Carbon Black

Search Carbon Black rules.

Telemetry Evidence

These values show how indexed rules identify Carbon Black telemetry.

Kusto

Queried source table CarbonBlackEvents_CL (1 rule)
Queried source table CarbonBlackNotifications_CL (1 rule)

Panther

Log type CarbonBlack.AlertV2 (1 rule)
Log type CarbonBlack.Audit (5 rules)
Platform carbonblack (6 rules)

Detection Rules

Kusto #

Known Malware Detected source medium: 'This creates an incident when a known Malware is detected on a endpoint managed by a Carbon Black.'T1204

Panther #

Carbon Black Admin Role Granted source high: Detects when a user is granted Admin or Super Admin permissions.T1098
Carbon Black API Key Created or Retrieved source medium: Detects when a user creates a new API key or retrieves an existing key.T1136
Carbon Black Data Forwarder Stopped source high: Detects when a user disables or deletes a Data Forwarder.T1685.002
Carbon Black Log Entry Flagged source medium: Detects when Carbon Black has flagged a log as important, such as failed login attempts and locked accounts.T1110
Carbon Black User Added Outside Org source high: Detects when a user from a different organization is added to Carbon Black.T1136

Compatible Rules

These rules declare Carbon Black connector or schema compatibility without a product-specific query filter.

Kusto #

Detect Malicious Usage of Recovery Tools to Delete Backup Files source high: This analytic rule detects usage of recovery tools vssadmin, wbadmin, wmic and bcedit to delete backup files or change recovery configuration. Adversaries may use these tools to delete shadow copies and backup files to prevent recovery of files. https://attack.mitre.org/techniques/T1490/T1490
Detect Print Processors Registry Driver Key Creation/Modification source medium: This analytic rule detects any registry value creation or modification of print processor registry Driver key. This will load the executable at startup with print spooler service. This could be an indication of a persistence attempt by an adversary.T1547
Detect Registry Run Key Creation/Modification source medium: This analytic rule detects any registry value or key creation in the registry run keys. This could be an indication of a persistence attempt by an adversary.T1112, T1547
Detect Windows Allow Firewall Rule Addition/Modification source medium: This analytic rule detects any registry value creation or modification of Windows firewall registry keys to allow network traffic. This could be an indication of defense evasion by an adversary to allow network traffic to/from a compromised host.T1685
Detect Windows Update Disabled from Registry source medium: This analytic rule detects any registry value creation or modification of Windows Update registry keys to disable Windows Update. This could be an indication of defense evasion by an adversary on a compromised host.T1685
Process Creation with Suspicious CommandLine Arguments source medium: This analytic rule detects process creation events with base64 encoded command line arguments. This could be an indication of a malicious process being executed.T1027, T1059

Carbon Black

Telemetry Evidence

Kusto

Panther

Detection Rules

Kusto #

Panther #

Other Index Content

Kusto #

Panther #

Compatible Rules

Kusto #