Alert Type Model Summary

Use this topic for a high level summary of each alert type, whether it is based on Analytics or Machine Learning (and what type), and the training time required for each. Optionally, expand any alert name for more specifics on that alert type.

Machine Learning (ML): Stellar Cyber's powerful artificial intelligence system uses a variety of models to analyze data and may aggregate many alert logs to generate one Stellar Cyber alert.

Unsupervised ML – Unsupervised models power the alert types that look for dissimilarities from normal patterns. These models learn the normal pattern within a certain customer environment, such as what application usage is normal for which users. Then, after that initial learning period, the alert types trigger when activity appears significantly different from the observed normal pattern. Similarly, a user observed using an anomalous application would result in a trigger of this alert type. Unsupervised Machine Learning is applicable when there is no clear identifier for what "bad" looks like.
Supervised ML – Supervised models power the alert types that look for known bad patterns based on training performed on large scale datasets. An example of a bad pattern here is a recently registered domain used for data exfiltration. There are enough real world examples of this type of activity that a model can be constructed to identify it with a certain level of confidence. Supervised machine learning models require no customer training period because they are already "trained" and ready to be used. In summary, Supervised Machine Learning is used when there are clear identifiers for what "bad" looks like, but it is far too computationally complex for a simple "rule" to be used.

For more details, refer to the overview of Machine Learning and the details for each alert type that may be produced in the Machine Learning pathway.

Analytics – These prediction results are based on security rules. These alert types leverage simple arithmetic or logic conditions instead of machine learning. For example, a Bad Reputation alert may trigger if a source IP has a reputation of "Bad Reputation". Another example could be looking for suspicious RDP activity that matches a certain process name. You can also use Stellar Cyber's Statistical Analysis engine to create your own Automated Threat Hunting rules..

Training Time

Certain ML models learn the data distribution in your network automatically but require two weeks of observing data to create an approximation of the real distribution. After that baseline, the model is automatically updated every 24 hours. Use the table below as a guide for which need to run in your environment for two weeks to begin reporting.

XDR Display Name

Model Type

Machine Learning Model Requires Two Weeks

Unsupervised

Account MFA Login Failure Anomaly

An anomalously large number of Multi-Factor Authentication (MFA) user login failures was observed for an account. Check with the user.

This alert type has two alert subtypes:

Machine Learning Anomaly Detection
Rule Based Detection

Alert Subtype: Machine Learning Anomaly Detection

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [External] Credential Access (TA0006 )
Technique: Brute Force (T1110 )
Tags: [External]

Event Name

The xdr_event.name for this alert type in the Interflow data is cloud_account_login_failure_okta.

Key Fields and Relevant Data Points

srcip_usersid — cloud account user ID
srcip_username — cloud account user name
event_summary.total_failed — number of failed logins in the period
event_summary.total_successful — number of successful logins in the period
event_summary.total_fail_ratio — percent of failed logins in the period, which is: event_summary.total_failed / (event_summary.total_failed + event_summary.total_successful)
accumulated_anomalous_failures — score value of the model indicating the degree of abnormal activity
srcip_host — host name of corresponding source IP address
login_type — type of login
srcip_reputation — source reputation

Use Case with Data Points

Multi-Factor Authentication login failures and successes are calculated periodically for every account (srcip_usersid). If the number of failures is significantly larger than the number of successes, an alert is triggered. A sample Interflow includes the login type (login_type), source host (srcip_host), and source reputation (srcip_reputation).

Alert Subtype: Rule Based Detection

The Suspicious AWS Login Failure rules are used to identify suspicious AWS account login failures. Any one or more of these will trigger the AWS Cloud Account Login Failure alert type.

Key Fields and Relevant Data Points

eventSource — source of event
eventName — name of event
eventType — type of event
userIdentity.accountId — key ID for the account involved in the event
userIdentity.userName — user name of the account involved in the event
userIdentity.type — type of account involved in the event
stellar.rule_id — Stellar Cyber rule ID

Link to Rule-Based Alert Types

Rules Contributing to Suspicious AWS Login Failure

Unsupervised

Application Usage Anomaly

An internal application had an anomalously large number of connections to one or more external hosts in a measured interval, exceeding 99.99% of all other intervals corresponding to different applications in the past two weeks.

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [External] XDR NBA (XTA0002)
Technique: XDR App Anomaly (XT2003)
Tags: [External; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is pripub_appid.

Key Fields and Relevant Data Points

appid — application ID
appid_name — application name
actual — actual number of connections in the period
stellar.threshold — threshold number of connections per interval below which 99.99% of all other intervals, corresponding to different applications in the past two weeks, fall
srcip_host — host name of a sample source IP address
srcip_geo.countryName — source country
dstip_host — host name of a sample destination IP address

Use Case with Data Points

Every application's (appid) number of connections is calculated periodically. If an application’s connections (actual) are larger than the threshold (stellar.threshold) below which 99.99% of all other intervals corresponding to different applications in the past two weeks fall, an alert is triggered. The Interflow includes a sample source host (srcip_host), the source country (srcip_geo.countryName), and a sample destination host (dstip_host). If there are multiple source or destination hosts, view the list in the Original Records.

Unsupervised

AWS AMI Made Public

An AWS AMI was made public. Check with the user to make sure this was intentional.

XDR Kill Chain

Kill Chain Stage: Propagation
Tactic: Privilege Escalation (TA0004 )
Technique: Valid Accounts (T1078 )
Tags: []

XDR Event Name

The xdr_event.name for this alert type in the Interflow data is aws_ami_public.

Key Fields and Relevant Data Points

userIdentity.accountId — key ID for the account
userIdentity.userName — AWS account user name
userIdentity.type — AWS account type
eventName — AWS event name
eventSource — AWS event source
eventType — AWS event type

Use Case with Data Points

For each AWS account (userIdentity.accountId), activity to make an AMI public is monitored. If an AMI is made public, an alert is triggered. The Interflow includes the account ID (userIdentity.accountId), user name (userIdentity.userName), account type (userIdentity.type), AWS event name (eventName), AWS event source (eventSource), and AWS event type (eventType).

Analytics

AWS Logging Stopped

AWS CloudTrail logging was stopped. Check with the user to make sure this was intentional.

XDR Kill Chain

Kill Chain Stage: Persistent Foothold
Tactic: Defense Evasion (TA0005 )
Technique: Impair Defenses (T1562 )
Tags: []

Event Name

The xdr_event.name for this alert type in the Interflow data is aws_stoplogging.

Key Fields and Relevant Data Points

userIdentity.accountId — key ID for the account
userIdentity.userName — AWS account user name
userIdentity.type — AWS account type
eventName — AWS event name
eventSource — AWS event source
eventType — AWS event type

Use Case with Data Points

For each AWS account (userIdentity.accountId), log disabling is monitored. Logging is enabled by default, so if logging is disabled, an alert is triggered. The Interflow includes the account ID (userIdentity.accountId), AWS account user name (userIdentity.userName), AWS account type (userIdentity.type), AWS event name (eventName), AWS event source (eventSource), and AWS event type (eventType).

Analytics

AWS S3 Ransomware

Possible AWS S3 ransomware was detected. Check with the user.

XDR Kill Chain

Kill Chain Stage: Exfiltration & Impact
Tactic: Impact (TA0040 )
Technique: Data Encrypted for Impact (T1486 )
Tags: [Malware; Ransomware]

Event Name

The xdr_event.name for this alert type in the Interflow data is aws_s3_ransomware.

Key Fields and Relevant Data Points

userIdentity.accountId — key ID for the account
userIdentity.userName — AWS account user name
userIdentity.type — AWS account type
eventName — AWS event name
eventSource — AWS event source
eventType — AWS event type

Use Case with Data Points

For each AWS account user name (userIdentity.userName), suspicious S3 ransomware is monitored. If ransomware is detected, an alert is triggered. The Interflow includes the account ID (userIdentity.accountId), AWS account user name (userIdentity.userName), AWS account type (userIdentity.type), AWS event name (eventName), AWS event source (eventSource), and AWS event type (eventType).

Analytics

Azure AD Apps Modified To Allow Multi-Tenant Access

Azure AD detected an application being modified to allow multi-tenant access. Check with the organization to be sure this was expected.

XDR Kill Chain

Kill Chain Stage: Persistent Foothold
Tactic: Persistence (TA0003 )
Technique: Account Manipulation (T1098 )
Tags: []

Event Name

The xdr_event.name for this alert type in the Interflow data is azure_ad_add_app_multitenant.

Key Fields and Relevant Data Points

srcip_usersid — user ID that modified the property change
activityDisplayName — description of the action
targetResources.modifiedProperties.displayName — properties that were changed

Use Case with Data Points

If Azure AD detects any user (srcip_usersid) changing an application to allow multi-tenant access, an alert is triggered. A sample Interflow includes the user ID (srcip_usersid), activity name (activityDisplayName), and name of the changed property (targetResources.modifiedProperties.displayName).

Analytics

Azure AD Custom Domains Changed

Azure AD detected a custom domain being changed. Check with the organization to be sure this was expected.

XDR Kill Chain

Kill Chain Stage: Persistent Foothold
Tactic: Defense Evasion (TA0005 )
Technique: Domain Policy Modification (T1484 )
Tags: []

Event Name

The xdr_event.name for this alert type in the Interflow data is azure_ad_change_domain.

Key Fields and Relevant Data Points

srcip_usersid — user account that made the domain change
activityDisplayName — activity display name
activity_name — action description

Use Case with Data Points

If Azure AD detects any user (srcip_usersid) changing a custom domain, an alert is triggered. A sample Interflow includes the user ID (srcip_usersid) and activity name (activity_name).

Analytics

Backup Catalogs Deleted by Ransomware

The wbadmin.exe utility was used to delete the backup catalog. Ransomware and other malware do this to prevent system recovery. Check with the user.

XDR Kill Chain

Kill Chain Stage: Persistent Foothold
Tactic: Defense Evasion (TA0005 )
Technique: Indicator Removal on Host (T1070 )
Tags: [Malware; Ransomware]

Event Name

The xdr_event.name for this alert type in the Interflow data is ransomware_delete_backup_catalogs.

Key Fields and Relevant Data Points

hostip — IP address of the host executing the process
process_name — name of the process
event_data.CommandLine — command that was executed

Use Case with Data Points

If wbadmin.exe is used to delete the backup catalog, an alert is triggered. The Interflow includes the host IP address (hostip), process name (process_name), and command line (event_data.CommandLine).

Analytics

Bad Destination Reputation Anomaly

A destination IP address with a bad reputation has received an anomalously large number of connections. Investigate the connections and consider blocking the destination IP address.

XDR Kill Chain

Kill Chain Stage: Persistent Foothold
Tactic: XDR Intel (XTA0005)
Technique: XDR Bad Reputation (XT2010)
Tags: [Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is dstip_bad_reps.

Key Fields and Relevant Data Points

dstip — destination IP address
dstip_host — destination host name
dstip_reputation — destination reputation
actual — actual number of connections to the destination IP address in the period
typical — typical number of connections to the destination IP address
srcip_host — source host name
srcip_reputation — source reputation
appid_name — application name

Use Case with Data Points

The number of connections for every destination IP address (dstip) with a bad reputation (dstip_reputation) is calculated periodically. If a destination IP address's number of connections (actual) is much larger than the typical historical number (typical), an alert is triggered. The Interflow includes the source IP address making the connection (srcip_host), the application (appid_name) used, and the reputation of the source host (srcip_reputation).

Unsupervised

Bad Reputation Login

A successful login was detected from an IP address with a history of malicious activity. Check with the user.

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [External] XDR NBA (XTA0002)
Technique: XDR Bad Reputation (XT2010)
Tags: [External]

Event Name

The xdr_event.name for this alert type in the Interflow data is bad_reputation_login.

Key Fields and Relevant Data Points

srcip — source IP address
srcip_host — source host name
srcip_reputation — source reputation
source_geo.countryName — source country
dstip_host — destination host name
login_type — type of login
username — user name

Use Case with Data Points

The login records are checked for every source IP address (srcip). If a source IP address has successful login records and its reputation (srcip_reputation) is bad (except brute-forcer and scanner), an alert is triggered. A sample Interflow includes source IP address (srcip), source host (srcip_host), source reputation (srcip_reputation), source country (srcip_geo.countryName), login type (login_type), and user name (username).

Analytics

Bad Source Reputation Anomaly

A source IP address with a bad reputation has made an anomalously large number of connections. Investigate the connections and consider blocking the source IP address.

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [External] XDR NBA (XTA0002)
Technique: XDR Bad Reputation (XT2010)
Tags: [External; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is srcip_bad_reps.

Key Fields and Relevant Data Points

srcip — source IP address
srcip_host — host name of corresponding source IP address
srcip_reputation — source reputation
actual — actual number of connections in the period
typical — typical number of connections from the source IP address
dstip_host — host name of corresponding destination IP address
dstip_reputation — destination reputation
appid_name — application name

Use Case with Data Points

The number of connections for every source IP address (srcip) with a bad reputation (srcip_reputation) is calculated periodically. If a source IP address's number of connections (actual) is much larger than the typical historical number (typical), an alert is triggered. The Interflow includes the application (appid_name) used and the reputation of the destination host (dstip_reputation).

Unsupervised

Carbon Black: XDR Anomaly

On a specific device, an anomalously large number of VMware Carbon Black endpoint log records or a rarely seen type of record has been observed compared to the typical number in a measured interval.

XDR Kill Chain

Kill Chain Stage: Persistent Foothold
Tactic: XDR EBA (XTA0001)
Technique: XDR Anomaly (XT1000)
Tags: []

Event Name

The xdr_event.name for this alert type in the Interflow data is carbonblack_edr_anomaly.

Key Fields and Relevant Data Points

process.command_id — command ID of the process
hostip — device internal IP address
host.external_ip — device external IP address
actual — actual volume of log records in the period
typical — typical difference in volume of log records between this period and the previous period

Use Case with Data Points

The number of occurrences of Carbon Black endpoint (cloud) log, based on the “UNKNOWN“ threat category (event.type), is tabulated periodically. If this category occurs (actual) much more often compared to its history (typical) or a rarely seen type of record is observed, an alert is triggered. The Interflow includes information such as the file name (file.name), process (process.name), and description (xdr_event.description).

Unsupervised

Command & Control Reputation Anomaly

An anomalously large number of connections were made to known command and control servers. Investigate the connections and source hosts. If malicious, block the IP addresses of the command and control servers.

XDR Kill Chain

Kill Chain Stage: Persistent Foothold
Tactic: XDR Intel (XTA0005)
Technique: XDR Command and Control Reputation (XT5001)
Tags: [Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is cnc_reputation.

Key Fields and Relevant Data Points

dstip — destination IP address
dstip_host — destination host name
dstip_reputation — destination reputation
actual — actual number of connections in the period
typical — typical number of connections to the destination IP with a C&C reputation
srcip_host — host name of corresponding source IP address
srcip_reputation — source reputation
appid_name — application name

Use Case with Data Points

The number of connections for every destination IP (dstip) with a command and control reputation (dstip_reputation) is calculated periodically. If a destination IP has a much higher number of connections (actual) than its history (typical) in any period, an alert is triggered. The Interflow includes the application used in the connection (appid_name), the source host (srcip_host), and the source reputation (srcip_reputation).

Unsupervised

Command Anomaly

A command has been executed an anomalously large number of times compared to its typical executions or those of other commands. Investigate the command and the user to determine if this is expected.

XDR Kill Chain

Kill Chain Stage: Persistent Foothold
Tactic: Execution (TA0002 )
Technique: Command and Scripting Interpreter (T1059 )
Tags: []

Event Name

The xdr_event.name for this alert type in the Interflow data is command_anomaly.

Key Fields and Relevant Data Points

command — command executed
actual — actual number of executions in the period
typical — typical number of executions in the period
cwd — current working directory from which the command executed
hostip — host running the agent sensor
srcip — source IP address from which the command was run
username — user name who ran the command

Use Case with Data Points

The number of times a command (command) has been executed is calculated periodically. If the volume (actual) is much larger than the typical volume (typical) of the command or other commands in any period, an alert is triggered. The Interflow includes the directory from which the command was executed (cwd), the host and source IP addresses (hostip and srcip) from which the command was executed, and the name of the user who ran the command (username).

Unsupervised

Cryptojacking

An unauthorized coin miner used a computer to mine cryptocurrency. Consider blocking the source IP address.

XDR Kill Chain

Kill Chain Stage: Exfiltration & Impact
Tactic: Impact (TA0040 )
Technique: Resource Hijacking (T1496 )
Tags: [Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is cryptojacking.

Key Fields and Relevant Data Points

ids.signature — IDS signature
srcip — source IP address of the cryptojacking action
dstip — destination IP address of the cryptojacking action
srcip_reputation — source reputation
srcip_host — source host name
dstip_reputation — destination reputation
dstip_host — destination host name

Use Case with Data Points

If an unauthorized coin miner is detected by IDS, an alert is triggered. A sample Interflow includes the IDS signature (ids.signature), source IP address (srcip), source reputation (srcip_reputation), source host (srcip_host), destination IP address (dstip), destination reputation (dstip_reputation), and destination host (dstip_host).

Analytics

CylanceOPTICS: XDR Anomaly

On a specific device, a rarely seen or an anomalously large number of CylanceOPTICS endpoint log records has been observed, compared to the typical number in a measured interval or has been observed after several days of silence.

XDR Kill Chain

Kill Chain Stage: Persistent Foothold
Tactic: XDR EBA (XTA0001)
Technique: XDR Anomaly (XT1000)
Tags: []

Event Name

The xdr_event.name for this alert type in the Interflow data is cylance_edr_anomaly.

Key Fields and Relevant Data Points

event.description — description of the detection rule
host.name — device name
actual — actual volume of log records in the period
typical — typical difference in volume of log records between this period and the previous period

Use Case with Data Points

The number of occurrences of CylanceOPTICS log records (event.provider) is calculated periodically. If this category occurs (actual) much more often compared to its history (typical) or a rarely seen type of event is generated, an alert is triggered. The Interflow includes information such as the process name (process.name), parent process name (process.parent.name), and description (event.description).

Unsupervised

Data Ingestion Volume Anomaly

A sensor is sending an anomalously high or low volume of data, compared to its typical volume. Check the sensor. A low volume could indicate a sensor failure or other problems. For a high volume, determine the cause of the increase.

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: XDR SBA (XTA0003)
Technique: XDR Bytes Anomaly (XT3001)
Tags: [Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is ade_outbytes_anomaly.

Key Fields and Relevant Data Points

engid — sensor ID
engid_name — sensor name
actual — actual volume of data in the period
typical — typical difference in data volume between this period and the previous period

Use Case with Data Points

The data ingestion volume of every data sensor with sensor id (engid) and sensor name (engid_name) is calculated periodically. If one of the following conditions is met, the anomaly is triggered:

A moving window is used to record data ingestion volume. If the time window can be divided into two sub windows and the metric values of these two sub windows show large deviation
The ingestion volume is anomalously high compared to its own history
The ingestion volume is anomalously low compared to its history and it keeps being low for a relatively longer period

A sample Interflow includes the sensor ID (engid) and sensor name (engid_name).

Unsupervised

DGA

A host is using a potential Domain Generation Algorithm (DGA). If the target domain is a malicious domain, the host might be compromised. Investigate the DGA domains and the host.

XDR Kill Chain

Kill Chain Stage: Persistent Foothold
Tactic: Command and Control (TA0011 )
Technique: Dynamic Resolution (T1568 )
Tags: [Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is dga_resolvable.

Key Fields and Relevant Data Points

srcip — source IP address of the host that sends the DGA queries
metadata.request.effective_tld — effective top-level domain of the DNS query
metadata.response.resolved_ips — IP addresses resolved from the DNS query
is_dga — flag marking whether or not the DNS query is a DGA query
actual — number of DGA domains the host has queried

Use Case with Data Points

Whenever a host (srcip) sends a DNS query (appid_name: dns) and the DNS server returns a non-existent domain (NXDOMAIN) response (metadata.response.reply_code), the NX domain query counter for the host is increased. We reset the counter if no NX domain queries are observed for a period of time. When the counter reaches a certain threshold, the host is monitored. When monitored, we run the FQDNs of all DNS queries (metadata.response.query) sent by this host through domain generation analytics to determine whether the domain's entropy indicates a DGA anomaly. If so, we mark the DNS record (is_dga). If the DNS query gets a response with valid resolved IP addresses (metadata.response.resolved_ips), we call it a resolvable query, otherwise we call it a non-resolvable query.

If a monitored host (srcip) sends a resolvable DGA query (is_dga: yes_resolvable), we check the effective top-level domain (metadata.response.effective_tld). If the same host (srcip) previously sent non-resolvable DGA queries (is_dga: yes) with the same effective top-level domain (metadata.response.effective_tld), the host is considered to have a high risk of being compromised and performing C&C with DGA. The Interflow includes the source host (srcip), DNS query (metadata.response.query), query effective top-level domain (metadata.response.effective_tld), and DGA flag (is_dga).

Supervised

DHCP Server Anomaly

A new DHCP server appeared in the network. This could be a hacker attempting to steer traffic. Investigate and consider telling employees to avoid this server.

XDR Kill Chain

Kill Chain Stage: Exploration
Tactic: [Internal] XDR NBA (XTA0002)
Technique: XDR Server Anomaly (XT2007)
Tags: [Internal]

Event Name

The xdr_event.name for this alert type in the Interflow data is dhcp_anomaly.

Key Fields and Relevant Data Points

metadata.response.server_ip — IP address of the anomalous DHCP server
srcip_host — host name that visited the DHCP server
srcip_geo.countryName — country name of the source that visited the DHCP server

Use Case with Data Points

If a DHCP server that has never been seen before appears in the network, an alert is triggered. The Interflow includes the DHCP server IP address (metadata.response.server_ip), source host (srcip_host), and source country (srcip_geo.countryName).

Analytics

DNS Tunneling Anomaly

An anomalously large number of connections tunneling high-entropy traffic through DNS were made. This can indicate data exfiltration. Investigate the tunnel and source host. If malicious, block the source host.

XDR Kill Chain

Kill Chain Stage: Exfiltration & Impact
Tactic: Exfiltration (TA0010 )
Technique: Exfiltration Over Alternative Protocol (T1048 )
Tags: []

Event Name

The xdr_event.name for this alert type in the Interflow data is dns_tunnel.

Key Fields and Relevant Data Points

srcip_host — host name of corresponding source IP address
dstip_host — host name of corresponding destination IP address
metadata.request.effective_tld — effective top-level domain, such as yahoo.com
metadata.request.query — DNS query
actual — actual number of bytes transmitted through the tunnel in the period
typical — typical number of bytes transmitted through a tunnel in the period
total_entropy — total entropy (information density) sent by the DNS tunnel
query_count — number of queries sent by the DNS tunnel

Use Case with Data Points

The DNS queries (metadata.requests.query) for each DNS tunnel (comprising the source host (srcip_host), destination host (dstip), and top-level domain (effective_tld)) are analyzed periodically. If a DNS tunnel has sent anomalously more entropy (total_entropy) and bytes (actual) than is normal (typical) in any period, an alert is triggered. The number of queries sent (query_count) is also considered.

Supervised

Emerging Threat

Stellar Cyber detected one or more emerging threats in traffic. Investigate the IP address and consider blocking.

XDR Kill Chain

Kill Chain Stage: Persistent Foothold
Tactic: XDR Intel (XTA0005)
Technique: XDR Emerging Threat (XT5003)
Tags: []

Event Name

The xdr_event.name for this alert type in the Interflow data is emerging_threat.

Key Fields and Relevant Data Points

srcip — source IP address marked as an emerging threat
dstip — destination IP address marked as an emerging threat
url_list — URL marked as an emerging threat
domain_list — domain marked as an emerging threat

Use Case with Data Points

Stellar Cyber monitors traffic for emerging threats. An alert is triggered if emerging threats are observed in any of the following:

Source IP address (srcip)
Destination IP address (dstip)
URL (url_list)
Domain (domain_list)

Note that only one of these is needed to trigger the alert. So, although the Interflow includes the source IP address (srcip), destination IP address (dstip), URL (url_list), and domain (domain_list), not all the values may be populated, depending on the nature of the observed threat.

Analytics

Encoded PowerShell

A Windows host executed an encoded PowerShell script. Investigate the script contents to see if it is malicious. If so, consider quarantining the host.

XDR Kill Chain

Kill Chain Stage: Persistent Foothold
Tactic: Execution (TA0002 )
Technique: Command and Scripting Interpreter (T1059 )
Tags: []

Event Name

The xdr_event.name for this alert type in the Interflow data is encoded_powershell.

Key Fields and Relevant Data Points

srcip — source IP address
event_data.ContextInfo — PowerShell script context
event_data.Payload — PowerShell script payload

Use Case with Data Points

If a Windows host (srcip) executes a PowerShell script whose context (event_data.ContextInfo) includes flags that indicate encoding or obfuscation of the script, an alert is triggered. The Interflow includes the IP address of the Windows host (srcip), the script context (event_data.ContextInfo), and script payload (event_data.Payload).

Analytics

Encrypted C&C

A connection to or from known command and control servers was detected in encrypted traffic. Consider blocking the source IP address.

XDR Kill Chain

Kill Chain Stage: Persistent Foothold
Tactic: Command and Control (TA0011 )
Technique: Encrypted Channel (T1573 )
Tags: [Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is ssl_certificate.

Key Fields and Relevant Data Points

srcip — source IP address of the connection
dstip — destination IP address of the connection
srcip_host — host name of corresponding source IP address
srcip_geo.countryName — source country of the connection
dstip_host — host name of corresponding destination IP address
dstip_geo.countryName — destination country of the connection

Use Case with Data Points

If known command and control servers are detected on either side of a connection with encrypted traffic, an alert is triggered. The Interflow includes the source IP address (srcip), source host (srcip_host), source country (srcip_geo.countryName), destination IP address (dstip), destination host (dstip_host), and destination country (dstip_geo.countryName).

Analytics

Exploited C&C Connection

An exploited host with vulnerabilities initiated a connection to the exploit attacker, which could indicate the host being compromised and performing C&C activities. See if the exploit was successful. Check the source host, and consider blocking.

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [External] XDR NBA (XTA0002)
Technique: XDR Command and Control Connection Exploitation (XT2014)
Tags: [Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is exploit_attempt_correlation.

Key Fields and Relevant Data Points

tenant_id — tenant ID
exploit_id — ID of the original exploit event
seen_traffic_id — ID of the original Interflow traffic record
srcip (of exploit event) — IP address of the attacker (correlation_info.srcip)
dstip (of exploit event) — IP address of the target host (correlation_info.dstip)
srcip (of traffic record) — IP address of the target host (correlation_info.srcip)
dstip (of traffic record) — IP address of the attacker (correlation_info.dstip)

Use Case with Data Points

Two events are involved in this alert type. In the first event, an attacker (srcip) with the IP address A is performing an exploit against a target (dstip) with the IP address B. If, following that event, an Interflow traffic record is observed where the target host (srcip) with IP address B initiates a network connection to the attacker (dstip) whose IP address is A, an alert is triggered.

When an alert is triggered a new correlation event is generated. The Interflow of the correlation event includes the reference ID of the exploit event (exploit_id), the reference ID of the traffic record (seen_traffic_id), the IP address of the attacker (correlation_info.srcip of the exploit event or correlation_info.dstip of the traffic record), the IP address of the victim (correlation_info.dstip of the exploit event or correlation_info.srcip of the traffic record).

Analytics

External Account Login Failure Anomaly

An anomalously large number of user login failures was observed for an account. Check with the user.

This alert type has a relatively long detection delay of up to 40 minutes because it waits for login events from high latency data sources and is sensitive to the event order of user logins.

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [External] Credential Access (TA0006 )
Technique: Brute Force (T1110 )
Tags: [External]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_cloud_account_login_failure.

Key Fields and Relevant Data Points

srcip_usersid — cloud account user ID
scrip_username — cloud account user name
event_summary.total_failed — number of failed logins in the period
event_summary.total_successful — number of successful logins in the period
event_summary.total_fail_ratio — percent of failed logins in the period, which is: event_summary.total_failed / (event_summary.total_failed + event_summary.total_successful)
accumulated_anomalous_failures — score value of the model indicating the degree of abnormal activity
srcip_host — host name of corresponding source IP address
login_type — type of login
srcip_reputation — source reputation

Use Case with Data Points

Login failures and successes are calculated periodically for every account (srcip_usersid). If the number of failures is significantly larger than the number of successes, an alert is triggered. A sample Interflow includes the login type (login_type), source host (srcip_host), and source reputation (srcip_reputation).

Unsupervised

External Brute-Forced Successful User Login

A successful login was observed from an IP address that had previously seen a large number of login failures, or a successful login to a user account was observed from another IP address or IP addresses that had previously seen a large number of login failures to that account. Check with the user.

This alert type has two subtypes:

Source IP-Based
User ID-Based

This alert type has a relatively long detection delay of up to 40 minutes because it waits for login events from high latency data sources and is sensitive to the event order of user logins.

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [External] Credential Access (TA0006 )
Technique: Brute Force (T1110 )
Tags: [External]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_user_success_brute_forcer.

Alert Subtype: Source IP-Based

The source IP-based alert subtype has the same XDR Kill Chain and Event Name as the user ID-based alert subtype, but differs in the Key Fields and Relevant Data Points and Use Case with Data Points.

Key Fields and Relevant Data Points

srcip — source IP address
srcip_usersid — Windows SID associated with the source IP address
srcip_host — source host name
srcip_reputation — source reputation
source_geo.countryName — source country
dstip_host — destination host name
login_type — type of login
username — user name
related_alert._id — link to the related External User Login Failure Anomaly

Use Case with Data Points

The login records are checked for every external source IP address (srcip). An alert is triggered if that IP address:

Has so many failed login attempts that it triggered the External User Login Failure Anomaly, and
Had a successful login

A sample Interflow includes the source IP address (srcip), login type (login_type), source host (srcip_host), source reputation (srcip_reputation), source country (srcip_geo.countryName), and user name (username).

Alert Subtype: User ID-Based

The user ID-based alert subtype has the same XDR Kill Chain and Event Name as the source IP-based alert subtype, but differs in the Key Fields and Relevant Data Points and Use Case with Data Points.

Key Fields and Relevant Data Points

srcip_usersid — Windows SID associated with the source IP address
srcip — source IP address
srcip_host — source host name
srcip_reputation — source reputation
source_geo.countryName — source country
dstip_host — destination host name
login_type — type of login
username — user name
related_alert._id — link to the related External Account Login Failure Anomaly

Use Case with Data Points

The login records to a user account (srcip_usersid) are checked for every external source IP address (srcip). An alert is triggered if that user account:

Has so many failed login attempts that it triggered the External Account Login Failure Anomaly, and
Had a successful login

Unsupervised+Analytics

External Credential Stuffing

An anomalously large amount of username/password testing was detected on AWS, Okta, or Windows. Check the activity after successful logins, and consider blocking the source IP addresses.

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [External] Credential Access (TA0006 )
Technique: Brute Force (T1110 )
Tags: [External]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_credential_stuffing.

Key Fields and Relevant Data Points

msg_class — name of the service: cloudtrail for AWS, okta for Okta, Microsoft-Windows-Security-Auditing for Windows
service_id — specific account ID of a service
login_failure_rate — rate of login failures per minute in the period
unknown_users_rate — rate of unknown user names per minute in the period
unknown_users_to_login_failures — ratio of unknown user names to login failures in the period
suspicious_ips — suspicious source IP addresses (up to 100)
possible_breached_ips — list of malicious IPs that may have successful breach activities

Use Case with Data Points

External credential stuffing is the constant testing of username/password combinations on the AWS, Okta, or Windows authentication functions. Login activity is monitored and if the number of failed logins is larger than normal for that service, an alert is triggered. The Interflow includes the service (msg_class), tenant's account ID on that service (service_id), suspicious source IP address (suspicious_ips), login failure rate (login_failure_rate), unknown user rate (unknown_users_rate), the ratio of unknown users to login failures (unknown_users_to_login_failures), and a list of source IP addresses that might have suspicious activities and should be investigated (possible_breached_ips).

Unsupervised

External Exploited Vulnerability

A host with a vulnerability discovered by a security scanning tool was exploited by an attack on that same vulnerability, indicating a high probability of success. Check the target to see if it was compromised.

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [External] XDR NBA (XTA0002)
Technique: XDR Exploited Vulnerability (XT2015)
Tags: [External; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_vuln_exploit_correlation.

Key Fields and Relevant Data Points

tenantid — tenant ID
vulnerability_id — ID of the original security scan result
ids_event_id — ID of the original IDS exploit event
srcip (of security scan result) — IP address of the target correlation_info.srcip
dstip (of IDS event) — IP address of the target (correlation_info.dstip)
srcip (of IDS event) — IP address of the attacker (correlation_info.srcip)
correlation_info.vulnerability.cve — CVE associated with the reported vulnerability
correlation_info.ids.cve — CVE the attacker used to exploit the host

Use Case with Data Points

An attacker (srcip) with IP address A is performing an exploit against a target (dstip) with internal IP address B using a vulnerability (ids.cve) with CVE x. If any security scanning tool found the target (srcip) with IP address B to have a vulnerability (vulnerability.cve) with CVE x, an alert is triggered.

When an alert is triggered, a new correlation event is generated. The Interflow of the correlation event includes the ID of the IDS exploit event (ids_event_id), the ID of the security scan record (vulnerability_id), the IP address of the attacker (correlation_info.srcip of the IDS event), the IP address of the victim (correlation_info.dstip of the IDS event or correlation_info.srcip of the security scan record), and the CVE that was used in the exploit (correlation_info.vulnerability.cve and correlation_info.ids.cve).

Analytics

External Firewall Denial Anomaly

A source host had actions blocked by a firewall too many times. Investigate the firewall rules that were violated. If suspicious, block the source IP address.

XDR Kill Chain

Kill Chain Stage: Initial Attempts

Tactic: [External] XDR NBA (XTA0002)

Technique: XDR Firewall Anomaly (XT2002)

Tags: [External; Network Traffic Analysis; Firewall Anomalies]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_fw_action.

Key Fields and Relevant Data Points

srcip_host — source host IP address
srcip — source host IP address
actual — actual number of firewall denials in the period
typical — typical number of firewall denials in the period
dstip_host — host name of corresponding destination IP address
dev_name — name of the firewall
engid_name — name of the sensor
src_host — name of the host for the source IP address

Use Case with Data Points

The number of firewall denials for every source IP address (srcip) is calculated periodically. If a source IP address’s number of firewall denials (actual) is much larger than the historical count (typical) of all IP addresses, an alert is triggered. The Interflow includes the name of the firewall (dev_name), the name of the sensor (engid_name), and the destination host (dstip_host).

Unsupervised

External Firewall Policy Anomaly

A rarely triggered firewall policy has been violated. Investigate that policy and track down the violation.

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [External] XDR NBA (XTA0002)
Technique: XDR Firewall Anomaly (XT2002)
Tags: [External; Network Traffic Analysis;Firewall Anomalies]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_fw_policy_id.

Key Fields and Relevant Data Points

fw_policy_id — ID of the violated firewall policy
days_silent — number of days since this firewall policy was last seen
srcip_host — host name of corresponding source IP address
dstip_host — host name of corresponding destination IP address
dev_name — device name
dev_type — device type
engid_name — sensor name

Use Case with Data Points

A firewall policy violation (fw_policy_id), which is raised by a device (dev_name and dev_type) and captured by a sensor (engid_name), shows never seen or very rare (days_silent) traffic between a host (srcip_host) and another host (dstip_host). This violation will trigger an alert.

Unsupervised

External Handshake Failure

There were too many handshake failures between two hosts, which might indicate port scanning. Check the source host to see if this was expected and, if not, consider blocking the host.

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [External] Reconnaissance (TA0043 )
Technique: Active Scanning (T1595 )
Tags: [External; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_handshake_failure.

Key Fields and Relevant Data Points

srcip — source IP address of the host with the handshake failures
srcip_host — source host name
dstip — destination IP address of the host with the handshake failures
dstip_host — destination host name
timestamp — when the scan happened

Use Case with Data Points

If a host (srcip) scans across many ports on another host (dstip), an alert is triggered. The Interflow includes the IP address of the potential attacker (srcip), the IP address of the victim (dstip), a special message flag (msgtyp), and when the scan happened (timestamp).

Analytics

External IDS Signature Spike

A source IP address transmitted an anomalous number of different IDS signatures. Typically, this indicates host penetration or vulnerability scanning.

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: Initial Access (TA0001 )
Technique: Exploit Public-Facing Application (T1190 )
Tags: [External; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_ids_signature_spike.

Key Fields and Relevant Data Points

srcip — source IP address
ids_signatures_summarize — summarized IDS signatures of the exploit
srcip_host — source host name
actual — actual number of unique IDS signatures in the period, with critical IDS signatures counted as 2, high counted as 1, low counted as 0.5, and others counted as 1
typical — typical number of unique IDS signatures from the source IP address, with critical IDS signatures counted as 2, high counted as 1, low counted as 0.5, and others counted as 1

Use Case with Data Points

The number of unique IDS signatures (ids.signature), weighted by their severity (ids.severity), are calculated periodically. If many different exploits with unique IDS signatures are observed, an alert is triggered. The Interflow includes a source (srcip), timestamp, an accumulated severity of IDS signatures (actual), the usual accumulated severity of IDS signatures (typical), and a sampling of the IDS signatures used in the attack (ids_signatures_summarize).

Unsupervised

External IP / Port Scan Anomaly

A host has either generated an anomalous number of connections compared to the typical amount, or has triggered an anomalous number of connection failure responses, in the measured interval. This can indicate that an attacker is scanning for computers or ports to exploit.

This alert type has two subtypes:

Connection Failure Anomaly (Sensor Traffic)
Connection Spike Anomaly (Firewall / Windows Traffic)

Alert Subtype: Connection Failure Anomaly (Sensor Traffic)

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [External] Reconnaissance (TA0043 )
Technique: Active Scanning (T1595 )
Tags: [External; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_port_scan.

Key Fields and Relevant Data Points

srcip — source IP address
num_failed — unique number of (destination IP and destination port) tuples that respond with failed status
num_successful — unique number of (destination IP and destination port) tuples that respond with success status
percent_failed — percent of unique (destination IP and destination port) tuples that respond with failed status
accumulated_anomalous_failures — score value of model, shows the degree of abnormal activities
srcip_host — host name of corresponding source IP address
dstip_host — host name of corresponding destination IP address
appid_name — application name

Use Case with Data Points

For every unique triplet (source IP address, destination IP address, and destination port) browsed by each source IP address (srcip), the number of response failures and successes is calculated periodically. If the number of failures is significantly larger than the number of successes, an alert is triggered. The Interflow includes the source host (srcip_host), destination host (dstip_host), and application name (appid_name).

Considering that a lateral scan (private to private) is more sensitive than a non-lateral scan, this alert type is divided into two parts. One focuses on lateral scan analysis, the other focuses on non-lateral scan analysis. The mechanism remains the same as before, with the trigger condition for lateral scan alert being more sensitive than non-lateral one.

Validation / Remediation

If the source IP address is internal targeting an external address, check with the user if they are aware of the activity or if they are authorized to perform the activity. Inform the user's supervisor if the activity is unauthorized.

If the source IP address is external targeting any addresses, check the reputation of the source IP address as in known malicious/scanner.

Potential False Positives

Some legitimate activities such as vulnerability scans or penetration testing may trigger this alert type, if from an external IP address to an internal IP address.

Alert Subtype: Connection Spike Anomaly (Firewall / Windows Traffic)

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [External] Reconnaissance (TA0043 )
Technique: Active Scanning (T1595 )
Tags: [External; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_port_scan_tsa.

Key Fields and Relevant Data Points

srcip — source IP address
actual — actual number of connection failure responses in the period
typical — typical number of connection failure responses in the period
srcip_host — host name of corresponding source IP address
dstip_host — host name of corresponding destination IP address
appid_name — application name

Use Case with Data Points

For every unique (destination IP address and destination port) browsed by each source IP address (srcip), the number of response failures and successes and the number of total data volume are calculated periodically. If the total data volume is significantly larger than the typical number, an alert is triggered. The Interflow includes the source host (srcip_host), destination host (dstip_host), and application name (appid_name).

Validation / Remediation

If the source IP address is external targeting any addresses, check the reputation of the source IP address as in known malicious/scanner.

Potential False Positives

Some legitimate activities such as vulnerability scans or penetration testing may trigger this alert type, if from an external IP address to an internal IP address.

Unsupervised

External Non-Standard Port Anomaly

An application had an anomalously large number of connections or a rarely seen connection on non-standard ports. Check the application to be sure this is benign.

XDR Kill Chain

Kill Chain Stage: Persistent Foothold
Tactic: [External] Command and Control (TA0011 )
Technique: Non-Standard Port (T1571 )
Tags: [External; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_non_std_port_anomaly.

Key Fields and Relevant Data Points

dstip — destination IP address
dstport — destination port
appid — application ID
days_silent — number of days since the application was last seen
appid_name — application name
dstip_host — host name of corresponding destination IP address
actual — actual number of connections in the period
typical — typical number of connections in the period

Use Case with Data Points

The number of connections for an application (dst_ip + dstport + appid) is calculated periodically. If a non-standard combination has an actual number of connections (actual) that is much larger than the typical number of connections (typical), or the combination has not appeared for a long time, an alert is triggered. The Interflow includes the source host (srcip_host), destination IP address (dstip), destination port (dstport), application ID (appid), and application name (appid_name).

Unsupervised+Analytics

External Other Malware

Malware with uncategorized malicious activity was observed. Check with the user.

XDR Kill Chain

Kill Chain Stage: Persistent Foothold
Tactic: [External] XDR Malware (XTA0006)
Technique: XDR Miscellaneous Malware (XT6001)
Tags: [External; Malware]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_malware_activity.

Key Fields and Relevant Data Points

ids.signature — IDS signature
maltrace-cloud.data.malicious_activity — malicious activity
actual — number of records for one IDS signature or malicious activity in the period
lateral — boolean, indicating whether this activity is lateral (from private to private)
srcip_host — source host name
srcip_geo.countryName — source country
dstip_host — destination host name
dstip_geo.countryName — destination country
file_name — name of the file that carries the malware
event_source — source of the event, either ids or sandbox

Use Case with Data Points

If ML-IDS or sandbox indicates malware that cannot be categorized as ransomware, spyware, trojan, PUA, or adware, an alert is triggered. A sample Interflow includes malicious activity for sandbox (maltrace-cloud.data.malicious_activity), IDS signature for ML-IDS (ids.signature), event source (event_source), source host (srcip_host), source country (srcip_geo.countryName), destination host (dstip_host), destination country (dstip_geo.countryName), and the name of the file that carries the malware (file_name) from the sandbox.

Analytics

External Password Spraying

.An anomalously large number of failed logins with unknown user names was observed on external Windows authentication services. Check the activity after successful logins, and consider blocking the source IP addresses.

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: Credential Access (TA0006 )
Technique: Brute Force (T1110 )
Sub-technique: Password Spraying (T1110.003 )
Tags: [External]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_password_spray.

Key Fields and Relevant Data Points

srcip — source IP address generating a failed login
or
event_data.Workstation — workstation causing the alert
The key field for this alert type can be either srcip or event_data.Workstation, depending on the data feed.
event_id — Windows event ID corresponding to the login failure
login_type — type of login; the available values vary by event_id
actual — actual number of failed logins with unknown user names in a 5-minute period
typical — typical number of failed logins with unknown user names in a 5-minute period
password_spray_user_summary — list of up to 100 unknown user names associated with the failed logins (the first three are shown in the alert description)

Use Case with Data Points

If a potential password spraying attack is observed, an alert is triggered. The Interflow includes a source (srcip or event_data.Workstation), timestamp, the type of login (login_type), the number of failed logins (actual), the usual number of failed logins (typical), and a sampling of the user names used in the attack (password_spray_user_summary).

Unsupervised

External PII Leaked

Personally identifiable information (social security numbers or credit cards) has been detected in the clear. Check the source to see if it is compromised. If so, consider blocking it.

XDR Kill Chain

Kill Chain Stage: Exfiltration & Impact
Tactic: [External] Exfiltration (TA0010 )
Technique: Automated Exfiltration (T1020 )
Tags: [External; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_pii_leak.

Key Fields and Relevant Data Points

srcip — source IP address of the PII leak
dstip — destination IP address of the PII leak
ids.signature — IDS signature of the exploit
srcip_host — host name of corresponding source IP address
dstip_host — host name of corresponding destination IP address

Use Case with Data Points

If a personally identifiable information leak is detected by IDS, an alert is triggered. A sample Interflow includes the IDS signature (ids.signature), source IP address (srcip), destination IP address (dstip), source host (srcip_host), and destination host (dstip_host).

Analytics

External Plain Text Passwords Detected

A plain text password was detected in unencrypted traffic. Check with the user.

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [External] XDR NBA (XTA0002)
Technique: XDR Clear Password (XT2006)
Tags: [External; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_clear_password.

Key Fields and Relevant Data Points

srcip — source IP address
actual — actual number of connections with a plain text password in the period
srcip_host — host name of corresponding source IP address
dstip_host — host name of corresponding destination IP address
appid_name — application name

Use Case with Data Points

If there are plain text passwords in unencrypted traffic records with a public source IP address (srcip) or destination IP address (dstip), an alert is triggered. A sample Interflow includes the source IP address (srcip), destination IP address (dstip), source host (srcip_host), destination host (dstip_host), and application (appid_name).

Analytics

External Protocol Account Login Failure Anomaly

An anomalously large number of login failures over SMB or FTP was observed. Check with the user.

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [External] Credential Access (TA0006 )
Technique: Brute Force (T1110 )
Tags: [External; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_protocol_account_login_failure.

Key Fields and Relevant Data Points

Use Case with Data Points

metadata.request.username — user name in the HTTP connection request
event_summary.total_failed — number of failed logins in the period
event_summary.total_successful — number of successful logins in the period
event_summary.total_fail_ratio — percent of failed logins in the period, which is: event_summary.total_failed / (event_summary.total_failed + event_summary.total_successful)
accumulated_anomalous_failures — score value of the model indicating the degree of abnormal activity
appid_name — application name
login_type — type of login
srcip_host — host name of corresponding source IP address
srcip_reputation — source reputation

For every user name (metadata.request.username) in the HTTP connections names (that do not begin with "Mozilla" or "Aella"), the number of failed and successful logins are calculated periodically. If the number of failed logins is much greater than successful logins, an alert is triggered. The Interflow includes the application name (appid_name), login type (login_type), source host (srcip_host), and source reputation (srcip_reputation).

Unsupervised

External PUA

Unwanted applications or malware that bombards the user with advertisements has been detected. Check with the user.

XDR Kill Chain

Kill Chain Stage: Persistent Foothold
Tactic: [External] XDR Malware (XTA0006)
Technique: XDR PUA (XT6002)
Tags: [External; Malware]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_pua.

Key Fields and Relevant Data Points

ids.signature — IDS signature
maltrace-cloud.data.malicious_activity — malicious activity
actual — number of records for one IDS signature or malicious activity in the period
lateral — boolean, indicating whether this activity is lateral (from private to private)
srcip_host — source host name
srcip_geo.countryName — source country
dstip_host — destination host name
dstip_geo.countryName — destination country
file_name — name of the file that carries the PUA
event_source — source of the event, either ids or sandbox

Use Case with Data Points

If ML-IDS or sandbox indicates potentially unwanted applications (PUA), an alert is triggered. A sample Interflow includes malicious activity for sandbox (maltrace-cloud.data.malicious_activity) or IDS signature for ML-IDS (ids.signature), along with event source (event_source), source host (srcip_host), source country (srcip_geo.countryName), destination host (dstip_host), destination country (dstip_geo.countryName), and the name of the file that carries the PUA (file_name) from the sandbox.

Analytics

External Ransomware

Malware that prevents you from accessing your system or files and demands ransom payment in order to regain access was detected. Check with the user.

XDR Kill Chain

Kill Chain Stage: Exfiltration & Impact
Tactic: [External] Impact (TA0040 )
Technique: Data Encrypted for Impact (T1486 )
Tags: [External; Malware; Ransomware]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_ransomware.

Key Fields and Relevant Data Points

ids.signature — IDS signature
maltrace-cloud.data.malicious_activity — malicious activity
actual — number of records for one IDS signature or malicious activity in the period
lateral — boolean, indicating whether this activity is lateral (from private to private)
srcip_host — source host name
srcip_geo.countryName — source country
dstip_host — destination host name
dstip_geo.countryName — destination country
file_name — name of the file that carries the ransomware
event_source — source of the event, either ids or sandbox

Use Case with Data Points

If ML-IDS or sandbox indicates ransomware, an alert is triggered. A sample Interflow includes malicious activity for sandbox (maltrace-cloud.data.malicious_activity), IDS signature for ML-IDS (ids.signature), event source (event_source), source host (srcip_host), source country (srcip_geo.countryName), destination host (dstip_host), destination country (dstip_geo.countryName), and the name of the file that carries the ransomware (file_name) from the sandbox.

Analytics

External RDP Brute Force Attack

An anomalously large number of RDP connections to an RDP server was observed. Check the source IP addresses to see if they are unknown or malicious, and monitor any successful RDP logins.

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [External] Credential Access (TA0006 )
Technique: Brute Force (T1110 )
Tags: [External; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_rdp_brute_force.

Key Fields and Relevant Data Points

dstip — IP address of the destination RDP server
actual — actual number of RDP connections to the destination IP address in the period
typical — typical number of RDP connections to the destination IP address in the period
srcip — source IP address

Use Case with Data Points

RDP connection activity is monitored and the number of connections are calculated periodically. If the number of connections to an RDP server (actual) is much greater than normal (typical), an alert is triggered. A sample Interflow includes the destination IP address (dstip) and source IP address (srcip).

Unsupervised

External RDP Suspicious Outbound

Non-standard tools connecting to TCP port 3389 were detected. This could indicate lateral movement attempting to establish an RDP connection. Check the IP address and block if necessary.

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [External] XDR NBA (XTA0002)
Technique: XDR App Anomaly (XT2003)
Tags: [External; RDP]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_rdp_suspicious_outbound.

Key Fields and Relevant Data Points

srcip — source IP address of the host that connects to TCP port 3389 with a non-standard tool
srcip_host — source host name
process_name — process name

Use Case with Data Points

Connections to TCP port 3389 are monitored, and if non-standard tools connect, an alert is triggered. A sample Interflow includes the source IP address (srcip) and the process name (process_name). The following are the standard tools:

mstsc.exe
RTSApp.exe
RTS2App.exe
RDCMan.exe
ws_TunnelService.exe
RSSensor.exe
RemoteDesktopManagerFree.exe
RemoteDesktopManager.exe
RemoteDesktopManager64.exe
mRemoteNG.exe
mRemote.exe
Terminals.exe
spiceworks-finder.exe
FSDiscovery.exe
FSAssessment.exe
MobaRTE.exe
chrome.exe
thor.exe
thor64.exe

Analytics

External Scanner Behavior Anomaly

An anomalously large amount of scanning behavior was found. Cross-check with the IP/Port Scan Anomaly alert.

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [External] Reconnaissance (TA0043 )
Technique: Active Scanning (T1595 )
Tags: [External; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_scan_anomalies.

Key Fields and Relevant Data Points

ids.signature — signature of the exploit
actual — actual number of times this signature was found in the period, with critical IDS signatures counted as 2, high counted as 1, low counted as 0.5, and others counted as 1
typical — typical number of times this signature is seen in the period, with critical IDS signatures counted as 2, high counted as 1, low counted as 0.5, and others counted as 1
srcip_host — host name of corresponding source IP address
dstip_host — host name of corresponding destination IP address
appid_name — application name

Use Case with Data Points

The number of occurrences of each scanner, based on IDS signature (ids.signature), is calculated periodically. If one scanner occurs (actual) much more often than its history (typical), an alert is triggered. The Interflow includes information such as the traffic application type (appid_name), source (srcip_host), and destination (dstip_host).

Unsupervised

External SMB Read Anomaly

An IP address sent an anomalously large number of read requests to SMB protocol based service(s). Investigate the files that the IP address tried to read. If suspicious, block the source IP address.

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [External] Initial Access (TA0001 )
Technique: Exploit Public-Facing Application (T1190 )
Tags: [External; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_smb_read_anomaly.

Key Fields and Relevant Data Points

srcip — source IP address
actual — actual number of SMB reads from the source IP address in the period
typical — typical number of SMB reads from other source IP addresses in the period
dstip_host — destination host name
smb_username — SMB user name

Use Case with Data Points

The number of SMB read requests for every source IP address (srcip) is calculated periodically. If a source IP address’s number of SMB reads (actual) is much larger than the typical number (typical) and that of other IP addresses in any period, an alert is triggered. The Interflow includes the SMB user (smb_username) and destination host (dstip_host).

Unsupervised

External SMB Username Enumeration

At least 5 different users SMB login attempts and 1 denied attempt or at least 10 different users SMB login attempts, were detected from the same source. Check the source IP address. If malicious, consider blocking it.

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [External] Credential Access (TA0006 )
Technique: Brute Force (T1110 )
Tags: [External; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_smb_user_scan.

Key Fields and Relevant Data Points

srcip — source IP address
srcip_host — host name of corresponding source IP address
dstip_host — host name of corresponding destination IP address
actual — actual unique SMB user count
threshold — SMB user count threshold
smb_username_set — all SMB login user names

Use Case with Data Points

If one source IP address (srcip) has several SMB login attempts with (1) at least 5 unique user names and at least 1 denied attempt or (2) at least 10 unique user names, an alert is triggered. A sample Interflow includes the source IP address (srcip), source host (srcip_host), destination host (dstip_host), and all the user names (smb_username_set).

Analytics

External SMB Write Anomaly

An IP address sent an anomalously large number of SMB write requests. Investigate the files that the IP address tried to write. If suspicious, block the source IP address.

XDR Kill Chain

Kill Chain Stage: Exfiltration & Impact
Tactic: [External] Impact (TA0040 )
Technique: Data Manipulation (T1565 )
Tags: [External; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_smb_anomaly.

Key Fields and Relevant Data Points

srcip_host — source host name
actual — actual number of SMB writes in the period
typical — typical number of SMB writes in the period
dstip_host — destination host name
smb_username — SMB user name

Use Case with Data Points

The number of SMB write requests for every source IP address (srcip_host) is calculated periodically. If a source IP address’s number of SMB writes (actual) is much larger than the typical number (typical) and that of other IP addresses in any period, an alert is triggered. The Interflow includes the SMB user (smb_username) and destination host (dstip_host).

Analytics

External Spyware

Malware that collects and shares information about a device without consent was detected. Check with the user.

XDR Kill Chain

Kill Chain Stage: Persistent Foothold
Tactic: [External] XDR Malware (XTA0006)
Technique: XDR Spyware (XT6003)
Tags: [External; Malware]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_spyware_activity.

Key Fields and Relevant Data Points

ids.signature — IDS signature
maltrace-cloud.data.malicious_activity — malicious activity
actual — number of records for one IDS signature or malicious activity in the period
lateral — boolean, indicating whether this activity is lateral (from private to private)
srcip_host — source host name
srcip_geo.countryName — source country
dstip_host — destination host name
dstip_geo.countryName — destination country
file_name — name of the file that carries the spyware
event_source — source of the event, either ids or sandbox

Use Case with Data Points

If ML-IDS or sandbox indicates spyware activity, an alert is triggered. A sample Interflow includes malicious activity for sandbox (maltrace-cloud.data.malicious_activity), IDS signature for ML-IDS (ids.signature), event source (event_source), source host (srcip_host), source country (srcip_geo.countryName), destination host (dstip_host), destination country (dstip_geo.countryName), and the name of the file that carries the spyware (file_name) from the sandbox.

Analytics

External SQL Anomaly

An IP address sent an anomalously large number of queries to a SQL server. Investigate the queries. If suspicious, block the source IP address.

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [External] Initial Access (TA0001 )
Technique: Exploit Public-Facing Application (T1190 )
Tags: [External; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_mysql_anomaly.

Key Fields and Relevant Data Points

srcip — source IP address
srcip_host — source host name
srcip_geo.countryName — name of the source country
actual — actual number of SQL queries in the period
typical — typical number of SQL queries from the source IP address
dstip_host — host name of corresponding destination IP address

Use Case with Data Points

The number of SQL queries for every source IP address (srcip_host) is calculated periodically. If a source IP’s SQL query count (actual) is much larger than the typical count (typical) and that of other IP addresses in any period, an alert is triggered. The source IP’s country is (srcip_geo.countryName). The Interflow includes the destination host (dstip_host) the source IP visits.

Unsupervised

External SQL Dumpfile Execution

The SQL dumpfile command was detected. This command is commonly used to dump database content or query output to a file on disk. Check with the user.

XDR Kill Chain

Kill Chain Stage: Exploration
Tactic: [External] Collection (TA0009 )
Technique: Data Staged (T1074 )
Tags: [External; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_sql_db_dump.

Key Fields and Relevant Data Points

srcip — source IP address
actual — number of SQL dumpfile queries
srcip_host — source host name
source_geo.countryName — source country
dstip_host — destination host name

Use Case with Data Points

If the SQL dumpfile command is seen on any source IP address (srcip), an alert is triggered. A sample Interflow includes the source IP address (srcip), source host (srcip_host), source country (srcip_geo.countryName), destination host (dstip_host), and number of SQL dumpfile queries in the period (actual).

Analytics

External SQL Shell Command

Shell commands were detected over a SQL connection, which is a common way hackers try to gain shell access over vulnerable SQL applications. Check with the user.

XDR Kill Chain

Kill Chain Stage: Persistent Foothold
Tactic: [External] Execution (TA0002 )
Technique: Command and Scripting Interpreter (T1059 )
Tags: [External; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_database_command.

Key Fields and Relevant Data Points

srcip — source IP address
dstip — destination IP address
srcip_host — source host name
srcip_reputation — source reputation
dstip_host — destination host name
dstip_reputation — destination reputation
metadata.request.query — SQL query command
actual — number of query records from one source to one destination in one period

Use Case with Data Points

For SQL query records, if special commands (such as select mylab_sys_exec) are found, an alert is triggered. A sample Interflow includes the source IP address (srcip), destination IP address (dstip), source host (srcip_host), source reputation (srcip_reputation), destination host (dstip_host), destination reputation (dstip_reputation), and SQL query records (metadata.request.query).

Analytics

External Suspected Malicious User Agent

An external HTTP connection was made by a user agent that has been identified as potentially malicious. Investigate the connection's destination.

This alert type has two subtypes:

Predicted Malicious Agent
Known Malicious Agent Match

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [External] XDR NBA (XTA0002)
Technique: XDR User Agent Anomaly (XT2012)
Tags: [External; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_suspected_malicious_user_agent.

Key Fields and Relevant Data Points

metadata.request.user_agent — user agent in the HTTP connection request
stellar.confidence — model's confidence in the prediction used to make the alert
srcip_host — host name of corresponding source IP address
dstip_host — host name of corresponding destination IP address
appid_name — application name

Use Case with Data Points

If a seen user agent is identified as suspicious, an alert is triggered. The alert includes the suspicious user agent (metadata.request.user_agent), confidence (stellar.confidence), tenant (tenant_name), source IP (srcip), and destination IP (dstip) in the key fields. Additionally, the confidence level of the model is displayed in the alert description in a pop-up box.

Alert Subtype: Predicted Malicious Agent

The Predicted Malicious Agent alert subtype is the same as the External Suspected Malicious User Agent alert type above, with the following differences:

The stellar.anomaly_tag is predicted_external.
The xdr_event.subtype.name is external_suspected_malicious_user_agent.
It is triggered by a machine learning classifier.

Alert Subtype: Known Malicious Agent Match

The Known Malicious Agent Match alert subtype is the same as the External Suspected Malicious User Agent alert type above, with the following differences:

The stellar.anomaly_tag is known_external.
The xdr_event.subtype.name is external_suspected_malicious_user_agent_known_malicious.
It is triggered by known threats.

Supervised

External SYN Flood Attacker

An attacker sends a large amount of SYN requests to a target's system in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic. Check to see if the host is malicious or compromised. If so, consider blocking the source host.

XDR Kill Chain

Kill Chain Stage: Exfiltration & Impact
Tactic: [External] Impact (TA0040 )
Technique: Endpoint Denial of Service (T1499 )
Tags: [External; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_syn_flood_attacker.

Key Fields and Relevant Data Points

srcip — source IP address of the SYN flood
srcip_host — source host name
dstip — target IP address of the SYN flood
dstip_host — destination host name
dstport — port on target host that received the SYN flood
time_window.start — start time of the SYN flood
time_window.end — end time of the SYN flood
syn_flood_events — number of SYN packets during the period

Use Case with Data Points

If a host (srcip) sends too many SYN packets (syn_flood_events) to a target (dstip) in a certain period (time_window.start to time_window.end), an alert is triggered. The Interflow includes the IP address of the source host (srcip), the IP address of the target host (dstip), the port of the target host (dstport), the start time of the event (time_window.start), the end time of the event (time_window.end), and how many SYN packets were observed (syn_flood_events).

Analytics

External SYN Flood Victim

XDR Kill Chain

Kill Chain Stage: Exfiltration & Impact
Tactic: [External] Impact (TA0040 )
Technique: Endpoint Denial of Service (T1499 )
Tags: [External; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_syn_flood.

Key Fields and Relevant Data Points

srcip — source IP address of the SYN flood
srcip_host — source host name
dstip — target IP address of the SYN flood
dstip_host — destination host name
dstport — port on target host that received the SYN flood
time_window.start — start time of the SYN flood
time_window.end — end time of the SYN flood
syn_flood_events — number of SYN packets during the period

Use Case with Data Points

Analytics

External Trojan

Malware that disguises itself as legitimate software in order to gain access to a system or files has been detected. Check with the user.

XDR Kill Chain

Kill Chain Stage: Persistent Foothold
Tactic: [External] XDR Malware (XTA0006)
Technique: XDR Trojan (XT6004)
Tags: [External; Malware]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_trojan_activity.

Key Fields and Relevant Data Points

ids.signature — IDS signature
maltrace-cloud.data.malicious_activity — malicious activity
actual — number of records for one IDS signature or malicious activity in the period
lateral — boolean, indicating whether this activity is lateral (from private to private)
srcip_host — source host name
srcip_geo.countryName — source country
dstip_host — destination host name
dstip_geo.countryName — destination country
file_name — name of the file that carries the trojan
event_source — source of the event, either ids or sandbox

Use Case with Data Points

If ML-IDS or sandbox indicates trojan activity, an alert is triggered. A sample Interflow includes malicious activity for sandbox (maltrace-cloud.data.malicious_activity), IDS signature for ML-IDS (ids.signature), event source (event_source), source host (srcip_host), source country (srcip_geo.countryName), destination host (dstip_host), destination country (dstip_geo.countryName), and the name of the file that carries the trojan (file_name) from the sandbox.

Analytics

External URL Reconnaissance Anomaly

An anomalous number of HTTP 4xx errors was detected. This can indicate an attacker scanning for pages to exploit. Check with the user.

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [External] Reconnaissance (TA0043 )
Technique: Active Scanning (T1595 )
Tags: [External; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_url_scan.

Key Fields and Relevant Data Points

srcip — source IP address
event_summary.total_failed — number of unique URLs with HTTP error status response in the period
event_summary.total_successful — number of unique URLs with HTTP success status response in the period
event_summary.total_fail_ratio — percent of unique URLs with HTTP error status response in the period, which is: event_summary.total_failed / (event_summary.total_failed + event_summary.total_successful)
accumulated_anomalous_failures — score value of the model indicating the degree of abnormal activity
srcip_host — host name of corresponding source IP address
dstip_host — host name of corresponding destination IP address
srcip_geo.countryName — source country name

Use Case with Data Points

For every unique URL browsed by each source IP address (srcip), the number of HTTP response failures and successes is calculated periodically. If the number of failures is significantly larger than the number of successes, an alert is triggered. The Interflow includes the source host (srcip_host), destination host (dstip_host), and source country (srcip_geo.countryName).

Unsupervised

External User Agent Anomaly

An HTTP connection was made by a user agent that has never been observed by Stellar Cyber (or been seen very rarely). Investigate the connection destination.

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [External] XDR NBA (XTA0002)
Technique: XDR User Agent Anomaly (XT2012)
Tags: [External; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_user_agent_anomaly.

Key Fields and Relevant Data Points

metadata.request.user_agent — user agent in the HTTP connection request
days_silent — number of days since this user agent was last seen
srcip_host — host name of corresponding source IP address
dstip_host — host name of corresponding destination IP address
appid_name — application name

Use Case with Data Points

All user agent (metadata.request.user_agent) HTTP connections having names that do not begin with "Mozilla" or "Aella" are examined. An alert is triggered if any of those agents have not been seen by Stellar Cyber before or have been silent for many days (days_silent). The Interflow includes all information from the suspicious HTTP connection, such as the application (appid_name), the source (srcip_host), and the destination (dstip_host).

Unsupervised

External User Application Usage Anomaly

A user who typically uses a small, consistent number of applications used a new application. Investigate the application, to see if it is benign. Check with the user to see if this was expected.

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [External] XDR UBA (XTA0004)
Technique: XDR App Anomaly (XT2003)
Tags: [External; User Behavior Analytics]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_user_uncommon_app.

Key Fields and Relevant Data Points

srcip_usersid — source user ID
appid_name — application name
srcip_host — host name of corresponding source IP address
dstip_host — host name of corresponding destination IP address
appid_family — application family
srcip_username — source user name
stability — score measuring the time since the last new application was used
days_stable — time since the last new application was used
diversity — score measuring the number of applications that the user used
child_count — number of applications that the user used

Use Case with Data Points

An alert is triggered under the following conditions:

a user (srcip_usersid, srcip_username) with a small number of applications (diversity, child_count) who has not used a new application for a long period of time (stability, days_stable), and then
a new application (appid_name) belonging to an application family (appid_family) appears on a host (scrip_host) with this user, and
that host connects to another host (scrip_host)

Unsupervised

External User Data Volume Anomaly

A user had an anomalously large volume of traffic compared to its typical volume or that of its peers. Investigate the user to see if this is expected.

Firewall and non-firewall data do not contribute to the same alert, so this alert will have either entirely firewall data or no firewall data.

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [External] XDR UBA (XTA0004)
Technique: XDR Bytes Anomaly (XT3001)
Tags: [External; User Behavior Analytics]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_user_bytes_sum.

Key Fields and Relevant Data Points

srcip_usersid — source user ID
actual — actual traffic volume in the period
typical — typical traffic volume from the user
srcip_host — host name of corresponding source IP address
srcip_username — source user name
dstip_host — host name of corresponding destination IP address
dstip_reputation — destination reputation
dstip_geo.countryName — destination country
appid_name — application name

Use Case with Data Points

The total traffic volume of each user identified by user ID (scrip_usersid) is calculated periodically. If the volume in one period (actual) is much larger than its normal volume (typical), an alert is triggered.

The Interflow includes the source IP address (scrip_host), destination IP address (dstip_host), destination reputation (dstip_reputation), destination country (dstip_geo.countryName), and application of the traffic (appid_name).

Unsupervised

External User Login Failure Anomaly

An anomalous number of login failures was observed for one of the following applications: SSH, SMTP, FTP, RDP, SMB, databases, Active Directory, Office 365, Okta, AWS CloudTrail, or Google Workspace. For Okta, an anomalous number of multi-factor authentication (MFA) failures was observed. Check with the user.

This alert type has a relatively long detection delay of up to 40 minutes because it waits for login events from high latency data sources and is sensitive to the event order of user logins.

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [External] Credential Access (TA0006 )
Technique: Brute Force (T1110 )
Tags: [External]

Event Name

The xdr_event.name for this alert type in the Interflow data is external_user_login_fail.

Key Fields and Relevant Data Points

srcip — source IP address
dstip — destination IP address
dstip_host — destination host name
event_summary.total_failed — number of failed logins in the period
event_summary.total_successful — number of successful logins in the period
event_summary.total_fail_ratio — percent of failed logins in the period, which is: event_summary.total_failed / (event_summary.total_failed + event_summary.total_successful)
accumulated_anomalous_failures — score value of the model indicating the degree of abnormal activity
login_type — type of login, such as ssh_traffic, okta_log, or aws_cloudtrail
srcip_host — source host name
srcip_reputation — source reputation

Use Case with Data Points

Login failures and successes are calculated periodically for every source (srcip) and destination (dstip) IP address. If the number of failures is significantly larger than the number of successes, an alert is triggered. The Interflow includes the login type (login_type), source host (srcip_host), and source reputation (srcip_reputation).

Unsupervised

Analytics

Unsupervised

Internal Account Login Failure Anomaly

An anomalously large number of login failures from an internal source IP address to an internal destination IP address was observed for an account. Check with the user.

This alert type has a relatively long detection delay of up to 40 minutes because it waits for login events from high latency data sources and is sensitive to the event order of user logins.

XDR Kill Chain

Kill Chain Stage: Propagation
Tactic: [Internal] Credential Access (TA0006 )
Technique: Brute Force (T1110 )
Tags: [Internal]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_cloud_account_login_failure.

Key Fields and Relevant Data Points

srcip_usersid — account user ID
or
srcip_username — account user name, enriched from event_data.targetusername
The key field for this alert type can be either srcip_usersid or srcip_username, depending on the data feed.
event_summary.total_failed — number of failed logins in the period
event_summary.total_successful — number of successful logins in the period
event_summary.total_fail_ratio — percent of failed logins in the period, which is: event_summary.total_failed / (event_summary.total_failed + event_summary.total_successful)
accumulated_anomalous_failures — score value of the model indicating the degree of abnormal activity
srcip_host — host name of corresponding source IP address
login_type — type of login
srcip_reputation — source reputation

Use Case with Data Points

Login failures and successes between any internal IP addresses are calculated periodically for every account (srcip_usersid). If the number of failures is significantly larger than the number of successes, an alert is triggered. A sample Interflow includes the login type (login_type), source host (srcip_host), and source reputation (srcip_reputation).

Unsupervised

Internal Brute-Forced Successful User Login

This alert type has two subtypes:

Source IP-Based
User ID-Based

This alert type has a relatively long detection delay of up to 40 minutes because it waits for login events from high latency data sources and is sensitive to the event order of user logins.

XDR Kill Chain

Kill Chain Stage: Propagation
Tactic: [Internal] Credential Access (TA0006 )
Technique: Brute Force (T1110 )
Tags: [Internal]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_user_success_brute_forcer.

Alert Subtype: Source IP-Based

Key Fields and Relevant Data Points

srcip — source IP address
srcip_usersid — Windows SID associated with the source IP address
srcip_host — source host name
srcip_reputation — source reputation
source_geo.countryName — source country
dstip_host — destination host name
login_type — type of login
username — user name
related_alert._id — link to the related Internal User Login Failure Anomaly

Use Case with Data Points

The login records to an internal IP address (dstip) are checked for every internal source IP address (srcip). An alert is triggered if that IP address:

Has so many failed login attempts that it triggered the Internal User Login Failure Anomaly, and
Had a successful login

A sample Interflow includes the source IP address (srcip), login type (login_type), source host name (srcip_host), source reputation (srcip_reputation), source country (srcip_geo.countryName), and user name (username).

Alert Subtype: User ID-Based

Key Fields and Relevant Data Points

srcip — source IP address
srcip_usersid — Windows SID associated with the source IP address
srcip_host — source host name
srcip_reputation — source reputation
source_geo.countryName — source country
dstip_host — destination host name
login_type — type of login
username — user name
related_alert._id — link to the related Internal Account Login Failure Anomaly

Use Case with Data Points

The login records to a user account (srcip_usersid) are checked for every internal source IP address (srcip). An alert is triggered if that user account:

Has so many failed login attempts that it triggered the Internal Account Login Failure Anomaly, and
Had a successful login

Unsupervised+Analytics

Internal Credential Stuffing

An anomalously large amount of username/password testing was detected on an internal Windows authentication service. Check the activity after successful logins, and consider blocking the internal source IP addresses.

XDR Kill Chain

Kill Chain Stage: Propagation
Tactic: [Internal] Credential Access (TA0006 )
Technique: Brute Force (T1110 )
Tags: [Internal]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_credential_stuffing.

Key Fields and Relevant Data Points

msg_class — Microsoft-Windows-Security-Auditing for Windows
service_id — specific account ID of a service
login_failure_rate — rate of login failures per minute in the period
unknown_users_rate — rate of unknown user names per minute in the period
unknown_users_to_login_failures — ratio of unknown user names to login failures in the period
suspicious_ips — suspicious source IP addresses (up to 100)
possible_breached_ips — list of malicious IP addresses that may have successful breach activities

Use Case with Data Points

Internal credential stuffing is the constant testing of username/password combinations on the AWS, Okta, or Windows authentication functions. Login activity is monitored and if the number of failed logins is larger than normal for that service, an alert is triggered. The Interflow includes the service (msg_class), tenant's account ID on that service (service_id), suspicious source IP address (suspicious_ips), login failure rate (login_failure_rate), unknown user rate (unknown_users_rate), the ratio of unknown users to login failures (unknown_users_to_login_failures), and a list of source IP addresses that might have suspicious activities and should be investigated (possible_breached_ips).

Unsupervised

Internal Exploited Vulnerability

An internal host with a vulnerability discovered by a security scanning tool was exploited by an attack on that same vulnerability, indicating a high probability of success. Check the target to see if it was compromised.

XDR Kill Chain

Kill Chain Stage: Exploration
Tactic: [Internal] XDR NBA (XTA0002)
Technique: XDR Exploited Vulnerability (XT2015)
Tags: [Internal; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_vuln_exploit_correlation.

Key Fields and Relevant Data Points

tenantid — tenant ID
vulnerability_id — ID of the original security scan result
ids_event_id — ID of the original IDS exploit event
srcip (of security scan result) — IP address of the target correlation_info.srcip
dstip (of IDS event) — IP address of the target (correlation_info.dstip)
srcip (of IDS event) — IP address of the attacker (correlation_info.srcip)
correlation_info.vulnerability.cve — CVE associated with the reported vulnerability
correlation_info.ids.cve — CVE the attacker used to exploit the host

Use Case with Data Points

An attacker (srcip) with IP address A is performing an exploit against a target (dstip) with IP address B using a vulnerability (ids.cve) with CVE x. If any security scanning tool found the target (srcip) with IP address B to have a vulnerability (vulnerability.cve) with CVE x, an alert is triggered.

Analytics

Internal Firewall Denial Anomaly

A internal source host had actions blocked by a firewall too many times. Investigate the firewall rules that were violated. If suspicious, block the internal source IP address.

XDR Kill Chain

Kill Chain Stage: Exploration
Tactic: [Internal] XDR NBA (XTA0002)
Technique: XDR Firewall Anomaly (XT2002)
Tags: [Internal; Network Traffic Analysis; Firewall Anomalies]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_fw_action.

Key Fields and Relevant Data Points

srcip_host — source host name
srcip — source IP address
actual — actual number of firewall denials in the period
typical — typical number of firewall denials in the period
dstip_host — host name of corresponding destination IP address
dev_name — name of the firewall
engid_name — name of the sensor

Use Case with Data Points

The number of firewall denials for every internal source IP address (srcip) is calculated periodically. If an internal source IP address’s number of firewall denials (actual) is much larger than the historical count (typical) of all internal IP addresses, an alert is triggered. The Interflow includes the name of the firewall (dev_name), the name of the sensor (engid_name), and the destination host (dstip_host).

Unsupervised

Internal Firewall Policy Anomaly

A rarely triggered firewall policy involving an internal source IP and internal destination IP has been violated. Investigate that policy and track down the violation.

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [Internal] XDR NBA (XTA0002)
Technique: XDR Firewall Anomaly (XT2002)
Tags: [Internal; Network Traffic Analysis; Firewall Anomalies]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_fw_policy_id.

Key Fields and Relevant Data Points

fw_policy_id — ID of the violated firewall policy
days_silent — number of days since this firewall policy was last seen
srcip_host — host name of corresponding source IP address
dstip_host — host name of corresponding destination IP address
dev_name — device name
dev_type — device type
engid_name — sensor name

Use Case with Data Points

A firewall policy violation (fw_policy_id), which is raised by a device (dev_name and dev_type) and captured by a sensor (engid_name), shows never seen or very rare (days_silent) traffic between an internal host (srcip_host) and another internal host (dstip_host). This violation will trigger an alert.

Unsupervised

Internal Handshake Failure

There were too many handshake failures between two internal hosts, which might indicate port scanning. Check the source host to see if this was expected, and if not, consider blocking the host.

XDR Kill Chain

Kill Chain Stage: Exploration
Tactic: [Internal] Discovery (TA0007 )
Technique: Network Service Scanning (T1046 )
Tags: [Internal; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_handshake_failure.

Key Fields and Relevant Data Points

srcip — source IP address of the host with the handshake failures
srcip_host — source host name
dstip — destination IP address of the host with the handshake failures
dstip_host — destination host name
timestamp — when the scan happened

Use Case with Data Points

If an internal host (srcip) scans across many ports on another internal host (dstip), an alert is triggered. The Interflow includes the IP address of the potential attacker (srcip), the IP address of the victim (dstip), a special message flag (msgtyp), and when the scan happened (timestamp).

Analytics

Internal IDS Signature Spike

A source IP address transmitted an anomalous number of different IDS signatures. Typically, this indicates host penetration or vulnerability scanning.

XDR Kill Chain

Kill Chain Stage: Propagation
Tactic: Lateral Movement (TA0008 )
Technique: Exploitation of Remote Services (T1210 )
Tags: [Internal; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_ids_signature_spike.

Key Fields and Relevant Data Points

srcip — source IP address
ids_signatures_summarize — summarized IDS signatures
srcip_host — source host name
actual — actual number of unique IDS signatures in the period, with critical IDS signatures counted as 2, high counted as 1, low counted as 0.5, and others counted as 1
typical — typical number of unique IDS signatures from the source IP address, with critical IDS signatures counted as 2, high counted as 1, low counted as 0.5, and others counted as 1

Use Case with Data Points

The number of unique IDS signatures (ids.signature) and severity (ids.severity), are calculated periodically. If many different exploits with unique IDS signatures are observed, an alert is triggered. The Interflow includes a source (srcip), timestamp, an accumulated severity of IDS signatures (actual), the usual accumulated severity of IDS signatures (typical), and a sampling of the IDS signatures used in the attack (ids_signatures_summarize).

Unsupervised

Internal IP / Port Scan Anomaly

This alert type has two subtypes:

Connection Failure Anomaly (Sensor Traffic)
Connection Spike Anomaly (Firewall / Windows Traffic)

Alert Subtype: Connection Failure Anomaly (Sensor Traffic)

XDR Kill Chain

Kill Chain Stage: Exploration
Tactic: [Internal] Discovery (TA0007 )
Technique: Network Service Scanning (T1046 )
Tags: [Internal; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_port_scan.

Key Fields and Relevant Data Points

srcip — source IP address
srcip_host — host name of corresponding source IP address
num_failed — unique number of (destination IP and destination port) tuples that respond with failed status
num_successful — unique number of (destination IP and destination port) tuples that respond with success status
percent_failed — percent of unique (destination IP and destination port) tuples that respond with failed status
accumulated_anomalous_failures — score value of model, which shows the degree of abnormal activities
dstip_host — host name of corresponding destination IP address
appid_name — application name

Use Case with Data Points

For each internal source IP address (srcip), the number of unique internal destination IP:port pairs that gave fail responses and the number of unique destination IP:port pairs that gave success responses are calculated periodically. If the number of failures is significantly larger than the number of successes, an alert is triggered. The Interflow includes the source host (srcip_host), destination host (dstip_host), and application name (appid_name).

Validation / Remediation

Check with the user related to the internal source IP address. Inform the user's supervisor if the activity is unauthorized.

Potential False Positives

Some legitimate activities such as vulnerability scans or penetration testing may trigger this alert type.

Alert Subtype: Connection Spike Anomaly (Firewall / Windows Traffic)

XDR Kill Chain

Kill Chain Stage: Exploration
Tactic: [Internal] Discovery (TA0007 )
Technique: Network Service Scanning (T1046 )
Tags: [Internal; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_port_scan_tsa.

Key Fields and Relevant Data Points

srcip — source IP address
actual — actual number of connections to the destination IP address in the period
typical — typical number of connections to the destination IP address
srcip_host — host name of corresponding source IP address
dstip_host — host name of corresponding destination IP address
appid_name — application name

Use Case with Data Points

For every unique triplet (source IP address, destination IP address, and destination port) browsed by each source IP address (srcip), the number of response failures and successes and the number of total data volume are calculated periodically. If the number of failures is significantly larger than the number of successes, or the total data volume is significantly larger than the typical number, an alert is triggered. The Interflow includes the source host (srcip_host), destination host (dstip_host), and application name (appid_name).

Validation / Remediation

Check with the user related to the internal source IP address. Inform the user's supervisor if the activity is unauthorized.

Potential False Positives

Some legitimate activities such as vulnerability scans or penetration testing may trigger this alert type.

Unsupervised

Internal Non-Standard Port Anomaly

An application had an anomalously large number of connections or a rarely seen connection to an internal IP address on non-standard ports. Check the application to be sure this is benign.

XDR Kill Chain

Kill Chain Stage: Exploration
Tactic: [Internal] XDR NBA (XTA0002)
Technique: XDR Service on Non-Standard Port (XT2011)
Tags: [Internal; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_non_std_port_anomaly.

Key Fields and Relevant Data Points

dstip — destination IP address
dstport — destination port
appid — application ID
days_silent — number of days since the application was last seen
appid_name — application name
dstip_host — host name of corresponding destination IP address
actual — actual number of connections in the period
typical — typical number of connections in the period

Use Case with Data Points

The number of connections for an application (dst_ip + dstport + appid) to an internal IP address is calculated periodically. If a non-standard combination has an actual number of connections (actual) that is much larger than the typical number of connections (typical), or the combination has not appeared for a long time, an alert is triggered. The Interflow includes the source host (srcip_host), destination IP address (dstip), destination port (dstport), application ID (appid), and application name (appid_name).

Unsupervised

Internal Other Malware

Malware with uncategorized malicious activity was detected. Check with the user.

XDR Kill Chain

Kill Chain Stage: Propagation
Tactic: [Internal] XDR Malware (XTA0006)
Technique: XDR Miscellaneous Malware (XT6001)
Tags: [Internal; Malware]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_malware_activity.

Key Fields and Relevant Data Points

ids.signature — IDS signature
maltrace-cloud.data.malicious_activity — malicious activity
actual — number of records for one IDS signature or malicious activity in the period
lateral — boolean, indicating whether this activity is lateral (from private to private)
srcip_host — source host name
srcip_geo.countryName — source country
dstip_host — destination host name
dstip_geo.countryName — destination country
file_name — name of the file that carries the malware
event_source — source of the event, either ids or sandbox

Use Case with Data Points

If ML-IDS or sandbox indicates malware in internal traffic that cannot be categorized as ransomware, spyware, trojan, PUA, or adware, an alert is triggered. A sample Interflow includes malicious activity for sandbox (maltrace-cloud.data.malicious_activity), IDS signature for ML-IDS (ids.signature), event source (event_source), source host (srcip_host), source country (srcip_geo.countryName), destination host (dstip_host), destination country (dstip_geo.countryName), and the name of the file that carries the malware (file_name) from the sandbox.

Analytics

Internal Password Spraying

An anomalously large number of failed logins with unknown user names was observed on internal Windows authentication services. Check the activity after successful logins, and consider blocking the internal source IP addresses.

XDR Kill Chain

Kill Chain Stage: Propagation
Tactic: Credential Access (TA0006 )
Technique: Brute Force (T1110 )
Sub-technique: Password Spraying (T1110.003 )
Tags: [Internal]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_password_spray.

Key Fields and Relevant Data Points

srcip — source IP address generating a failed login
or
event_data.Workstation — workstation generating a failed login
The key field for this alert type can be either srcip or event_data.Workstation, depending on the data feed.
event_data.WorkstationName — workstation associated with the alerting srcip (when applicable)
event_id — Windows event ID corresponding to the login failures
login_type — type of login; the available values vary by event_id
actual — actual number of failed logins with unknown user names in a 5-minute period
typical — typical number of failed logins with unknown user names in a 5-minute period
password_spray_user_summary — list of up to 100 unknown user names associated with the failed logins (the first three are shown in the alert description)

Use Case with Data Points

Unsupervised

Internal PII Leaked

Personally identifiable information (social security numbers or credit cards) has been detected in internal traffic in the clear. Check the source to see if it is compromised. If so, consider blocking it.

XDR Kill Chain

Kill Chain Stage: Exfiltration & Impact
Tactic: [Internal] Exfiltration (TA0010 )
Technique: Automated Exfiltration (T1020 )
Tags: [Internal; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_pii_leak.

Key Fields and Relevant Data Points

srcip — source IP address of the PII leak
dstip — destination IP address of the PII leak
ids.signature — IDS signature of the exploit
srcip_host — host name of corresponding source IP address
dstip_host — host name of corresponding destination IP address

Use Case with Data Points

Analytics

Internal Plain Text Passwords Detected

A plain text password was observed in unencrypted traffic. Check with the user.

XDR Kill Chain

Kill Chain Stage: Exploration
Tactic: [Internal] XDR NBA (XTA0002)
Technique: XDR Clear Password (XT2006)
Tags: [Internal; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_clear_password.

Key Fields and Relevant Data Points

srcip — source IP address
actual — actual number of connections with a plain text password in the period
srcip_host — host name of corresponding source IP address
dstip_host — host name of corresponding destination IP address
appid_name — application name

Use Case with Data Points

If there are plain text passwords in traffic records with a public source IP address (srcip) or destination IP address (dstip), an alert is triggered. A sample Interflow includes the source IP address (srcip), destination IP address (dstip), source host (srcip_host), destination host (dstip_host), and application (appid_name).

Analytics

Internal Protocol Account Login Failure Anomaly

An anomalously large number of login failures over SMB or FTP was observed. Check with the user.

XDR Kill Chain

Kill Chain Stage: Propagation
Tactic: [Internal] Credential Access (TA0006 )
Technique: Brute Force (T1110 )
Tags: [Internal; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_protocol_account_login_failure.

Key Fields and Relevant Data Points

Use Case with Data Points

metadata.request.username — user name in the HTTP connection request
protocol_account — account user ID
event_summary.total_failed — number of failed logins in the period
event_summary.total_successful — number of successful logins in the period
event_summary.total_fail_ratio — percent of failed logins in the period, which is: event_summary.total_failed / (event_summary.total_failed + event_summary.total_successful)
accumulated_anomalous_failures — score value of the model indicating the degree of abnormal activity
appid_name — application name
login_type — type of login
srcip_host — host name of corresponding source IP address
srcip_reputation — source reputation

Unsupervised

Internal PUA

Unwanted applications or malware that bombards the user with advertisements in internal traffic has been detected. Check with the user.

XDR Kill Chain

Kill Chain Stage: Propagation
Tactic: [Internal] XDR Malware (XTA0006)
Technique: XDR PUA (XT6002)
Tags: [Internal; Malware]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_pua.

Key Fields and Relevant Data Points

ids.signature — IDS signature
maltrace-cloud.data.malicious_activity — malicious activity
actual — number of records for one IDS signature or malicious activity in the period
lateral — boolean, indicating whether this activity is lateral (from private to private)
srcip_host — source host name
srcip_geo.countryName — source country
dstip_host — destination host name
dstip_geo.countryName — destination country
file_name — name of the file that carries the PUA
event_source — source of the event, either ids or sandbox

Use Case with Data Points

If ML-IDS or sandbox indicates potentially unwanted applications (PUA) in internal traffic, an alert is triggered. A sample Interflow includes malicious activity for sandbox (maltrace-cloud.data.malicious_activity), IDS signature for ML-IDS (ids.signature), event source (event_source), source host (srcip_host), source country (srcip_geo.countryName), destination host (dstip_host), destination country (dstip_geo.countryName), and the name of the file that carries the PUA (file_name) from the sandbox.

Analytics

Internal Ransomware

Malware that prevents you from accessing your system or files and demands ransom payment in order to regain access in internal traffic was detected. Check with the user.

XDR Kill Chain

Kill Chain Stage: Exfiltration & Impact
Tactic: [Internal] Impact (TA0040 )
Technique: Data Encrypted for Impact (T1486 )
Tags: [Internal; Malware; Ransomware]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_ransomware.

Key Fields and Relevant Data Points

ids.signature — IDS signature
maltrace-cloud.data.malicious_activity — malicious activity
actual — number of records for one IDS signature or malicious activity in the period
lateral — boolean, indicating whether this activity is lateral (from private to private)
srcip_host — source host name
srcip_geo.countryName — source country
dstip_host — destination host name
dstip_geo.countryName — destination country
file_name — name of the file that carries the ransomware
event_source — source of the event, either ids or sandbox

Use Case with Data Points

If ML-IDS or sandbox indicates ransomware in internal traffic, an alert is triggered. A sample Interflow includes malicious activity for sandbox (maltrace-cloud.data.malicious_activity), IDS signature for ML-IDS (ids.signature), event source (event_source), source host (srcip_host), source country (srcip_geo.countryName), destination host (dstip_host), destination country (dstip_geo.countryName), and the name of the file that carries the ransomware (file_name) from the sandbox.

Analytics

Internal RDP Brute Force Attack

An anomalously large number of RDP connections from internal host(s) to an RDP server was observed. Check the source IP addresses to see if they are unknown or malicious, and monitor any successful RDP logins.

XDR Kill Chain

Kill Chain Stage:Propagation
Tactic: [Internal] Credential Access (TA0006 )
Technique: Brute Force (T1110 )
Tags: [Internal; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_rdp_brute_force.

Key Fields and Relevant Data Points

dstip — IP address of the destination RDP server
actual — actual number of RDP connections to the destination IP address in the period
typical — typical number of RDP connections to the destination IP address in the period
srcip — source IP address

Use Case with Data Points

RDP connection activity is monitored and the number of connections calculated periodically. If the number of connections from internal host(s) to an RDP server (actual) is much greater than normal (typical), an alert is triggered. A sample Interflow includes the destination IP address (dstip) and source IP address (srcip).

Unsupervised

Internal RDP Suspicious Outbound

Non-standard tools from an internal host connecting to TCP port 3389 in the other internal host were detected. This could indicate lateral movement attempting to establish an RDP connection. Check the IP address and block if necessary.

XDR Kill Chain

Kill Chain Stage: Propagation
Tactic: [Internal] Lateral Movement (TA0008)
Technique: Remote Services (T1021)
Tags: [Internal; RDP]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_rdp_suspicious_outbound.

Key Fields and Relevant Data Points

srcip — source IP address of the host that connects to TCP port 3389 with a non-standard tool
srcip_host — source host name
process_name — process name

Use Case with Data Points

mstsc.exe
RTSApp.exe
RTS2App.exe
RDCMan.exe
ws_TunnelService.exe
RSSensor.exe
RemoteDesktopManagerFree.exe
RemoteDesktopManager.exe
RemoteDesktopManager64.exe
mRemoteNG.exe
mRemote.exe
Terminals.exe
spiceworks-finder.exe
FSDiscovery.exe
FSAssessment.exe
MobaRTE.exe
chrome.exe
thor.exe
thor64.exe

Analytics

Internal Scanner Behavior Anomaly

An anomalously large amount of scanning behavior between internal hosts was identified. Cross-check with the IP/Port Scan Anomaly alert.

XDR Kill Chain

Kill Chain Stage: Exploration
Tactic: [Internal] Discovery (TA0007 )
Technique: Network Service Scanning (T1046 )
Tags: [Internal; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_scan_anomalies.

Key Fields and Relevant Data Points

ids.signature — signature of the exploit
actual — actual number of times this signature was found in the period, with critical IDS signatures counted as 2, high counted as 1, low counted as 0.5, and others counted as 1
typical — typical number of times this signature is seen in the period, with critical IDS signatures counted as 2, high counted as 1, low counted as 0.5, and others counted as 1
srcip_host — host name of corresponding source IP address
dstip_host — host name of corresponding destination IP address
appid_name — application name

Use Case with Data Points

The number of occurrences of each scanner, based on IDS signature (ids.signature) between internal hosts, is calculated periodically. If one scanner occurs (actual) much more often compared to its history (typical), an alert is triggered. A sample Interflow is presented with information such as the traffic application type (appid_name), source host (srcip_host), and destination host (dstip_host).

Unsupervised

Internal SMB Read Anomaly

An internal IP address sent an anomalously large number of SMB read requests. Investigate the files that the IP address tried to read. If suspicious, block the source IP address.

XDR Kill Chain

Kill Chain Stage: Propagation
Tactic: [Internal] Lateral Movement (TA0008 )
Technique: Exploitation of Remote Services (T1210 )
Tags: [Internal; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_smb_read_anomaly.

Key Fields and Relevant Data Points

srcip — source IP address
actual — actual number of SMB reads from the source IP address in the period
typical — typical number of SMB reads from other source IP addresses in the period
dstip_host — destination host name
smb_username — SMB user name

Use Case with Data Points

The number of SMB read requests for every internal source IP address (srcip) is calculated periodically. If a source IP address’s number of SMB reads (actual) is much larger than the typical number (typical) and that of other IP addresses in any period, an alert is triggered. The Interflow includes the SMB user (smb_username) and destination host (dstip_host).

Unsupervised

Internal SMB Username Enumeration

At least 5 different users SMB login attempts and 1 denied attempt or at least 10 different users SMB login attempts, were detected from an internal IP address to other internal IP address(es). Check the source IP address. If malicious, consider blocking it.

XDR Kill Chain

Kill Chain Stage: Propagation
Tactic: [Internal] Credential Access (TA0006 )
Technique: Brute Force (T1110 )
Tags: [Internal; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_smb_user_scan.

Key Fields and Relevant Data Points

srcip — source IP address
srcip_host — host name of corresponding source IP address
dstip_host — host name of corresponding destination IP address
actual — actual unique SMB user count
threshold — SMB user count threshold
smb_username_set — all SMB login user names

Use Case with Data Points

If an internal source IP address (srcip) has several SMB login attempts with (1) at least 5 unique user names and at least 1 denied attempt or (2) at least 10 unique user names, an alert is triggered. A sample Interflow includes the source IP address (srcip), source host (srcip_host), destination host (dstip_host), and all the user names (smb_username_set).

Analytics

Internal SMB Write Anomaly

An internal IP address sent an anomalously large number of SMB write requests to other internal IP address(es). Investigate the files that the IP address tried to write. If suspicious, block the source IP address.

XDR Kill Chain

Kill Chain Stage: Propagation
Tactic: [Internal] Lateral Movement (TA0008 )
Technique: Remote Services (T1021 )
Tags: [Internal; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_smb_anomaly.

Key Fields and Relevant Data Points

srcip_host — source host name
actual — actual number of SMB writes in the period
typical — typical number of SMB writes in the period
dstip_host — destination host name
smb_username — SMB user name

Use Case with Data Points

The number of SMB write requests to internal IP address(es) for every internal source IP address (srcip_host) is calculated periodically. If a source IP address’s number of SMB writes (actual) is much larger than the typical number (typical) and that of other IP addresses in any period, an alert is triggered. The Interflow includes the SMB user (smb_username) and destination host (dstip_host).

Unsupervised

Internal Spyware

Malware that collects and shares information about a device without consent in internal traffic was detected. Check with the user.

XDR Kill Chain

Kill Chain Stage: Propagation
Tactic: [Internal] XDR Malware (XTA0006)
Technique: XDR Spyware (XT6003)
Tags: [Internal; Malware]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_spyware_activity.

Key Fields and Relevant Data Points

ids.signature — IDS signature
maltrace-cloud.data.malicious_activity — malicious activity
actual — number of records for one IDS signature or malicious activity in the period
lateral — boolean, indicating whether this activity is lateral (from private to private)
srcip_host — source host name
srcip_geo.countryName — source country
dstip_host — destination host name
dstip_geo.countryName — destination country
file_name — name of the file that carries the spyware
event_source — source of the event, either ids or sandbox

Use Case with Data Points

If ML-IDS or sandbox indicates spyware activity in internal traffic, an alert is triggered. A sample Interflow includes malicious activity for sandbox (maltrace-cloud.data.malicious_activity), IDS signature for ML-IDS (ids.signature), event source (event_source), source host (srcip_host), source country (srcip_geo.countryName), destination host (dstip_host), destination country (dstip_geo.countryName), and the name of the file that carries the spyware (file_name) from the sandbox.

Analytics

Internal SQL Anomaly

An internal IP address sent an anomalously large number of queries to an internal SQL server. Investigate the queries. If suspicious, block the source IP address.

XDR Kill Chain

Kill Chain Stage: Propagation
Tactic: [Internal] Lateral Movement (TA0008 )
Technique: Exploitation of Remote Services (T1210 )
Tags: [Internal; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_mysql_anomaly.

Key Fields and Relevant Data Points

srcip — source IP address
srcip_host — source host name
srcip_geo.countryName — source country
actual — actual number of SQL queries in the period
typical — typical number of SQL queries from the source IP address
dstip_host — destination host name

Use Case with Data Points

The number of SQL queries for every internal source IP address (srcip_host) is calculated periodically. If an internal source IP’s SQL query count (actual) is much larger than the typical count (typical) and that of other internal IP addresses in any period, an alert is triggered. The internal source IP’s country is (srcip_geo.countryName). The Interflow includes the internal destination host (dstip_host) the source IP visits.

Unsupervised

Internal SQL Dumpfile Execution

The SQL dumpfile command was detected. This command is commonly used to dump database content or query output to a file on disk. Check with the user.

XDR Kill Chain

Kill Chain Stage: Exploration
Tactic: [Internal] Collection (TA0009 )
Technique: Data Staged (T1074 )
Tags: [Internal; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_sql_db_dump.

Key Fields and Relevant Data Points

srcip — source IP address
actual — number of SQL dumpfile queries
srcip_host — source host name
source_geo.countryName — source country
dstip_host — destination host name

Use Case with Data Points

If any SQL dumpfile commands are detected between an internal source IP address (srcip) and an internal destination IP address (dstip), an alert is triggered. A sample Interflow includes the source IP address (srcip), source host (srcip_host), source country (srcip_geo.countryName), destination host (dstip_host), and the number of SQL dumpfile queries in the period (actual).

Analytics

Internal SQL Shell Command

Shell commands were detected over a SQL connection, which is a common way hackers try to gain shell access over vulnerable SQL applications. Check with the user.

XDR Kill Chain

Kill Chain Stage: Persistent Foothold
Tactic: [Internal] Execution (TA0002 )
Technique: Command and Scripting Interpreter (T1059 )
Tags: [Internal; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_database_command.

Key Fields and Relevant Data Points

srcip — source IP address
dstip — destination IP address
srcip_host — source host name
srcip_reputation — source reputation
dstip_host — destination host name
dstip_reputation — destination reputation
metadata.request.query — SQL query command
actual — number of query records from one source to one destination in one period

Use Case with Data Points

Analytics

Internal Suspected Malicious User Agent

An internal HTTP connection was made by a user agent that has been identified as potentially malicious. Investigate the connection's destination.

This alert type has two subtypes:

Predicted Malicious Agent
Known Malicious Agent Match

XDR Kill Chain

Kill Chain Stage: Exploration
Tactic: [Internal] XDR NBA (XTA0002)
Technique: XDR User Agent Anomaly (XT2012)
Tags: [Internal; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_suspected_malicious_user_agent.

Key Fields and Relevant Data Points

metadata.request.user_agent — user agent in the HTTP connection request
stellar.confidence — model's confidence in the prediction used to make the alert
srcip_host — host name of corresponding source IP address
dstip_host — host name of corresponding destination IP address
appid_name — application name

Use Case with Data Points

If a seen user agent is identified as suspicious, an alert is triggered. The alert will contain the suspicious user agent (metadata.request.user_agent), confidence (stellar.confidence), tenant (tenant_name), source IP (srcip), and destination IP (dstip) in the key fields. Additionally, the confidence level of the model is displayed in the alert description in a pop-up box.

Alert Subtype: Predicted Malicious Agent

The Predicted Malicious Agent alert subtype is the same as the Internal Suspected Malicious User Agent alert type above, with the following differences:

The stellar.anomaly_tag is predicted_internal.
The xdr_event.subtype.name is internal_suspected_malicious_user_agent.
It is triggered by a machine learning classifier.

Alert Subtype: Known Malicious Agent Match

The Known Malicious Agent Match alert subtype is the same as the Internal Suspected Malicious User Agent alert type above, with the following differences:

The stellar.anomaly_tag is known_internal.
The xdr_event.subtype.name is internal_suspected_malicious_user_agent_known_malicious.
It is triggered by known threats.

Supervised

Internal SYN Flood Attacker

An internal attacker sends a large amount of SYN requests to internal target system(s) in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic.

XDR Kill Chain

Kill Chain Stage: Exfiltration & Impact
Tactic: [Internal] Impact (TA0040 )
Technique: Endpoint Denial of Service (T1499 )
Tags: [Internal; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_syn_flood_attacker.

Key Fields and Relevant Data Points

srcip — source IP address of the SYN flood
srcip_host — source host name
dstip — target IP address of the SYN flood
dstip_host — destination host name
dstport — port on target host that received the SYN flood
time_window.start — start time of the SYN flood
time_window.end — end time of the SYN flood
syn_flood_events — number of SYN packets during the period

Use Case with Data Points

If an internal host (srcip) sends too many SYN packets (syn_flood_events) to internal target(s) (dstip) in a certain period (time_window.start to time_window.end), an alert is triggered. The Interflow includes the IP address of the source host (srcip), the IP address of the target host (dstip), the port of the target host (dstport), the start time of the event (time_window.start), the end time of the event (time_window.end), and how many SYN packets were observed (syn_flood_events).

Analytics

Internal SYN Flood Victim

A large amount of SYN requests to an internal target were observed, which can indicate an attempt to consume server resources and make the target unresponsive. Check to see if the host is malicious or compromised. If so, consider blocking the source host.

XDR Kill Chain

Kill Chain Stage: Exfiltration & Impact
Tactic: [Internal] Impact (TA0040 )
Technique: Endpoint Denial of Service (T1499 )
Tags: [Internal; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_syn_flood.

Key Fields and Relevant Data Points

srcip — source IP address for the SYN flood
srcip_host — source host name
dstip — target IP address of the SYN flood
dstip_host — destination host name
dstport — port on target host that received the SYN flood
time_window.start — start time of the SYN flood
time_window.end — end time of the SYN flood
syn_flood_events — number of SYN packets during the period

Use Case with Data Points

If too many SYN packets (syn_flood_events from internal host(s) to an internal target (dstip) occur in a certain period (time_window.start to time_window.end), an alert is triggered. The Interflow includes the IP address of the source host (srcip), the IP address of target host (dstip), the port of the target host (dstport), the start time of the event (time_window.start), the end time of the event (time_window.end), and how many SYN packets were observed (syn_flood_events).

Analytics

Internal Trojan

Malware that disguises itself as legitimate software in order to gain access to a system or files in internal traffic has been detected. Check with the user.

XDR Kill Chain

Kill Chain Stage: Propagation
Tactic: [Internal] XDR Malware (XTA0006)
Technique: XDR Trojan (XT6004)
Tags: [Internal; Malware]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_trojan_activity.

Key Fields and Relevant Data Points

ids.signature — IDS signature
maltrace-cloud.data.malicious_activity — malicious activity
actual — number of records for one IDS signature or malicious activity in the period
lateral — boolean, indicating whether this activity is lateral (from private to private)
srcip_host — source host name
srcip_geo.countryName — source country
dstip_host — destination host name
dstip_geo.countryName — destination country
file_name — name of the file that carries the trojan
event_source — source of the event, either ids or sandbox

Use Case with Data Points

If ML-IDS or sandbox indicates trojan activity in internal traffic, an alert is triggered. A sample Interflow includes malicious activity for sandbox (maltrace-cloud.data.malicious_activity), IDS signature for ML-IDS (ids.signature), event source (event_source), source host (srcip_host), source country (srcip_geo.countryName), destination host (dstip_host), destination country (dstip_geo.countryName), and the name of the file that carries the trojan (file_name) from the sandbox.

Analytics

Internal URL Reconnaissance Anomaly

An anomalous number of HTTP 4xx errors from an internal IP address to other internal IP addresses was detected. This can indicate an attacker scanning for pages to exploit. Check with the user.

XDR Kill Chain

Kill Chain Stage: Exploration
Tactic: [Internal] Discovery (TA0007 )
Technique: Network Service Scanning (T1046 )
Tags: [Internal; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_url_scan.

Key Fields and Relevant Data Points

srcip — source IP address
event_summary.total_failed — number of unique URLs with HTTP error status response in the period
event_summary.total_successful — number of unique URLs with HTTP success status response in the period
event_summary.total_fail_ratio — percent of unique URLs with HTTP error status response in the period, which is: event_summary.total_failed / (event_summary.total_failed + event_summary.total_successful)
accumulated_anomalous_failures — score value of the model indicating the degree of abnormal activity
srcip_host — host name of corresponding source IP address
dstip_host — host name of corresponding destination IP address
srcip_geo.countryName — source country name

Use Case with Data Points

For each internal source IP address (srcip), the number of unique URLs that responded with failure HTTP status and the number of unique URLs that responded with success HTTP status are calculated periodically. If the fail metric is significantly larger than the success metric, an alert is triggered. A sample Interflow includes the source host (srcip_host), destination host (dstip_host), and source country (srcip_geo.countryName).

Unsupervised

Internal User Agent Anomaly

An internal HTTP connection was made by an internal user agent that has never been observed by Stellar Cyber(or been seen very rarely). Investigate the connection destination.

XDR Kill Chain

Kill Chain Stage: Exploration
Tactic: [Internal] XDR NBA (XTA0002)
Technique: XDR User Agent Anomaly (XT2012)
Tags: [Internal; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_user_agent_anomaly.

Key Fields and Relevant Data Points

metadata.request.user_agent — user agent in the HTTP connection request
days_silent — number of days since this user agent was last seen
srcip_host — host name of corresponding source IP address
dstip_host — host name of corresponding destination IP address
appid_name — application name

Use Case with Data Points

All user agents (metadata.request.user_agent) with internal HTTP connections having names that do not begin with "Mozilla" or "Aella" are examined. An alert is triggered if any of those agents have not been observed by Stellar Cyber before or have been silent for many days (days_silent). The Interflow includes all information from the suspicious HTTP connection, such as the application (appid_name), the source host name (srcip_host), and the destination host name (dstip_host).

Unsupervised

Internal User Application Usage Anomaly

An internal user who usually runs a few applications with internal service IP addresses suddenly runs a new application. Investigate the application, to see if it is benign. Check with the user to see if this was expected.

XDR Kill Chain

Kill Chain Stage: Propagation
Tactic: [Internal] XDR UBA (XTA0004)
Technique: XDR App Anomaly (XT2003)
Tags: [Internal; User Behavior Analytics]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_user_uncommon_app.

Key Fields and Relevant Data Points

srcip_usersid — source user ID
appid_name — application name
srcip_host — host name of corresponding source IP address
dstip_host — host name of corresponding destination IP address
appid_family — application family
srcip_username — source user name
stability — score measuring the time since the last new application was used
days_stable — time since the last new application was used
diversity — score measuring the number of applications that the user used
child_count — number of applications that the user used

Use Case with Data Points

An alert is triggered under the following conditions:

a user (srcip_usersid, srcip_username) with a small number of applications (diversity, child_count) who has not used a new application for a long period of time (stability, days_stable), and then
a new application (appid_name) belonging to an application family (appid_family) appears on a host (scrip_host) with this user, and
that host connects to another host (scrip_host)

Unsupervised

Internal User Data Volume Anomaly

A user had an anomalously large volume of internal traffic compared to its typical volume or that of its peers. Investigate the user to determine if this is expected.

Firewall and non-firewall data do not contribute to the same alert, so this alert will have either entirely firewall data or no firewall data.

XDR Kill Chain

Kill Chain Stage: Propagation
Tactic: [Internal] XDR UBA (XTA0004)
Technique: XDR Bytes Anomaly (XT3001)
Tags: [Internal; User Behavior Analytics]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_user_bytes_sum.

Key Fields and Relevant Data Points

srcip_usersid — source user ID
actual — actual traffic volume in the period
typical — typical traffic volume from the user
srcip_host — host name of corresponding source IP address
srcip_username — source user name
dstip_host — host name of corresponding destination IP address
dstip_reputation — destination reputation
dstip_geo.countryName — destination country
appid_name — application name

Use Case with Data Points

The total internal traffic volume of each user identified by user ID (scrip_usersid) is calculated periodically. If the volume in one period (actual) is much larger than its normal volume (typical), an alert is triggered.

The Interflow includes the source IP address (srcip_host), destination IP address (dstip_host), destination reputation (dstip_reputation), destination country (dstip_geo.countryName), and application of the traffic (appid_name).

Unsupervised

Internal User Login Failure Anomaly

An anomalous number of login failures between internal IP addresses was observed for one of the following applications: SSH, SMTP, FTP, RDP, SMB, databases, Active Directory, Office 365, Okta, AWS CloudTrail, Google Workspace, Salesforce, or Microsoft Entra ID (formerly Azure AD). Check with the user.

This alert type has a relatively long detection delay of up to 40 minutes because it waits for login events from high latency data sources and is sensitive to the event order of user logins.

XDR Kill Chain

Kill Chain Stage: Propagation
Tactic: [Internal] Credential Access (TA0006 )
Technique: Brute Force (T1110 )
Tags: [Internal]

Event Name

The xdr_event.name for this alert type in the Interflow data is internal_user_login_fail.

Key Fields and Relevant Data Points

srcip — source IP address
dstip — destination IP address
dstip_host — destination host name
service_id — source domain, workstation, organization, or service
event_summary.total_failed — number of failed logins in the period
event_summary.total_successful — number of successful logins in the period
event_summary.total_fail_ratio — percent of failed logins in the period, which is: event_summary.total_failed / (event_summary.total_failed + event_summary.total_successful)
accumulated_anomalous_failures — score value of the model indicating the degree of abnormal activity
login_type — type of login, such as ssh_traffic, okta_log, or aws_cloudtrail
srcip_host — source host name
srcip_reputation — source reputation

Use Case with Data Points

Login failures and successes between internal IP addresses are calculated periodically for every source (srcip) and destination (dstip) IP address. If the number of failures is significantly larger than the number of successes, an alert is triggered. The Interflow includes the login type (login_type), source host (srcip_host), and source reputation (srcip_reputation).

Unsupervised

Analytics

Mimikatz DCSync

An attempt to replicate Active Directory for the first time on a domain controller, or the first time by that account, has occurred. Evaluate whether the replication is intended and, if not, consider disabling the account involved in the replication and investigate for further signs of compromise.

XDR Kill Chain

Kill Chain Stage: Propagation
Tactic: [Internal] Credential Access (TA0006 )
Technique: OS Credential Dumping (T1003 )
Tags: [Internal, Active Directory]

Event Name

The xdr_event.name for this alert type in the Interflow data is mimikatz_dcsync.

Key Fields and Relevant Data Points

hostip — IP address of the targeted domain controller
event_data.SubjectUserSid — source user ID associated with the account attempting replication
hostip_host — host name of the targeted domain controller
event_data.SubjectUserName — name of the account that attempted the Active Directory replication
event_data.SubjectDomainName — domain of the account that attempted the Active Directory replication

Use Case with Data Points

This alert is triggered when replication of an Active Directory domain controller (hostip) occurs for the first time or is attempted by a user account or computer account (event_data.SubjectUserName) that has rarely occurred (days_silent) or never initiated replication on that DC before. The Interflow includes the IP address of the targeted domain controller (hostip), the account (event_data.SubjectUserName) attempting the replication and its domain (event_data.SubjectDomainName), and the replication operation attempted (event_data.Properties). (For guidance understanding the GUID in the event_data.Properties field, refer to Microsoft Documentation.)

Validation / Remediation

To triage an alert of this type, consider first verifying whether the Active Directory replication event was expected. If the replication is not intended, then the alert has indicated that a DCSync attack is highly likely. This attack can be very severe, because all password hashes stored on the targeted domain controller might have been dumped. Disable the account involved in the replication as soon as possible and further investigate the account for any signs of compromise.

There is no simple remediation for a confirmed DCSync attack. Evaluate the overall risks of credential leakage and apply appropriate corrective actions, including minimizing accounts with permissions to perform Active Directory replication, and forcing a change of credentials for accounts with weak passwords.

Potential False Positives

The following will trigger an alert:

Set up of a new DC
Replication of a DC for the first time

Analytics

Office 365 Access Governance Anomaly

This alert type is deprecated as of the 4.3.7 release. It is replaced by Microsoft 365 alert integration. See Microsoft 365: Valid Accounts (Privilege Escalation) and Microsoft 365: Account Manipulation.

Office 365 generated an access governance alert, which might indicate a change in Exchange admin privileges. Check with the user to make sure this was expected.

XDR Kill Chain

Kill Chain Stage: Propagation
Tactic: Privilege Escalation (TA0004 )
Technique: Valid Accounts (T1078 )
Tags: []

Event Name

The xdr_event.name for this alert type in the Interflow data is office365_access_governance_alert.

Key Fields and Relevant Data Points

srcip_usersid — key ID for the Office 365 account
Name — alert type description
Source — source that generated the alert seen by Stellar Cyber
srcip — source IP address

Use Case with Data Points

For each Office 365 account (srcip_usersid), access governance alerts detected by Office 365 are checked periodically. If Office 365 finds an access governance alert, an alert is triggered. A sample Interflow includes the account ID (srcip_usersid), this alert type description (Name),the alerting source (Source), and source IP address (srcip).

Analytics

Office 365 Blocked User

This alert type is deprecated as of the 4.3.7 release. It is replaced by Microsoft 365 alert integration. See Microsoft 365: Valid Accounts (Initial Access).

The Office 365 Security Compliance Center discovered a user exceeding the sending limits of the service or outbound spam policies and blocked the user from sending email. Check with the user.

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [External] XDR UBA (XTA0004)
Technique: XDR Suspicious User (XT4008)
Tags: [External]

Event Name

The xdr_event.name for this alert type in the Interflow data is office365_blocked_user.

Key Fields and Relevant Data Points

srcip_usersid — key ID for the Office 365 account
Source — alerting source
srcip — source IP address of the account

Use Case with Data Points

Office 365 monitors email sending actions for each Office 365 account (srcip_usersid). If an account exceeds the sending limit, an alert is triggered. A sample Interflow includes the account ID (srcip_usersid), alerting source (Source), and source IP address (srcip).

Analytics

Office 365 Data Exfiltration Attempt Anomaly

This alert type is deprecated as of the 4.3.7 release. It is replaced by Microsoft 365 alert integration. See Microsoft 365: Exfiltration Over Web Service.

The Office 365 Security Compliance Center discovered a data exfiltration attempt. Office 365 then blocked, quarantined, encrypted, or applied a hold on the possible exfiltration. Check with the user.

XDR Kill Chain

Kill Chain Stage: Exfiltration & Impact
Tactic: Exfiltration (TA0010 )
Technique: Exfiltration Over Web Service (T1567 )
Tags: []

Event Name

The xdr_event.name for this alert type in the Interflow data is office365_data_exfiltration_attempt.

Key Fields and Relevant Data Points

srcip_usersid — key ID for the Office 365 account
Name — alert type description
Source — reporting source
srcip — source IP address

Use Case with Data Points

Office 365 periodically checks each Office 365 account (srcip_usersid) for data exfiltration attempts. If data exfiltration is detected, an alert is triggered. A sample Interflow includes the account ID (srcip_usersid), this alert type description (Name), reporting source (Source), and source IP address (srcip).

Analytics

Office 365 Data Loss Prevention

This alert type is deprecated as of the 4.3.7 release. It is replaced by Microsoft 365 alert integration. See Microsoft 365: Exfiltration Over Web Service.

The Office 365 Security Compliance Center discovered data loss. Office 365 then blocked, quarantined, encrypted, or applied a hold on the possible exfiltration. Check with the user.

XDR Kill Chain

Kill Chain Stage: Exfiltration & Impact
Tactic: Exfiltration (TA0010 )
Technique: Exfiltration Over Web Service (T1567 )
Tags: []

Event Name

The xdr_event.name for this alert type in the Interflow data is office365_data_loss_prevention.

Key Fields and Relevant Data Points

srcip_usersid — key ID for the Office 365 account
Name — alert type description
Source — reporting source
srcip — source IP address

Use Case with Data Points

Office 365 periodically checks each Office 365 account (srcip_usersid) for data loss. If data loss is detected, an alert is triggered. A sample Interflow includes the account ID (srcip_usersid), this alert type description (Name), reporting source (Source), and source IP address (srcip).

Analytics

Unsupervised

Analytics

Unsupervised

Analytics

RDP Suspicious Logon

An RDP logon with a local source IP address was detected. This could indicate a tunneled logon. Check with the user.

XDR Kill Chain

Kill Chain Stage: Persistent Foothold
Tactic: Command and Control (TA0011 )
Technique: Protocol Tunneling (T1572 )
Tags: [RDP]

Event Name

The xdr_event.name for this alert type in the Interflow data is rdp_suspicious_logon.

Key Fields and Relevant Data Points

hostip — host IP address of the RDP server
event_data.TargetDomainName — domain of the login account
event_data.TargetUserName — user name of the login account
hostip_host — host name of the RDP server

Use Case with Data Points

Remote desktop logins are monitored, and if a local source IP address is seen, an alert is triggered. A sample Interflow includes the source IP address (hostip) and host name (hostip_host).

Analytics

Unsupervised

Analytics

Unsupervised

Analytics

Unsupervised

Analytics

WAF Internal Attacker Anomaly

Internal web requests from a private IP address have been blocked/alerted by the Web Application Firewall (WAF). Investigate the source requester and ensure they are not compromised.

XDR Kill Chain

Kill Chain Stage: Exploration
Tactic: [Internal] XDR NBA (XTA0002)
Technique: XDR WAF Anomaly (XT2009)
Tags: [Internal]

Event Name

The xdr_event.name for this alert type in the Interflow data is waf_internal_attacker.

Key Fields and Relevant Data Points

srcip — source IP address
action — status of web requests
event.severity_str — severity level of web requests
event.uri — URI of the web request
event.reason — attack type (signature name)

The above fields are standardized to support a variety of WAFs. The original fields, listed below, remain in the F5 WAF Interflow record for backward compatibility.

List of F5 legacy fields

F5 Field Purpose	Original Stellar Cyber WAF Field Name	Standardized Stellar Cyber WAF Field Name
Signature ID	f5.sig_ids	event.sig_id
Signature name	f5.sig_names	event.reason
Staged signature ID	f5.staged_sig_ids	event.staged_sig_id
Staged signature ID	f5.staged_sig_names	event.staged_sig_name
Violation	f5.violations	event.violations
Sub violation	f5.sub_violations	event.sub_violations
Threat campaign	f5.threat_campaign_names	event.threat_campaign_names
Request status	f5.request_status	action
Severity	f5.severity	event.severity_str
Attack type	f5.attack_type	threat
Client IP	srcip	srcip service.origin.ip
Client Port	srcport	srcport service.origin.port
Service IP	dstip	dstip service.target.ip
Service Port	dstport	dstport service.target.port
Violation Details	f5.violation_details	event.description
Telemetry Event Category	f5.telemetryEventCategory	event.telemetry_event_category
url	f5.uri	event.uri
Web application name	f5.web_application_name	event.web_application_name

Use Case with Data Points

If web requests (f5.uri) from an internal IP address (srcip) to a web application (f5.web_application_name) have been blocked/alerted (f5.request_status) by the WAF, an alert is triggered. The Interflow includes the level of severity (f5.severity), the attack type (f5.attack_type), and the violation information (f5.violations), as well as signature name (f5.sig_names), staged signature name (f5.staged_sig_names), sub violation information (f5.sub_violations), and threat campaign name (f5.violation_details_xml.request-violations.violation.threat_campaign_data.threat_campaign_name), if applicable.

If web requests (event.uri) from an internal IP address ( srcip) to a web application (event.web_application_name) have been blocked/alerted (action) by the WAF, an alert is triggered. The Interflow includes the level of severity (event.severity_str), the attack type (threat), and the violation information (event.description), as well as signature name (event.reason). If applicable for the WAF type, the Interflow also includes staged signature name (event.staged_sig_id), sub violation information (event.sub_violations), and threat campaign name (event.threat_campaign.names).

Ingestion Types Supported for this Alert

F5 Big-IP Firewall
F5 Silverline WAF
Barracuda WAF
AWS CloudWatch WAF

Analytics

WAF Rule Violation Anomaly

Web requests have been blocked/alerted by the supported Web Application Firewalls (WAF) due to a surge in violations or violating a rule that is rarely invoked. Investigate the blocked/alerted web requests and ensure they are benign.

Refer to Log Parser Ports for the most current list of WAF parsers.

XDR Kill Chain

Kill Chain Stage: Initial Attempts
Tactic: [External] XDR NBA (XTA0002)
Technique: XDR Rule Violation (XT2004)
Tags: [External; Network Traffic Analysis]

Event Name

The xdr_event.name for this alert type in the Interflow data is waf_rule_violation.

Key Fields and Relevant Data Points

srcip — source IP address
action — status of web requests
event.severity_str — severity level of web requests
event.web_application_name — web application name
event.uri — URI of the web request
event.reason — attack type (signature name)
event.sig_id — attack type (signature ID)
actual — actual number of specific WAF violations in the period
typical — typical number of specific WAF violations in the period

The above fields are standardized to support a variety of WAFs. The original fields, listed below, remain in the F5 WAF Interflow record for backward compatibility.

List of F5 legacy fields

F5 Field Purpose	Original Stellar Cyber WAF Field Name	Standardized Stellar Cyber WAF Field Name
Signature ID	f5.sig_ids	event.sig_id
Signature name	f5.sig_names	event.reason
Staged signature ID	f5.staged_sig_ids	event.staged_sig_id
Staged signature ID	f5.staged_sig_names	event.staged_sig_name
Violation	f5.violations	event.violations
Sub violation	f5.sub_violations	event.sub_violations
Threat campaign	f5.threat_campaign_names	event.threat_campaign_names
Request status	f5.request_status	action
Severity	f5.severity	event.severity_str
Attack type	f5.attack_type	threat
Client IP	srcip	srcip service.origin.ip
Client Port	srcport	srcport service.origin.port
Service IP	dstip	dstip service.target.ip
Service Port	dstport	dstport service.target.port
Violation Details	f5.violation_details	event.description
Telemetry Event Category	f5.telemetryEventCategory	event.telemetry_event_category
url	f5.uri	event.uri
Web application name	f5.web_application_name	event.web_application_name

Use Case with Data Points

If web requests (event.uri) to a web application ( event.web_application_name) have been blocked/alerted (action) by the WAF due to violating certain rules, which include the level of severity (event.severity_str), the attack type (threat), and the violation information (event.violations). If the violations (actual) surge compared to the normal number of violations in a period (typical), an alert is triggered.

Ingestion Types Supported for this Alert

F5 Big-IP Firewall
F5 Silverline WAF
Barracuda WAF
AWS CloudWatch WAF

Unsupervised

Alert Type Model Summary

Abnormal Parent / Child Process

XDR Kill Chain

Event Name

Key Fields and Relevant Data Points

Use Case with Data Points

Key Fields and Relevant Data Points

Link to Rule-Based Alert Types

Account MFA Login Failure Anomaly

XDR Kill Chain

Event Name

Key Fields and Relevant Data Points

Use Case with Data Points

Key Fields and Relevant Data Points

Link to Rule-Based Alert Types

Application Usage Anomaly

XDR Kill Chain

Event Name

Key Fields and Relevant Data Points

Use Case with Data Points

AWS AMI Made Public

XDR Kill Chain

XDR Event Name

Key Fields and Relevant Data Points

Use Case with Data Points

AWS Logging Stopped

XDR Kill Chain

Event Name

Key Fields and Relevant Data Points

Use Case with Data Points

AWS S3 Ransomware

XDR Kill Chain

Event Name

Key Fields and Relevant Data Points

Use Case with Data Points

Azure AD Apps Modified To Allow Multi-Tenant Access

XDR Kill Chain

Event Name

Key Fields and Relevant Data Points

Use Case with Data Points

Azure AD Custom Domains Changed

XDR Kill Chain

Event Name

Key Fields and Relevant Data Points

Use Case with Data Points

Backup Catalogs Deleted by Ransomware

XDR Kill Chain

Event Name

Key Fields and Relevant Data Points

Use Case with Data Points

Bad Destination Reputation Anomaly

XDR Kill Chain

Event Name

Key Fields and Relevant Data Points

Use Case with Data Points

Bad Reputation Login

XDR Kill Chain

Event Name

Key Fields and Relevant Data Points

Use Case with Data Points

Bad Source Reputation Anomaly

XDR Kill Chain

Event Name

Key Fields and Relevant Data Points

Use Case with Data Points

Carbon Black: XDR Anomaly

XDR Kill Chain

Event Name

Key Fields and Relevant Data Points

Use Case with Data Points

Command & Control Reputation Anomaly

XDR Kill Chain

Event Name

Key Fields and Relevant Data Points

Use Case with Data Points

Command Anomaly

XDR Kill Chain

Event Name

Key Fields and Relevant Data Points

Use Case with Data Points