Suspicious software installation
Last updated on:
In this page
About the rule
Rule Type
Advanced
Rule Description
This rule detects VPN logon failures followed by a successful VPN logon and a remote login in a Windows device using which a software is installed using the remotely logged user account.
Severity
Critical
Rule Requirement
Criteria
Action1: actionname = "null" | timewindow 10m | groupby HOSTNAME | groupby USERNAME having COUNT > 5 Action2: actionname = "fortinet_successful_vpn_logon" AND HOSTNAME = Action1.HOSTNAME AND USERNAME = Action1.USERNAME Action3: actionname = "Remote logon" AND REMOTEIP = Action2.PRIVATE_IP Action4: actionname = "null" AND HOSTNAME = Action3.HOSTNAME AND USERNAME = Action3.USERNAME sequence:Action1 followedby Action2 within 2m followedby Action3 within 15m followedby Action4 within 30m select Action2.HOSTNAME,Action2.USERNAME,Action2.REMOTE_IP,Action2.MESSAGE,Action2.TUNNEL_ID,Action2.C_IP_COUNTRY,Action2.PRIVATE_IP,Action2.IP_ADDRESS_COUNTRY,Action3.HOSTNAME,Action3.MESSAGE,Action3.ELEVATEDTOKEN,Action3.USERNAME,Action3.DOMAIN,Action3.REMOTEHOST,Action3.REMOTEIP,Action3.LOGONTYPE,Action3.PROCESSNAME,
Detection
Execution Mode
realtime
Log Sources
Miscellaneous
