RSA NetWitness Endpoint Application Rules

Document created by RSA Product Team Employee on Oct 3, 2019Last modified by RSA Product Team Employee on Oct 4, 2019
Version 4Show Document
  • View in full screen mode

The following table lists the RSA Application Rules for NetWitness Endpoint.

Display NameFile NameDescription
Accesses Administrative Share Using Command Shellaccesses_administrative_share_using_command_shellAccessing administrative share using command shell can be an indicator of someone trying for lateral movement or privilege escalation by using hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. This rule is supported for Windows 8 and higher versions.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = accesses administrative share using command shell
Activates BITS Jobactivates_bits_jobBackground Intelligent Transfer Service (BITS) is a Windows component used to transfer files. It has commonly been used for malware distribution.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* ioc = activates bits job
Adds Files To BITS Download Jobadds_files_to_bits_download_jobBackground Intelligent Transfer Service (BITS) is a Windows component used to transfer files. It has commonly been used for malware distribution.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* ioc = adds files to bits download job
Adds Firewall Ruleadds_firewall_ruleAdding firewall rule can be a indication of someone trying to compromise the integrity of the security solution, causing events to go unreported, or make forensic analysis and incident response more difficult due to lack of sufficient data to determine incident occurred.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = adds firewall rule
Allocates Remote Memoryallocates_remote_memoryIn Mac, a process not signed by Apple has allocated memory in another process. Most allocations will only occur within the same process and by processes signed by Apple. This generally indicates an attempt to inject code or data into another process, which may be a first step in reinforcing a malicious presence on a system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = allocates remote memory
Antivirus Disabledantivirus_disabledDisabling antivirus can be a indication of someone trying to compromise the integrity of the security solution, causing events to go unreported, or make forensic analysis and incident response more difficult due to lack of sufficient data to determine incident occurred.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* eoc = antivirus disabled
Archiving Software Reads Multiple Documentsarchiving_software_reads_multiple_documentsMultiple documents read could be an indication of someone creating a large archive.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = archiving software reads multiple documents
AutorunautorunIndicates applications or commands that are configured to run on system startup.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = autorun
Autorun File Path Not Part Of RPMautorun_file_path_not_part_of_rpmInstallation or updates of software on Linux systems is typically done through an RPM. Executables outside of this packing format could be considered suspicious.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = autorun file path not part of rpm
Autorun Key Contains Non-Printable Charactersautorun_key_contains_non-printable_charactersAutorun key containing non-printable characters an indication of someone trying to use startup configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* ioc = autorun key contains non-printable characters
Autorun RPM Mismatchautorun_rpm_mismatchA hash mismatch may indicate a file has been altered from its original state and call into question its integrity. Since RPMs typically contain compiled software this could mean an attacker is trying to disguise malicious malware as legitimate.
Autorun Unsigned Active Setupautorun_unsigned_active_setupActive Setup is a mechanism for executing commands once per user early during login and executed by explorer.exe. To ensure persistence across reboots and log-offs attackers use active setup which is even more suspicious when it is unsigned.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = autorun unsigned active setup
Autorun Unsigned AppInit_DLLsautorun_unsigned_appinit_dllsUnsigned Autorun AppInit_DLLs can be an indiaction of attacker trying to abused registry key values for DLLs to obtain persistence and privilege escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = autorun unsigned appinit_dlls
Autorun Unsigned BHOautorun_unsigned_bhoBHOs can be used to monitor user browsing habits and deliver targeted advertising as well as steal information. BHOs Unsigned and configured to run on system startup are used for persistence and are suspicious.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = autorun unsigned bho
Autorun Unsigned BootExecute Registry Startup Methodautorun_unsigned_bootexecute_registry_startup_methodUnsigned Autorun BootExecute registry startup method an indication of someone trying to use startup configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = autorun unsigned bootexecute registry startup method
Autorun Unsigned Explorer Registry Startup Methodautorun_unsigned_explorer_registry_startup_methodUnsigned Autorun explorer registry startup method an indication of someone trying to use startup configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = autorun unsigned explorer registry startup method
Autorun Unsigned Hiddenautorun_unsigned_hiddenAdversaries can use this to their advantage to hide files and folders anywhere on the system for persistence and evasion. To ensure persistence across reboots attackers configure to run those on system startup which is even more suspicious when it is unsigned.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = autorun unsigned hidden
Autorun Unsigned IE Toolbarautorun_unsigned_ie_toolbarToolbar can be spyware or adware which can breach privacy and steal data through browsers. To ensure persistence across reboots attackers configure to run those on system startup which is even more suspicious when it is unsigned.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = autorun unsigned ie toolbar
Autorun Unsigned In AppDataLocal Directoryautorun_unsigned_in_appdatalocal_directoryThis rule looks for any registry logon autoruns (HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce and \\Run keys) that have actions pointing at files running out of AppData/Local/Temp on Windows systems. These locations are used often by malware authors to store malicious payloads, with autoruns in place to ensure persistence.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = autorun unsigned in appdatalocal directory
Autorun Unsigned In AppDataRoaming Directoryautorun_unsigned_in_appdataroaming_directoryThis rule looks for any registry logon autoruns (HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce and \\Run keys) that have actions pointing at files running out of AppData/Roaming on Windows systems. These locations are used often by malware authors to store malicious payloads, with autoruns in place to ensure persistence.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = autorun unsigned in appdataroaming directory
Autorun Unsigned In ProgramData Directoryautorun_unsigned_in_programdata_directoryThis rule looks for any registry logon autoruns (HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce and \\Run keys) that have actions pointing at files running out of ProgramData directory on Windows systems. These locations are used often by malware authors to store malicious payloads, with autoruns in place to ensure persistence.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = autorun unsigned in programdata directory
Autorun Unsigned In Temp Directoryautorun_unsigned_in_temp_directoryThis rule looks for any registry logon autoruns (HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce and \\Run keys) that have actions pointing at files running out of Temp directory on Windows systems. These locations are used often by malware authors to store malicious payloads, with autoruns in place to ensure persistence.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = autorun unsigned in temp directory
Autorun Unsigned LogonType Registry Startup Methodautorun_unsigned_logontype_registry_startup_methodUnsigned Autorun LogonType registry startup method an indication of someone trying to use startup configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = autorun unsigned logontype registry startup method
Autorun Unsigned LSA Providerautorun_unsigned_lsa_providerWindows Authentication Package (AP) DLLs are loaded by the Local Security Authority (LSA) process at system start. Attackers can introduce their own APs to control logon processes and security protocols to OS. To ensure persistence across reboots attackers configure to run those on system startup which is even more suspicious when it is unsigned.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = autorun unsigned lsa provider
Autorun Unsigned ServiceDLLautorun_unsigned_servicedllTo evade defense, DLLs can be run as a service. This technique is used by attackers to hide the malware. To ensure persistence across reboots attackers configure to run those on system startup which is even more suspicious when it is unsigned.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = autorun unsigned servicedll
Autorun Unsigned Winsock LSPautorun_unsigned_winsock_lspWinsock LSP is a DLL that is loaded when a process uses Winsock API, it allows us to inject our code between the user network calls and the Winsock API, thus allowing attacker to inspect, modify, or block those network calls. To ensure persistence across reboots attackers configure to run those on system startup which is even more suspicious when it is unsigned.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = autorun unsigned winsock lsp
Bad Certificate Warning Disabledbad_certificate_warning_disabledDisabling bad certificate warning can be an indication of an adversary attempting to block indicators or event notifications, causing events to go unreported, or make forensic analysis and incident response more difficult due to lack of sufficient data to determine incident occurred.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* eoc = bad certificate warning disabled
Blacklisted Fileblacklisted_fileAn analyst may mark files as blacklisted within NetWitness Endpoint. If actions on an endpoint involve those blacklisted files as the source, then this rule will trigger.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = blacklisted file
Browser Runs Mshtabrowser_runs_mshtaMshta.exe executes Microsoft HTML Applications (HTA). Attackers can use mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. It is suspicious for a browser to run Mshta.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = browser runs mshta
Browser Runs Powershellbrowser_runs_powershellBrowser running powershell can be an indication of someone trying to run web based malicious commands using browsers to compromise the system or the user, which can be further used to gain access, to do lateral movement or to gain elevated privileges.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = browser runs powershell
Builds Script Incrementallybuilds_script_incrementallyBuilding script incrementally can be an indication of attacker trying to execute serias of commands using script, which can be further used to gain access, to do lateral movement or to gain elevated privileges. Attackers may take advantage of this to avoid triggering security tools.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = builds script incrementally
Clears Security Event Logclears_security_event_logClearing security event log can be a strong indication of someone trying to compromise the integrity of the security solution, causing events to go unreported, or make forensic analysis and incident response more difficult due to lack of sufficient data to determine incident occurred.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = clears security event log
Clears System Event Logclears_system_event_logClearing security system log can be a indication of someone trying to compromise the integrity of the security solution, causing events to go unreported, or make forensic analysis and incident response more difficult due to lack of sufficient data to determine incident occurred.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = clears system event log
Combines Binaries Using Command Promptcombines_binaries_using_command_promptChaining binaries using command prompt can be an indication of someone trying to run multiple malicious commands needed to perform multi-stage attack to exploit the system, which can be further used to gain access, to do lateral movement or to gain elevated privileges.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = combines binaries using command prompt
Command Line Usage Of Archiving Softwarecommand_line_usage_of_archiving_softwareUse of the command line to create archive files demonstrates more advanced use of the tools and is atypical.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = command line usage of archiving software
Completes BITS Download Jobcompletes_bits_download_jobBackground Intelligent Transfer Service (BITS) is a Windows component used to transfer files. It has commonly been used for malware distribution.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* ioc = completes bits download job
Configures Image Hijackingconfigures_image_hijackingImage File Execution Options (IFEO) enable a developer to attach a debugger to an application. Value of the debugger process can be abused to obtain persistence and privilege escalation by causing a malicious executable to be loaded and by continuous invocation. Malware may also use IFEO for Defense Evasion by registering invalid debuggers that redirect and effectively disable various system and security applications

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* ioc = configures image hijacking
Configures Port Redirectionconfigures_port_redirectionConfiguring port redirection can be indication of adversaries can be using connection to manage command and control communications, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = configures port redirection
Copies Binary Over Administrative Sharecopies_binary_over_administrative_shareAdministrative shares once compromised could be used to distribute malware.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = copies binary over administrative share
Created In Last Monthcreated_in_last_monthFiles created in the last month may be reviewed for malicious intent.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = created in last month
Creates Browser Extensioncreates_browser_extensionBrowser extensions or plugins are small programs that can add functionality and customize aspects of internet browsers. Malicious extensions once installed can browse to websites in the background, steal all information that a user enters into a browser and be used as an installer for a RAT for persistence.
Creates Domain User Accountcreates_domain_user_accountCreating domain user account can be an indication of adversaries with a sufficient level of access creating a domain user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = creates domain user account
Creates Executable In Startup Directorycreates_executable_in_startup_directoryCreating executable in startup directory can an indication of someone trying to use startup configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = creates executable in startup directory
Creates Local Driver Servicecreates_local_driver_serviceCreating local driver service can be an indication of someone trying to maintain a persistent access on the system using driver services which can execute under SYSTEM privileges, modify the registry and create back

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = creates local driver service
Creates Local Servicecreates_local_serviceCreating local service can be an indication of someone trying to maintain a persistent presence on the system using local services which can modify the registry, escalate privileges and create backdoor.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = creates local service
Creates Local Taskcreates_local_taskCreating local task can be an indication of someone trying to use task scheduling to execute programs at system startup or on a scheduled basis for persistence, to conduct remote execution as part of lateral movement, to gain SYSTEM privileges, or to run a process under the context of a specified account.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = creates local task
Creates Local User Accountcreates_local_user_accountCreating local user account can be an indication of adversaries with a sufficient level of access creating a local user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = creates local user account
Creates Password-Protected Archivecreates_password-protected_archivePassword-protected archive files can be used to exfiltrate sensitive data since contents cannot be examined.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = creates password-protected archive
Creates Recursive Archivecreates_recursive_archiveCreating a recursive archive could be an attempt to exfiltrate many files at once.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = creates recursive archive
Creates Remote Process Using WMI Command-Line Toolcreates_remote_process_using_wmi_command-line_toolCreating remote process using WMI command-line tool can be an indication of someone trying to use WMI to interact with local and remote systems and use it as a means to perform many tactic functions, such as gathering information for discovery and remote execution of files as part of Lateral Movement.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = creates remote process using wmi command-line tool
Creates Remote Servicecreates_remote_serviceCreating remote service can be an indication of someone trying to maintain a persistent presence on the system using remote services which can modify the registry, escalate privileges and create backdoor.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = creates remote service
Creates Remote Taskcreates_remote_taskCreating remote task can be an indication of someone trying to use task scheduling to execute programs at system startup or on a scheduled basis for persistence, to conduct remote execution as part of lateral movement, to gain SYSTEM privileges, or to run a process under the context of a specified account.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = creates remote task
Creates Shadow Volume For Logical Drivecreates_shadow_volume_for_logical_driveCreating shadow volume for logical drive can be indication of someone trying to dump credentials using shadow backup copies of systems to be able to Creates remote taskCreates remote taskgain a privileged foothold, allowing them unfettered access to elevate privileges and move about the network freely without detection.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = creates shadow volume for logical drive
Creates Suspicious Service Running Command Promptcreates_suspicious_service_running_command_promptCreates suspicious service running command prompt can be an indication of someone trying to create and run malicious services to exploit the system, which can be further used to gain access, to do lateral movement or to gain elevated privileges. Attackers may take advantage of this to proxy execution of code to avoid triggering security tools.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = creates suspicious service running command prompt
Deletes Backup Catalogdeletes_backup_catalogDeleting backup catalog can be an indication of someone is trying to remove files over the course of an intrusion to keep their footprint low or remove them at the end as part of the post-intrusion cleanup process.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = deletes backup catalog
Deletes Firewall Ruledeletes_firewall_ruleDeleting firewall rule can be a indication of someone trying to compromise the integrity of the security solution, causing events to go unreported, or make forensic analysis and incident response more difficult due to lack of sufficient data to determine incident occurred.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = deletes firewall rule
Deletes Shadow Volume Copiesdeletes_shadow_volume_copiesDeleting shadow volume copies can be an indication of someone is trying to removefiles over the course of an intrusion to keep their footprint low or remove them at the end as part of the post-intrusion cleanup process.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = deletes shadow volume copies
Deletes USN Change Journaldeletes_usn_change_journalDeleting USN change journal can be a indication of someone trying to compromise the integrity of the security solution, causing events to go unreported, or make forensic analysis and incident response more difficult due to lack of sufficient data to determine incident occurred.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = deletes usn change journal
Disables Firewalldisables_firewallDisabling firewall can be a indication of someone trying to compromise the integrity of the security solution, causing events to go unreported, or make forensic analysis and incident response more difficult due to lack of sufficient data to determine incident occurred.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* eoc = disables firewall
Disables Security Servicedisables_security_serviceDisabling security service can be a indication of someone trying to compromise the integrity of the security solution, causing events to go unreported, or make forensic analysis and incident response more difficult due to lack of sufficient data to determine incident occurred.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* eoc = disables security service
Disables Startup Repairdisables_startup_repairDisabling startup repair can be an indication of someone is trying to remove files over the course of an intrusion to keep their footprint low or remove them at the end as part of the post-intrusion cleanup process.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = disables startup repair
Disables UACdisables_uacEvent viewer executing uncommon binary can be an indication of possible Windows User Account Control (UAC) bypass. Attacker can use these techniques to elevate privileges to administrator if the target process is unprotected. Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* eoc = disables uac
Disables UAC Remote Restrictionsdisables_uac_remote_restrictionsDisabling UAC remote restrictions can be an attempt to bypass Windows User Account Control (UAC). Attacker can use these techniques to elevate privileges to administrator if the target process is unprotected. Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* eoc = disables uac remote restrictions
Disables Windows Defender Using Powershelldisables_windows_defender_using_powershellDisabling windows defender using powershell can be a indication of someone trying to compromise the integrity of the security solution, causing events to go unreported, or make forensic analysis and incident response more difficult due to lack of sufficient data to determine incident occurred.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = disables windows defender using powershell
Downloads Binary Using Certutildownloads_binary_using_certutilWindows certificate managing utility program - CertUtil can install, backup, delete, manage, and perform various functions related to certificates and certificate stores in Windows. Downloading binary using certutil can be an indication of someone trying to download malicious code to exploit the system, which can be further used to gain access, to do lateral movement or to gain elevated privileges.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = downloads binary using certutil
Drops Credential Dumping Toolsdrops_credential_dumping_toolsDropping credential dumping tools can be indication of someone trying to bypass all credentials checks to be able to gain a privileged foothold, allowing them unfettered access to elevate privileges and move about the network freely without detection.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* ioc = drops credential dumping library
Dumps DNS Cachedumps_dns_cacheDumping DNS cache can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = dumps dns cache
Dyld Inserteddyld_insertedmacOS and OS X use a common method to look for required dynamic libraries (dylib) to load into a program based on search paths. Adversaries can take advantage of ambiguous paths to plant dylibs to gain privilege escalation or persistence.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* eoc = dyld inserted
Enables Cleartext Credential Storageenables_cleartext_credential_storageEnabling cleartext credential storage can be indication of someone trying to exploit these credentials to be able to gain a privileged foothold, allowing them unfettered access to elevate privileges and move about the network freely without detection.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* eoc = enables cleartext credential storage
Enables Login Bypassenables_login_bypassAccessibility features that may be launched with a key combination before a user has logged in . Enabling login bypass can be an indicator of someone trying to modify the way these programs are launched to maintain a persistent presence on the system which can escalate privileges and create backdoor without logging in to the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* ioc = enables login bypass
Enables RDP From Command-Lineenables_rdp_from_command-lineEnabling RDP from command-line can be indication of adversaries trying to connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials. Adversaries may also use RDP in conjunction with the Accessibility Features technique for Persistence or perform RDP session hijacking which involves stealing a legitimate user's remote session.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = enables rdp from command-line
Enumerates ARP Tableenumerates_arp_tableEnumeration of ARP table can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = enumerates arp table
Enumerates Available Systems On Networkenumerates_available_systems_on_networkEnumeration of available systems on network can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = enumerates available systems on network
Enumerates Domain Account Policyenumerates_domain_account_policyEnumeration of domain account policy can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = enumerates domain account policy
Enumerates Domain Administratorsenumerates_domain_administratorsEnumeration of domain administrators can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = enumerates domain administrators
Enumerates Domain Computersenumerates_domain_computersEnumeration of domain computers can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = enumerates domain computers
Enumerates Domain Controllersenumerates_domain_controllersEnumeration of domain controllers can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = enumerates domain controllers
Enumerates Domain Groupsenumerates_domain_groupsEnumeration of domain groups can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = enumerates domain groups
Enumerates Domain Usersenumerates_domain_usersEnumeration of domain users can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = enumerates domain users
Enumerates Enterprise Administratorsenumerates_enterprise_administratorsEnumeration of enterprise administrators can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = enumerates enterprise administrators
Enumerates Exchange Domain Serversenumerates_exchange_domain_serversEnumeration of exchange domain servers can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = enumerates exchange domain servers
Enumerates Exchange Serversenumerates_exchange_serversEnumeration of exchange servers can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = enumerates exchange servers
Enumerates IP Configurationenumerates_ip_configurationEnumeration of IP configuration can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = enumerates ip configuration
Enumerates Local Account Policyenumerates_local_account_policyEnumeration of local account policy can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = enumerates local account policy
Enumerates Local Administratorsenumerates_local_administratorsEnumeration of local administrators can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = enumerates local administrators
Enumerates Local Administrators On Domain Controllerenumerates_local_administrators_on_domain_controllerEnumeration of local administrators on domain controller can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = enumerates local administrators on domain controller
Enumerates Local Groupsenumerates_local_groupsEnumeration of local groups can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = enumerates local groups
Enumerates Local Servicesenumerates_local_servicesEnumeration of local services can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = enumerates local services
Enumerates Local Usersenumerates_local_usersEnumeration of local users can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = enumerates local users
Enumerates Logical Diskenumerates_logical_diskEnumeration of logical disk can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = enumerates logical disk
Enumerates Mapped Resourcesenumerates_mapped_resourcesEnumeration of mapped resources can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = enumerates mapped resources
Enumerates Network Connectionsenumerates_network_connectionsEnumeration of network connections can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = enumerates network connections
Enumerates Primary Domain Controllerenumerates_primary_domain_controllerEnumeration of primary domain controller can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = enumerates primary domain controller
Enumerates Processes On Local Systemenumerates_processes_on_local_systemEnumeration of processes on local system can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = enumerates processes on local system
Enumerates Processes On Remote Systemenumerates_processes_on_remote_systemEnumeration of processes on local system can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = enumerates processes on remote system
Enumerates Remote Netbios Name Tableenumerates_remote_netbios_name_tableEnumeration of remote netbios name table can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = enumerates remote netbios name table
Enumerates Remote Resourcesenumerates_remote_resourcesEnumeration of remote resources can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = enumerates remote resources
Enumerates Route Tableenumerates_route_tableEnumeration of routing table can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = enumerates route table
Enumerates Services Hosted In Processesenumerates_services_hosted_in_processesEnumeration of services hosted in processes can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = enumerates services hosted in processes
Enumerates System Infoenumerates_system_infoEnumeration of system information can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = enumerates system info
Enumerates Trusted Domainsenumerates_trusted_domainsEnumeration of trusted domains can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = enumerates trusted domains
Event Viewer Executes Uncommon Binaryevent_viewer_executes_uncommon_binaryEvent viewer executing uncommon binary can be an indication of possible Windows User Account Control (UAC) bypass. Attacker can use these techniques to elevate privileges to administrator if the target process is unprotected. Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = event viewer executes uncommon binary
Executable In ADSexecutable_in_adsLeveraging Alternate Data Streams can be a way to mask a malicious file inside a data stream of another binary, which can then be executed by launching the file it is forked into
Exports Sensitive Registry Hiveexports_sensitive_registry_hiveExporting sensitive registry hive can be indication of someone trying to exploit these credentials and registry values to be able to gain a privileged foothold, allowing them unfettered access to elevate privileges and move about the network freely without detection.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = exports sensitive registry hive
Extracts Password-Protected Archiveextracts_password-protected_archivePassword-protected archive files can be used to secure sensitive data since contents cannot be examined.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = extracts password-protected archive
File Encryptedfile_encryptedFile is encrypted before being exfiltrated in order to hide the information that is being exfiltrated from detection or to make the exfiltration less conspicuous upon inspection by a defender.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = file encrypted
File Hiddenfile_hiddenTo prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a hidden file. Adversaries can use this to their advantage to hide files and folders anywhere on the system for persistence and evading a typical user or system analysis that does not incorporate investigation of hidden files.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = file hidden
File Path Not Part Of RPMfile_path_not_part_of_rpmInstallation or updates of software on Linux systems is typically done through an RPM. Executables outside of this packing format could be considered suspicious.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = file path not part of rpm
File Path Not Part Of RPM In Important System Directoryfile_path_not_part_of_rpm_in_important_system_directoryInstallation or updates of software on Linux systems is typically done through an RPM. Executables outside of this packing format could be considered suspicious.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = file path not part of rpm in important system directory
File Vault Disabledfile_vault_disabledFileVault full-disk encryption (FileVault 2) uses XTS-AES-128 encryption with a 256-bit key to help prevent unauthorized access to the information on your startup disk. Disabling this feature will decrypt the information on your startup disk.
Floating Modulefloating_moduleDetects a floating code module as a result of DLL injection. This may result in an attacker gaining access to internal resources, escalating privileges or disguising malicious behavior under a legitimate process.
Floating Module And Hookingfloating_module_and_hookingDetects floating code as a result of hooking. The attacker masks malicious behavior under the process.
Floating Module In Browser Processfloating_module_in_browser_processDetects a floating code module as a result of DLL injection. The attacker masks malicious behavior under the legitimate browser process.
Floating Module In OS Processfloating_module_in_os_processDetects a floating code module as a result of DLL injection. The attacker masks malicious behavior under the legitimate OS process.
Gatekeeper Disabledgatekeeper_disabledGatekeeper is a security feature of the Mac OS operating system. It enforces code signing and verifies downloaded applications before allowing them to run, thereby reducing the likelihood of inadvertently executing malware.
Gets Current User As SYSTEMgets_current_user_as_systemTrying to find current user as SYSTEM can be an indication of someone trying to discover potential attack vectors in the system , and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = gets current user as system
Gets Current Usernamegets_current_usernameTrying to find current username information can be an indication of someone trying to discover potential attack vectors in the system , and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = gets current username
Gets Current Username And Group Informationgets_current_username_and_group_informationTrying to find current username and group information can be an indication of someone trying to discover potential attack vectors in the system , and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = gets current username and group information
Gets Hostnamegets_hostnameEnumeration of hostnames can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = gets hostname
Gets Remote Timegets_remote_timegetting remote time can be an indication of someone trying to gather information that could be useful for performing other techniques, such as executing a file with a Scheduled Task, or to discover locality information based on time zone to assist in victim targeting.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = gets remote time
GINA Replacementgina_replacementGINA is the Graphical Identification and Authentication component of Windows and handles the logon screen that we're all familiar with. GINA DLL can be replaced with another DLL to intercept credentials.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = gina replacement
Graylisted Filegraylisted_fileAn analyst may mark files as graylisted within NetWitness Endpoint. If actions on an endpoint involve those graylisted files as the source, then this rule will trigger.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = graylisted file
Hidden In AppDatahidden_in_appdataProcess injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Hidden Plist And Autorunhidden_plist_and_autorunplist (Property List) is a flexible and convenient format for storing application data. Adversaries can modify these plist files to point to their own code, can use them to execute their code in the context of another user, bypass whitelisting procedures, or even use them as a persistence mechanism.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = hidden plist and autorun
Hidden Running As Roothidden_running_as_rootA file is typically hidden to prevent users from accidentally changing them on a filesystem. A hidden file running with root privileges may indicate an attacker behavior to evade detection and install malware to maintain persistence.
Hooks Audio Output Functionhooks_audio_output_functionA hook is a process which can intercept actions from an application such as keystrokes, networking and files. These intercepted functions fall to a hook procedure, which can then change or reject the event.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = hooks audio output function
Hooks Authentication Functionhooks_authentication_functionA hook is a process which can intercept actions from an application such as keystrokes, networking and files. These intercepted functions fall to a hook procedure, which can then change or reject the event.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = hooks authentication function
Hooks Crypto Functionhooks_crypto_functionA hook is a process which can intercept actions from an application such as keystrokes, networking and files. These intercepted functions fall to a hook procedure, which can then change or reject the event.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = hooks crypto function
Hooks DnsQuery Functionhooks_dnsquery_functionA hook is a process which can intercept actions from an application such as keystrokes, networking and files. These intercepted functions fall to a hook procedure, which can then change or reject the event.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = hooks dnsquery function
Hooks GUI Functionhooks_gui_functionA hook is a process which can intercept actions from an application such as keystrokes, networking and files. These intercepted functions fall to a hook procedure, which can then change or reject the event.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = hooks gui function
Hooks Network HTTP Functionhooks_network_http_functionA hook is a process which can intercept actions from an application such as keystrokes, networking and files. These intercepted functions fall to a hook procedure, which can then change or reject the event.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = hooks network http function
Hooks Network IO Functionhooks_network_io_functionA hook is a process which can intercept actions from an application such as keystrokes, networking and files. These intercepted functions fall to a hook procedure, which can then change or reject the event.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = hooks network io function
Hooks NtLdr Functionhooks_ntldr_functionA hook is a process which can intercept actions from an application such as keystrokes, networking and files. These intercepted functions fall to a hook procedure, which can then change or reject the event.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = hooks ntldr function
Hooks Registry Access Functionhooks_registry_access_functionA hook is a process which can intercept actions from an application such as keystrokes, networking and files. These intercepted functions fall to a hook procedure, which can then change or reject the event.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = hooks registry access function
Hooks Registry Enumeration Functionhooks_registry_enumeration_functionA hook is a process which can intercept actions from an application such as keystrokes, networking and files. These intercepted functions fall to a hook procedure, which can then change or reject the event.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = hooks registry enumeration function
HTTP Daemon Runs Command Prompthttp_daemon_runs_command_promptHTTP daemon running command prompt can be an indication of web shell trying to run malicious commands which may may serve as Redundant Access or as a persistence mechanism in case an adversary's primary access methods are detected and removed.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = http daemon runs command prompt
HTTP Daemon Runs Powershellhttp_daemon_runs_powershellHTTP daemon running powershell can be an indication of web shell trying to run malicious commands which may may serve as Redundant Access or as a persistence mechanism in case an adversary's primary access methods are detected and removed.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = http daemon runs powershell
HTTP Daemon Runs Reconnaissance Toolhttp_daemon_runs_reconnaissance_toolHTTP daemon running reconnaissance tool can be an indication of web shell trying to run malicious commands which may may serve as Redundant Access or as a persistence mechanism in case an adversary's primary access methods are detected and removed.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* boc = http daemon runs reconnaissance tool
HTTP Daemon Writes Executablehttp_daemon_writes_executableHTTP daemon running writing executable can be an indication of web shell trying to run malicious commands which may may serve as Redundant Access or as a persistence mechanism in case an adversary's primary access methods are detected and removed.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = http daemon writes executable
IE DEP Disabledie_dep_disabledDisabling IE DEP can be a indication of someone trying to compromise the integrity of the security solution, causing events to go unreported, or make forensic analysis and incident response more difficult due to lack of sufficient data to determine incident occurred.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* eoc = ie dep disabled
IE Enhanced Security Disabledie_enhanced_security_disabledDisabling IE enhanced security can be a indication of someone trying to compromise the integrity of the security solution, causing events to go unreported, or make forensic analysis and incident response more difficult due to lack of sufficient data to determine incident occurred.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* eoc = ie enhanced security disabled
In AppData Directoryin_appdata_directoryThese locations are used often by malware authors to store malicious payloads, with autoruns in place to ensure persistence.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = in appdata directory
In Hidden Directoryin_hidden_directoryTo prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a hidden file. Adversaries can use this to their advantage to hide files and folders anywhere on the system for persistence and evading a typical user or system analysis that does not incorporate investigation of hidden files.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = in hidden directory
In Recycle Bin Directoryin_recycle_bin_directoryA file found in recycle bin directory may be suspicious.
In Root Of AppDataLocal Directoryin_root_of_appdatalocal_directoryThese locations are used often by malware authors to store malicious payloads, with autoruns in place to ensure persistence.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = in root of appdatalocal directory
In Root Of AppDataRoaming Directoryin_root_of_appdataroaming_directoryThese locations are used often by malware authors to store malicious payloads, with autoruns in place to ensure persistence.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = in root of appdataroaming directory
In Root Of Logical Drivein_root_of_logical_driveWhile the majority of programs are stored in folders on a system, it is uncommon to see a binary in the root of for example, "C:" directory.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file boc = in root of logical drive
In Root Of Program Directoryin_root_of_program_directoryThese locations are used often by malware authors to store malicious payloads, with autoruns in place to ensure persistence.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = in root of program directory
In Root Of Users Directoryin_root_of_users_directoryThese locations are used often by malware authors to store malicious payloads, with autoruns in place to ensure persistence.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file boc = in root of users directory
In System Volume Information Directoryin_system_volume_information_directory

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = in system volume information directory
In Temporary Directoryin_temporary_directoryThese locations are used often by malware authors to store malicious payloads, with autoruns in place to ensure persistence.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = in temporary directory
In Uncommon Directoryin_uncommon_directoryA file found in an uncommon directory may be suspicious.
Installs Root Certificateinstalls_root_certificateInstalling root certificate on a compromised system can be an indication of an adversary trying to compromise the integrity of the security solution, causing events to go unreported, or make forensic analysis and incident response more difficult due to lack of sufficient data to determine incident occurred.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = installs root certificate
Invalid Signatureinvalid_signatureThis indicates that code may have been altered or corrupted since it was signed.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = invalid signature
Kext Signature Validation Disabledkext_signature_validation_disabledKext signature validation is a code signing requirement for all extensions and drivers located in the extensions folder. Disabling that feature may expose the system to unsigned rootkits or other malware.
LD Preloadld_preloadEnvironment variables can be used to dynamically load a library in a process which can be used to intercept API calls from the running process.
Library Preferences Directorylibrary_preferences_directory"Adversaries can use list of specific applications to run when a user logs in. These login items are stored in the users ~/Library/Preferences/ directory in a plist file called com.apple.loginitems.plist

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = library preferences directory"
Lists Anti-Spyware Productslists_anti-spyware_productsListing anti-spyware products can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = lists anti-spyware products
Lists Antivirus Productslists_antivirus_productsListing antivirus products can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = lists antivirus products
Lists Firewall Productslists_firewall_productsListing firewall products can be an indication of someone trying to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* analysis.file = lists firewall products
Login Bypass Configuredlogin_bypass_configuredAccessibility features that may be launched with a key combination before a user has logged in . A login bypass can be an indicator of someone trying to modify the way these programs are launched to maintain a persistent presence on the system which can escalate privileges and create backdoor without logging in to the system.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* eoc = login bypass configured
LUA Disabledlua_disabledWindows User Account Controls (UAC) will not notify the user when programs try to make changes to the computer. UAC was formerly known as Limited User Account (LUA). This can be an attempt to bypass UAC.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* eoc = lua disabled
Mac Firewall Disabledmac_firewall_disabledDisabling firewall can be a indication of someone trying to compromise the integrity of the security solution, causing events to go unreported, or make forensic analysis and incident response more difficult due to lack of sufficient data to determine incident occurred.
Malicious File By Reputation Servicemalicious_file_by_reputation_serviceFiles reported as malicious by reputation service indicates execution of files and hashes of which are tagged as malicious.

 

VERSIONS SUPPORTED
* NetWitness Platform 11.3 and higher

 

DEPENDENCIES
* NetWitness Endpoint Server

 

GENERATED META KEYS
* ioc = malicious file by reputation service
Maps Administrative Sharemaps_administrative_shareMapping administrative share can be an indicator of someone trying for lateral movement or privilege escalation by using hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions