Cisco Secure Endpoint

Search Cisco Secure Endpoint rules.

Telemetry Evidence

These values show how indexed rules identify Cisco Secure Endpoint telemetry.

Kusto

Queried source table CiscoSecureEndpoint (10 rules)
Queried source table CiscoSecureEndpoint_CL (1 rule)

Detection Rules

Kusto #

Cisco SE - Connection to known C2 server source high: 'This rule is triggered when connection to known C2 is detected from host.'T1071
Cisco SE - Dropper activity on host source high: 'Detects possible dropper activity on host.'T1204, T1204.002
Cisco SE - Generic IOC source high: 'This rule is triggered when generic IOC is observed on host.'T1204, T1204.002
Cisco SE - Malware execusion on host source high: 'Detects malware execution on host.'T1204, T1204.002
Cisco SE - Malware outbreak source high: 'Detects possible malware outbreak.'T1133, T1190
Cisco SE - Multiple malware on host source high: 'This rule triggers when multiple malware where detected on host.'T1133, T1190
Cisco SE - Policy update failure source medium: 'Detects policy updates failures.'T1685
Cisco SE - Possible webshell source high: 'Detects possible webshell on host.'T1102
Cisco SE - Ransomware Activity source high: 'This rule is triggered when possible ransomware activity is detected on host.'T1486
Cisco SE - Unexpected binary file source medium: 'Detects binary files in uncommon locations.'T1133, T1190

Show 1 more

Cisco SE High Events Last Hour source high: 'Find events from Cisco Secure Endpoint that are of High severity in the last hour.'T1190, T1204, T1204.002

Compatible Rules

These rules declare Cisco Secure Endpoint connector or schema compatibility without a product-specific query filter.

Kusto #

Detect Malicious Usage of Recovery Tools to Delete Backup Files source high: This analytic rule detects usage of recovery tools vssadmin, wbadmin, wmic and bcedit to delete backup files or change recovery configuration. Adversaries may use these tools to delete shadow copies and backup files to prevent recovery of files. https://attack.mitre.org/techniques/T1490/T1490
Detect Print Processors Registry Driver Key Creation/Modification source medium: This analytic rule detects any registry value creation or modification of print processor registry Driver key. This will load the executable at startup with print spooler service. This could be an indication of a persistence attempt by an adversary.T1547
Detect Registry Run Key Creation/Modification source medium: This analytic rule detects any registry value or key creation in the registry run keys. This could be an indication of a persistence attempt by an adversary.T1112, T1547
Detect Windows Allow Firewall Rule Addition/Modification source medium: This analytic rule detects any registry value creation or modification of Windows firewall registry keys to allow network traffic. This could be an indication of defense evasion by an adversary to allow network traffic to/from a compromised host.T1685
Detect Windows Update Disabled from Registry source medium: This analytic rule detects any registry value creation or modification of Windows Update registry keys to disable Windows Update. This could be an indication of defense evasion by an adversary on a compromised host.T1685
Process Creation with Suspicious CommandLine Arguments source medium: This analytic rule detects process creation events with base64 encoded command line arguments. This could be an indication of a malicious process being executed.T1027, T1059