Link Search Menu Expand Document

CB_Malware_New_Malware

ID: 100229

Description:

CarbonBlack Malware alert

Repository: Group: CarbonBlack Type: event

Default Status:

Enabled

Tags:
Carbon Black
 

Selector:

Query:

Filters:

Field MUST hit
@cb.threatInfo.threatCause.threatCategory NEW_MALWARE
@source carbonBlackPSC
Field MUST NOT hit
@cb.threatInfo.threatCause.reputation TRUSTED_WHITE_LIST
@cb.threatInfo.score 1
  2

Behavior Rule:

Key Type Behavior Category
@cb.deviceInfo.deviceName asset security alert

Risks:

Risks Base Score Dimension
ALERT_END_POINT 800 alert

Attributes:

Alias Key
Hostname @cb.deviceInfo.deviceName
Username @cb.deviceInfo.email
IP @cb.deviceInfo.internalIpAddress
FileHash @cb.threatInfo.threatCause.actor
Origin @cb.threatInfo.threatCause.originSourceType
OS @cb.deviceInfo.deviceVersion
Description @cb.threatInfo.summary
Score @cb.threatInfo.score
IncidentID @cb.threatInfo.incidentId
Threat Reputation @cb.threatInfo.threatCause.reputation
Threat Application Name @cb.threatInfo.indicators.applicationName
Threat Indicator Name @cb.threatInfo.indicators.indicatorName

Correlation Rules:

First Occurrence:

Name Window Fields
NewAsset 10 days @cb.deviceInfo.deviceName
  Risks: ML_NEW_ASSET
NewActor 10 days @cb.threatInfo.threatCause.actor
  Risks: ML_NEW_FILE

History:

User Date
ku*n@fluencysecurity.com 2021 Apr 6 13:40:59 EDT

This page was automatically created/formatted on Tue, 2021 Oct 19 00:29:17 EDT, from rule_dump.json (db47c470500ce8686ead334f5eda0596)