Alert Rules
Enhancement
Browser Credential File Access on Linux
Disk Image or Container File Downloaded via Outlook
Malicious Email Attachment Detected by Microsoft Defender for Office 365
Malicious Email Detected by Microsoft Defender for Office
Office 365 Safe Links Warning Bypassed
Office365 OAuth Consent or Device Code Phishing URL Clicked
Office365 Suspicious OAuth Application Permission Granted
Office365 User-Reported Phishing or Malware Email
Rclone File Upload Activity on Windows and Linux
Registry key Deleted by Suspicious Process
Registry Symbolic Link Value Modified
Suspicious Access to GNOME Keyring Files
Suspicious File Creation in Removable Drive Root
Suspicious File Downloaded from Teams
Suspicious Find Execution on Unix
Suspicious Process Spawned with System Privilege
System Named Pipe Creation by Non-System Process
USB Device Connection Detected
USB Device Insertion Detected via Registry Modification
Windows Directory Environment Variable Modified
Updated query and description of the following alert rules:
Potential Data Exfiltration via Curl
MEGA Client File Upload Activity on Windows
Suspicious Child Process Creation via OneNote
Suspicious Double Extension Detected
Entra ID Device Code Authentication Detected
RClone Utility Execution
Suspicious Outbound RDP Connections Detected
Virtual Machine Environment Discovery via Process or Service Checks
Browser Credential Files Accessed
Chromeloader Cross-Process Injection to Load Extention
Cmdkey Cached Credentials Recon Detected
Regsvr32 Network Activity Detected
Suspicious Script Execution From Temp Folder
Virtualization Environment Discovery via WMI
CEO Fraud - Possible Fraudulent Email Behavior
Execution in Outlook Temp Folder Detected
Guardsix License Expiry Status
Default CPU Usage Status
Default Harddisk Usage Status
Default License Invalid
Default Memory Usage Status
Possible Insider Threat
Removed the following generic and redundant alert rules:
Adobe ColdFusion Remote Code Execution CVE-2018-15961 Attempt
Application Whitelisting Bypass via Dnx Detected
Application Whitelisting Bypass with DLL load via ODBC
BlueKeep Vulnerability CVE-2019-0708 Exploitation
CVE-2022-40684 Exploitation Detected
CVE-2024-38112 Exploitation Detected
Chrome Extension Installed with DevTools Permission
Citrix ADC VPN Directory Traversal Detected
Copyright Violation Email
Default Connection Attempts on Closed Port
Default IRC connection
Default License Grace State
Default Malware not Cleaned
Default Possible Cross Site Scripting Attack Detected
Default Possible Non-PCI Compliant Inbound Network Traffic Detected
Default Possible System Instability State Detected
Default TCP Probable SynFlood Attack
Default Unapproved Port Activity Detected
DenyAllWAF SQL Injection Attack
Drupal Arbitrary Code Execution Detected
EMC Possible Ransomware Detection
Endpoint Protect File Copied To USB Device
Endpoint Protect File Delete
Endpoint Protect Threat Content Detected
Exchange Remote Code Execution CVE-2020-0688 Attempt
Execution of Trojanized 3CX Application
Exfiltration over Cloud Application Detected
Exim Remote Command Execution Detected
Exploitation of CVE-2019-1388 Detected
Fail2ban IP Banned
Formbook Process Creation Detected
FortiGate Admin Login Disable
High Severity EPP Alert
Koadic Execution Detected
Malware Threat Connection from Malicious Source
Malware Threat Connection to Malicious Destination
Malware Threat Connection to Malicious URLs
Malware Threat Emails Sent to Attacker
Oracle WebLogic CVE-2021-2109 Exploitation
Petitpotam - Anonymous RPC and File Share
Possible Applocker Bypass Detected
Possible Malware Detected
Possible Outbound Spamming Detected
Possible User Account Control Bypass Detected
Potential Phishing Attack Detected
Process Pattern Match For CVE-2021-40444 Exploitation
Proxy Execution of Payloads via Microsoft Signed Script
Proxy Execution via Desktop Setting Control Panel
Proxy Execution via Xwizard
Pulse Secure Arbitrary File Reading Detected
RDP Extension File Dropped in Outlook Folder
RDP Over Reverse SSH Tunnel Detected
RSA SecurID Account Lockout
RSA SecurID Passcode Reuse
SSHD Connection Denied
SolarisLDAP Group Remove from LDAP Detected
SolarisLDAP Possible Bruteforce Attack Detected
Suspicious CLR Logs File Creation
Suspicious Certutil Command Detected
Suspicious Program Location with Network Connections
Suspicious Usage of Squirrel Binary
TerraMaster TOS CVE-2020-28188 Exploitation
Threat Intel Connections with Suspicious Domains
UAC Bypass via CMLUA or CMSTPLUA
Usage of Sysinternals Tools Detected
VBA DLL Loaded by Office
VM - High Risk Vulnerability on Low Impact Assets
VMware Link Down
VMware VSphere CVE-2021-21972 Exploitation
VMware View Planner CVE-2021-21978 Exploitation
WannaCry MS17-010 Vulnerable Sources
WannaCry Sources in Connections to Sinkhole Domain
ZoHo ManageEngine Desktop Central CVE-2020-10189 Exploitation Attempt
ZoHo ManageEngine Pre-Auth File Upload CVE-2019-8394 Exploitation Attempt
Zoho ManageEngine ADSelfService Plus CVE-2021-40539 Exploitation
Past Releases
Alert Rules v6.2.0 ▾
Enhancement
New Alert Rules are added to enhance threat detection, security events, and incident response.
- Microsoft 365 SharePoint or OneDrive Bulk Access via PowerShell Client
- Microsoft 365 SharePoint or OneDrive Mass File Download by User
- Microsoft 365 SharePoint Sensitive Keyword Search Discovery
- Office365 User Account Creation Followed by Admin Role Assignment
- Linux Firewall Policy or Rule Modification
- Linux Firewall Service Disabled or Stopped
- Python Spawning Shell with Suspicious Arguments
- System Check for Virtualization Environment
- Unix User Account Creation Detected via File Modification
- Unix User Account Creation via System Command
- Firewall Rule Modification via Netsh Detected
- MEGA Client File Upload Activity on Windows
- Network Connection to MEGA via MEGA Client on Windows
- Python Execution from Suspicious Location
- Python Inline Command Execution
- Remote File Upload via Restic on Windows
- RMM Tool Activity Detected on Windows
- Sensitive File and Directory Discovery on Windows
- Suspicious Eventlog Clear or Configuration Change Activity
- User Added to Privileged or Remote Access Group
- Virtual Machine Environment Discovery via Process or Service Checks
- Virtualization Environment Discovery via WMI
- Windows Credential Manager Access via VaultCmd
- Python Pth File Creation Detected
- EnableLinkedConnections Registry Modification
- Windows Firewall Disabled via Registry Modification
- User Account Creation with Suspicious Naming Pattern
- Windows Firewall Configuration Change
- Windows Firewall Tampering via PowerShell
- Windows Vault Enumeration Followed by Vault Credential Read
Updated query and description of the following Alert Rules:
- Always Install Elevated Windows Installer
- Child Process Spawned via Diskshadow
- Clipboard Data Access Detected
- Creation of Anonymous Sharing Link in SharePoint
- Curl Silent Mode Execution Detected
- Execution of Temporary Files via Office Application
- File Shared to Guest in SharePoint
- Firewall Disabled via Netsh Detected
- HackTool - PPID Spoofing SelectMyParent Tool Execution
- Large ICMP Traffic
- Microsoft Defender Disabling Attempt via PowerShell
- RDP Registry Modification
- Reconnaissance Activity with Nltest
- Startup Folder File Write
- Suspicious Child Process Spawned by Microsoft Office Product
- Suspicious LoadAssembly PowerShell Diagnostic Script Execution
- Suspicious Rundll32 Activity Detected
- Suspicious Script Execution From Temp Folder
- Suspicious Usage of Where Binary
- Use of Pcalua for Execution
- VM - High Risk Vulnerability on High Impact Assets
- VM - High Risk Vulnerability on Low Impact Assets
- VM - High Risk Vulnerability on Medium Impact Assets
- VM - Medium Risk Vulnerability on High Impact Assets
- VM - Medium Risk Vulnerability on Low Impact Assets
- VM - Medium Risk Vulnerability on Medium Impact Assets
- WinPwn PowerShell Script Block Detected
- Windows Service Stop or Delete
- Windows User Account Created via Command Line
Removed the following generic and redundant Alert Rules:
- Suspicious Eventlog Clear or Configuration Using Wevtutil Detected
- Firewall Rule Addition via Netsh Detected
- Script Interpreter Execution From Suspicious Folder
- Most Exploitable Vulnerabilities Detected
- Suspicious Invocation PowerShell Diagnostic Script Execution
Alert Rules v6.1.1 ▾
Enhancement
New Alert Rules are added to enhance threat detection, security events, and incident response.
Registry Disable System Restore
Registry Persistence Mechanisms in Recycle Bin
Sticky Keys Backdoor via Registry Modification
Security Product Reconnaissance through WMI
Use of Pcalua for Execution
WinPwn PowerShell Script Block Detected
Audit Policy Tampering via Auditpol
Suspicious Active Directory Enumeration via LDAP Command Line
Potential Data Exfiltration via Curl
Potential Browser Data Stealing
Rubeus PowerShell ScriptBlock Detected
RestrictedAdminMode Registry Value Tampering
WSUS Suspicious Child Process Execution
Suspicious PowerShell Embedded Payload Carving
Unsigned DLL Loaded by Windows Utility
Suspicious Velociraptor Execution
PowerShell Cryptography Namespace Invocation
Suspicious Child Process Spawned by Browsers
Suspicious Kerberos-Related DLL Loading
Updated query and description of the following Alert Rules:
LSASS Memory Dump Detected
Network Share Discovery
Reconnaissance using Windows Binaries Detected
Scheduled Task Creation Detected
System Network Connections Discovery
File Dropped in Suspicious Location
Suspicious Use of Findstr Detected
Suspicious Named Pipes Detected
Suspicious PowerShell Parameter Substring Detected
Execution of Base64 Encoded Command Using IEX
Suspicious Base64 Encoded PowerShell Command
Startup Folder File Write
Mimikatz Command Line Detected
Suspicious MSHTA Process Pattern
Suspicious PsExec Execution Detected
Reconnaissance Activity with Nltest
Bypass User Account Control using Registry
Registry Persistence Mechanisms Detected
Removed the following generic and redundant Alert Rules:
Encoded PowerShell Command Detected
Suspicious File Execution via MSHTA
Unsigned DLLs loaded by RunDLL32 or RegSvr32
Possible Command Prompt Process Hollowing
Alert Rules v6.1.0 ▾
Enhancement
Go to Alert Rules to learn more.
Alert Rules v6.0.0 ▾
Enhancement
Go to Alert Rhttps://docs.logpoint.com/docs/alert-rules/en/latest/ules to learn more.
Comments
Please sign in to leave a comment.