Suspicious software installation
Last updated on:
In this page
About the rule
Rule Type
Advanced
Rule Description
This rule detects VPN logon failures followed by a successful VPN logon and a remote login in a Windows device using which a software is installed using the remotely logged user account.
Severity
Critical
Rule Requirement
Criteria
Action1:
actionname = "Failed VPN logon"
| timewindow 10m
| groupby HOSTNAME
| groupby USERNAME having COUNT >= 5
Action2:
actionname = "Successful VPN logon" AND HOSTNAME = Action1.HOSTNAME AND USERNAME = Action1.USERNAME
Action3:
actionname = "Remote logon" AND REMOTEIP = Action2.PRIVATE_IP
Action4:
actionname = "Software installed" AND HOSTNAME = Action3.HOSTNAME AND USERNAME = Action3.USERNAME
sequence:Action1 followedby Action2 within 2m followedby Action3 within 15m followedby Action4 within 30m
select Action1.timewindow.HOSTNAME,Action1.timewindow.USERNAME,Action1.timewindow.REMOTE_IP,Action1.timewindow.MESSAGE,Action2.HOSTNAME,Action2.USERNAME,Action2.REMOTE_IP,Action2.MESSAGE,Action2.TUNNEL_ID,Action2.C_IP_COUNTRY,Action2.PRIVATE_IP,Action2.IP_COUNTRY,Action3.HOSTNAME,Action3.MESSAGE,Action3.ELEVATEDTOKEN,Action3.USERNAME,Action3.DOMAIN,Action3.REMOTEHOST,Action3.REMOTEIP,Action3.LOGONTYPE,Action3.PROCESSNAME,Action4.HOSTNAME,Action4.MESSAGE,Action4.SERVICENAME,Action4.VENDORNAME,Action4.USERNAME,Action4.VERSION
Detection
Execution Mode
realtime
Log Sources
Miscellaneous
