Security Evasion-Inventory Management
Last updated on:
In this page
About the rule
Rule Type
Advanced
Rule Description
Disabling a scheduled scan and approving or installing software may indicate an attempt to evade security controls and potentially introduce harmful software or malware into the system.
Severity
Critical
Rule Requirement
Criteria
Action1:
actionname = "Inventory File Scan Modification"
Action2:
actionname = "Successful Software Addition" AND HOSTNAME = Action1.HOSTNAME
Action3:
actionname = "Service installed" AND HOSTNAME = Action2.HOSTNAME AND HOSTNAME = Action1.HOSTNAME
sequence:Action1 followedby Action2 within 10m followedby Action3 within 10m
select Action1.MESSAGE,Action1.HOSTNAME,Action1.USERNAME,Action2.MESSAGE,Action2.HOSTNAME,Action2.USERNAME,Action3.HOSTNAME,Action3.MESSAGE,Action3.DOMAIN,Action3.SERVICEACCOUNT,Action3.SERVICENAME,Action3.OBJECTNAME,Action3.USERNAME,Action3.SECURITYID,Action3.SERVICESTARTUPTYPE,Action3.SERVICETYPE
Detection
Execution Mode
realtime
Log Sources
Miscellaneous
