill ChainEvent NameThe Key Fields and Relevant Data Points
Use Case with Data PointsOffice 365 periodically checks file restore records. If multiple file restore records are detected within a short period, an alert is triggered. A sample Interflow includes the Office 365 account ID ( |
office365_multi_user_deleted |
Office 365 Multiple Users Deleted More details
Office 365 Multiple Users DeletedOffice 365 detected that multiple users were deleted in a short period. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsOffice 365 periodically checks user deletion records. If multiple users were deleted within a short period, an alert is triggered. A sample Interflow includes the Office 365 account ID ( |
office365_outside_entity_file_sharing |
Office 365 File Sharing with Outside Entities More details
Office 365 File Sharing with Outside EntitiesAn Office 365 account shared multiple files with entities outside of the organization. Check with the user to make sure this was expected. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsOffice 365 monitors sharing with outside entities for each Office 365 account ( |
office365_password_policy_changed |
Office 365 Password Policy Changed More details
Office 365 Password Policy ChangedOffice 365 identified a change to your organization's password policy, which is uncommon. Make sure this was expected. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsOffice 365 monitors all Office 365 accounts ( |
office365_security_conf_changed |
Office 365 Network Security Configuration Changed More details
Office 365 Network Security Configuration ChangedOffice 365 identified a change to your organization's network security configuration, which is uncommon. Make sure this was expected. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsOffice 365 monitors all Office 365 accounts ( |
office365_sharing_policy_changed |
Office 365 Sharing Policy Changed More details
Office 365 Sharing Policy ChangedOffice 365 identified a change to your organization's sharing policy, which is uncommon. Make sure this was expected. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsOffice 365 monitors all Office 365 accounts ( |
office365_user_network_admin_changed |
Office 365 User Network Admin Changed More details
Office 365 User Network Admin ChangedThe Office 365 account’s network admin information was changed. Make sure this change was expected. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsOffice 365 monitors the network admin information for each Office 365 account ( |
outbytes_anomaly |
Outbytes Anomaly More details
Outbytes AnomalyA source IP address transmitted an anomalously high amount of outbound traffic to one or multiple destination addresses in a 5 minute interval. This could indicate data exfiltration. Firewall and non-firewall data do not contribute to the same alert, so this alert will have either entirely firewall data or no firewall data. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsEvery source host's ( |
parent_child |
Abnormal Parent / Child Process More details
Abnormal Parent / Child ProcessA process that typically launches a small, consistent number of child processes launched a new child process. Investigate the child process to see if it is benign. This alert type has two subtype categories: Alert Subtype: Machine Learning Anomaly Detection XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsEach pair of parent/child processes ( Alert Subtype: Rule Based Detection The Parent/Child Suspicious Process Creation rules are used to identify suspicious activity with parent/child relationships associated with process creation. Any one or more of these will trigger the Parent/Child Suspicious Process Creation alert types. Key Fields and Relevant Data Points
Link to Rule-Based Alert TypesRules Contributing to Parent/Child Suspicious Process Creation Alert Type |
password_cracking_with_hashcat |
Password Cracking With Hashcat More details
Password Cracking with HashcatA user from a Windows host executed a command-line script that launched either the hashcat.exe command or a command using known Hashcat parameters (-a -m 1000 -r). The Hashcat command is known to use a SAM file from the Windows registry along with a password list to crack passwords. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThis alert is triggered if a Windows host ( Validation / RemediationCheck the body of the Powershell script that is reported on the Windows host to identify whether the contents are actually malicious. If malicious, consider quarantining the host. Potential False PositivesThe running of any executable named |
password_spraying_attempts_using_dsacls |
Password Spraying Attempts Using Dsacls More details
Password Spraying Attempts Using DsaclsA user from a Windows host executed a command-line script to launch a command that by name and parameter list indicates an attempt to abuse dsacls.exe for password spraying. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThis alert is triggered if a Windows host ( Validation / RemediationCheck whether the usage was actually malicious. If so, consider quarantining the Windows host. Potential False PositivesThis alert could be triggered even if the use is a legitimate use of |
phishing |
Phishing URL More details
Phishing URLA connection to a site with a phishing reputation was discovered. Check with the user to determine whether their system is compromised. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf a connection from a source ( |
powershell_cnc |
PowerShell Remote Access More details
PowerShell Remote AccessA Windows host executed a PowerShell script interacting with a remote host. Investigate the script and the remote host to determine whether the script is malicious. If so, consider quarantining the host. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf a Windows host ( |
pripub_appid |
Application Usage Anomaly More details
Application Usage AnomalyAn internal application had an anomalously large number of connections to one or more external hosts in a measured interval, exceeding 99.99% of all other intervals corresponding to different applications in the past two weeks. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsEvery application's ( |
ransomware_delete_backup_catalogs |
Backup Catalogs Deleted by Ransomware More details
Backup Catalogs Deleted by RansomwareThe XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf |
ransomware_volume_shadow_copy_deletion_via_vssadminedit |
Volume Shadow Copy Deletion via VssAdmin More details
Volume Shadow Copy Deletion via VssAdminThe XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf |
ransomware_volume_shadow_copy_deletion_via_wmicredit |
Volume Shadow Copy Deletion via WMIC More details
Volume Shadow Copy Deletion via WMICThe XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf |
rdp_outbytes_anomaly |
RDP Outbytes Anomaly More details
RDP Outbytes AnomalyAn internal host transferred an anomalously high amount of data to external host(s) through RDP. This could indicate data exfiltration. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsEvery destination host's ( |
rdp_port_opening |
RDP Port Opening More details
RDP Port OpeningNetsh commands to open TCP port 3389 were detected. This could indicate Sarwent malware attempting to establish an RDP connection. Check the IP address and block if necessary. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsCommands that open TCP port 3389 are monitored, and if netsh commands are seen, an alert is triggered. A sample Interflow includes the source IP address ( |
rdp_registry_modification |
RDP Registry Modification More details
RDP Registry ModificationModifications of the property values of XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe property values of |
rdp_reverse_tunnel |
RDP Reverse Tunnel More details
RDP Reverse TunnelAn XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf an svchost hosting RDP termsvcs communicating with the loopback address is found on TCP port 3389, an alert is triggered. A sample Interflow includes the host IP address ( |
rdp_session_hijacking |
RDP Session Hijacking More details
RDP Session HijackingA suspicious RDP session using tscon.exe or MSTSC shadowing was detected. This could indicate a hijacked RDP session. Check the IP address and block if necessary. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf an RDP session redirect using tscon.exe or MSTSC is detected, an alert is triggered. A sample Interflow includes the host IP address ( |
rdp_settings_hijack |
RDP Settings Hijacking More details
RDP Settings HijackingChanges to RDP terminal services settings were detected. Check the IP address and block if necessary. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsRDP terminal service settings are monitored, and if changes are found to these settings, an alert is triggered. A sample Interflow includes the source IP address ( |
rdp_suspicious_logon |
RDP Suspicious Logon More details
RDP Suspicious LogonAn RDP logon with a local source IP address was detected. This could indicate a tunneled logon. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsRemote desktop logins are monitored, and if a local source IP address is seen, an alert is triggered. A sample Interflow includes the source IP address ( |
rdp_suspicious_logon_attempt |
RDP Suspicious Logon Attempt More details
RDP Suspicious Logon AttemptAn authenticated user who is not allowed to log on remotely attempted to connect through RDP. Check with the user. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsWindows remote desktop logins are monitored, and if a user who is not allowed to remotely log in tries to log in with RDP, an alert is triggered. A sample Interflow includes the source IP address ( |
scanner_rep |
Scanner Reputation Anomaly More details
Scanner Reputation AnomalyAn anomalously large amount of connections were detected from an IP address with a reputation of being a scanner. Cross-check with the IP/Port Scan Anomaly, and check the links and content for possible spam or phishing. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe number of connections from a source IP address ( |
smb_hack_smbexec |
SMB Specific Service Installation More details
SMB Specific Service InstallationA specific service installation used by the XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf a Windows host ( |
smb_impacket_lateralization |
SMB Impacket Lateralization More details
SMB Impacket LateralizationThe execution of XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf a Windows host ( |
smb_suspicious_copy |
SMB Suspicious Copy More details
SMB Suspicious CopyA suspicious copy command from a remote C$ or ADMIN$ share was detected. Check the source host. If malicious, consider blocking the host. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf a Windows host ( |
srcip_bad_reps |
Bad Source Reputation Anomaly More details
Bad Source Reputation AnomalyA source IP address with a bad reputation has made an anomalously large number of connections. Investigate the connections and consider blocking the source IP address. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsThe number of connections for every source IP address ( |
ssl_certificate |
Encrypted C&C More details
Encrypted C&CA connection to or from known command and control servers was detected in encrypted traffic. Consider blocking the source IP address. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf known command and control servers are detected on either side of a connection with encrypted traffic, an alert is triggered. The Interflow includes the source IP address ( |
suspicious_commandline |
Suspicious Process Creation Commandline More details
Suspicious Process Creation CommandlineThe Suspicious Process Creation Commandline rules are used to identify suspicious activity relating to command-line process creation. Any one or more of these will trigger the Suspicious Process Creation Commandline alert types. Event NameThe Key Fields and Relevant Data Points
Link to Rule-Based Alert TypesRules Contributing to Suspicious Process Creation Commandline Alert Type |
suspicious_powershell_script |
Suspicious Powershell Script More details
Suspicious Powershell ScriptThe Suspicious Powershell Script rules are used to identify suspicious activity relating to PowerShell scripts. Any one or more of these will trigger the Suspicious PowerShell Script alert types. Event NameThe Key Fields and Relevant Data Points
Link to Rule-Based Alert TypesRules Contributing to Suspicious Powershell Script Alert Type |
unencrypted_phishing_site |
Possible Unencrypted Phishing Site Visit More details
Possible Unencrypted Phishing Site VisitA possible phishing site visit to a recently registered domain was detected in unencrypted traffic. Check with the user to determine whether their system is compromised. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsIf an unencrypted connection to a recently registered site ( |
user_asset_access |
User Asset Access Anomaly More details
User Asset Access AnomalyA user who typically uses a small, consistent number of assets logged in to a new asset. Investigate the asset and user to see if this was expected. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsUsers ( The user is identified with the |
user_impossible_travel |
Impossible Travel Anomaly More details
Impossible Travel AnomalyA user logged in from locations that are geographically impossible to travel between in the time frame. Check with the user. This alert type has a relatively long detection delay of up to 40 minutes because it waits for login events from high latency data sources and is sensitive to the event order of user logins. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsLogin events (E1 and E2) are examined for a user ( E1 is the basis for the Interflow. The |
user_login_region |
User Login Location Anomaly More details
User Login Location AnomalyA user logged in from an anomalous location. Check with the user. This alert type has a relatively long detection delay of up to 40 minutes because it waits for login events from high latency data sources and is sensitive to the event order of user logins. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsSuccessful login events for certain login types ( |
user_login_time |
Login Time Anomaly More details
Login Time AnomalyA user logged in at an abnormal time. Check with the user. This alert type has a relatively long detection delay of up to 40 minutes because it waits for login events from high latency data sources and is sensitive to the event order of user logins. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsEvery user's ( |
user_uncommon_process |
User Process Usage Anomaly More details
User Process Usage AnomalyA user who typically executes a small, consistent number of processes suddenly executed a new process. Investigate the process, to see if it is benign. Check with the user to see if this process was expected. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
Use Case with Data PointsLooks for a user ( The user is identified with the |
waf_internal_attacker |
WAF Internal Attacker Anomaly More details
WAF Internal Attacker AnomalyInternal web requests from a private IP address have been blocked/alerted by the Web Application Firewall (WAF). Investigate the source requester and ensure they are not compromised. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
The above fields are standardized to support a variety of WAFs. The original fields, listed below, remain in the F5 WAF Interflow record for backward compatibility. Use Case with Data PointsIf web requests (f5.uri) from an internal IP address (srcip) to a web application (f5.web_application_name) have been blocked/alerted (f5.request_status) by the WAF, an alert is triggered. The Interflow includes the level of severity (f5.severity), the attack type (f5.attack_type), and the violation information (f5.violations), as well as signature name (f5.sig_names), staged signature name (f5.staged_sig_names), sub violation information (f5.sub_violations), and threat campaign name (f5.violation_details_xml.request-violations.violation.threat_campaign_data.threat_campaign_name), if applicable. If web requests ( Ingestion Types Supported for this Alert
|
waf_rule_violation |
WAF Rule Violation Anomaly More details
WAF Rule Violation AnomalyWeb requests have been blocked/alerted by the supported Web Application Firewalls (WAF) due to a surge in violations or violating a rule that is rarely invoked. Investigate the blocked/alerted web requests and ensure they are benign. Refer to Log Parser Ports for the most current list of WAF parsers. XDR Kill Chain
Event NameThe Key Fields and Relevant Data Points
The above fields are standardized to support a variety of WAFs. The original fields, listed below, remain in the F5 WAF Interflow record for backward compatibility. Use Case with Data PointsIf web requests ( Ingestion Types Supported for this Alert
|
windows_security_ad_sensitive_attribute_modification |
Sensitive Windows Active Directory Attribute Modification More details
Sensitive Windows Active Directory Attribute ModificationThe Sensitive Windows Active Directory Attribute Modification rules are used to identify suspicious activity with Sensitive Windows Active Directory Attribute Modification. Any one or more of these will trigger the Sensitive Windows Active Directory Attribute Modification alert type. Event NameThe Key Fields and Relevant Data Points
Link to Rule-Based Alert TypesRules Contributing to Sensitive Windows Active Directory Attribute Modification Alert Type |
windows_security_ad_suspicious_operation |
Suspicious Windows Active Directory Operation More details
Suspicious Windows Active Directory OperationThe Suspicious Windows Active Directory Operation rules are used to identify suspicious activity with Windows Active Directory Operation. Any one or more of these will trigger the Suspicious Windows Active Directory Operation alert type. Event NameThe Key Fields and Relevant Data Points
Link to Rule-Based Alert TypesRules Contributing to Suspicious Windows Active Directory Operation Alert Type |
windows_security_malicious_event |
Potentially Malicious Windows Event More details
Potentially Malicious Windows EventThe Potentially Malicious Windows Event rules are used to identify suspicious activity with Windows Events. This is a generic rule name. Any one or more of these will trigger the Potentially Malicious Windows Event alert type. Event NameThe Key Fields and Relevant Data Points
Link to Rule-Based Alert TypesRules Contributing to Potentially Malicious Event Alert Type |
windows_security_object_access_suspicious_attempt |
Suspicious Access Attempt to Windows Object More details
Suspicious Access Attempt to Windows ObjectThe Suspicious Access Attempt to Windows Object rules are used to identify suspicious activity with Access Attempt to Windows Objects. Any one or more of these will trigger the Suspicious Access Attempt to Windows Object alert type. Event NameThe Key Fields and Relevant Data Points
Link to Rule-Based Alert TypesRules Contributing to Suspicious Access Attempt to Windows Object Alert Type |
windows_security_sensitive_networkshare |
Sensitive Windows Network Share File or Folder Accessed More details
Sensitive Windows Network Share File or Folder AccessedThe Sensitive Windows Network Share File or Folder Accessed rules are used to identify suspicious activity with Windows Network Share File or Folder Access. Any one or more of these will trigger the Sensitive Windows Network Share File or Folder Accessed alert type. Event NameThe Key Fields and Relevant Data Points
Link to Rule-Based Alert TypesRules Contributing to Sensitive Windows Network Share File or Folder Accessed Alert Type |
windows_security_suspicious_activity_related_to_security_enabled_group |
Suspicious Activity Related to Security-Enabled Group More details
Suspicious Activity Related to Security-Enabled GroupThe Suspicious Activity Related to Security-Enabled Group rules are used to identify suspicious activity related to security-enabled groups. Any one or more of these will trigger the Suspicious Activity Related to Security-Enabled Group alert types. Event NameThe Key Fields and Relevant Data Points
Link to Rule-Based Alert TypesRules Contributing to Suspicious Activity Related to Security-Enabled Group Alert Type |
windows_security_suspicious_connection_process |
Suspicious Connection to Another Process More details
Suspicious Connection to Another ProcessThe Suspicious Connection to Another Process rules are used to identify suspicious activity with Suspicious Connection to Another Process. Any one or more of these will trigger the Suspicious Connection to Another Process alert types. Event NameThe Key Fields and Relevant Data Points
Link to Rule-Based Alert TypesRules Contributing to Suspicious Connection to Another Process Alert Type |
windows_security_suspicious_handle_request |
Suspicious Handle Request to Sensitive Object More details
Suspicious Handle Request to Sensitive ObjectThe Suspicious Handle Request to Sensitive Object rules are used to identify suspicious activity with Handle Requests to Sensitive Objects. Any one or more of these will trigger the Suspicious Handle Request to Sensitive Object alert type. Event NameThe Key Fields and Relevant Data Points
Link to Rule-Based Alert TypesRules Contributing to Suspicious Handle Request to Sensitive Object Alert Type |
windows_security_suspicious_logon_event |
Suspicious Windows Logon Event More details
Suspicious Windows Logon EventThe Suspicious Windows Logon Event rules are used to identify suspicious activity with Windows Logons. Any one or more of these will trigger the Suspicious Windows Logon alert types. Event NameThe Key Fields and Relevant Data Points
Link to Rule-Based Alert TypesRules Contributing to Suspicious Windows Logon Event Alert Type |
windows_security_suspicious_service_installation |
Suspicious Windows Service Installation More details
Suspicious Windows Service InstallationThe Suspicious Windows Service Installation rules are used to identify suspicious activity with service installation. Any one or more of these will trigger the Suspicious Windows Service Installation alert type. Event NameThe Key Fields and Relevant Data Points
Link to Rule-Based Alert TypesRules Contributing to Suspicious Windows Service Installation Alert Type |
windows_suspicious_process_creation |
Suspicious Windows Process Creation More details
Suspicious Windows Process CreationThe Suspicious Windows Process Creation rules are used to identify suspicious activity associated with process creation. Any one or more of these will trigger the Suspicious Process Creation alert type. Event NameThe Key Fields and Relevant Data Points
Link to Rule-Based Alert TypesRules Contributing to Windows Suspicious Process Creation Alert Type |