Security Evasion-Inventory Management
Last updated on:
In this page
About the rule
Rule Type
Advanced
Rule Description
Disabling a scheduled scan and approving or installing software may indicate an attempt to evade security controls and potentially introduce harmful software or malware into the system.
Severity
Critical
Rule Requirement
Criteria
Action1: actionname = "uem_file_scan" Action2: actionname = "null" AND HOSTNAME = Action1.HOSTNAME Action3: actionname = "Service installed" AND HOSTNAME = Action2.HOSTNAME AND HOSTNAME = Action1.HOSTNAME sequence:Action1 followedby Action2 within 10m followedby Action3 within 10m select Action1.MESSAGE,Action1.HOSTNAME,Action1.USERNAME,,Action3.HOSTNAME,Action3.MESSAGE,Action3.DOMAIN,Action3.SERVICEACCOUNT,Action3.SERVICENAME,Action3.OBJECTNAME,Action3.USERNAME
Detection
Execution Mode
realtime
Log Sources
Miscellaneous
