Trend Micro

Search Trend Micro rules.

Telemetry Evidence

These values show how indexed rules identify Trend Micro telemetry.

Kusto

Queried source table TMApexOneEvent (10 rules)
Queried source table TrendMicro_XDR_WORKBENCH_CL (1 rule)
Queried source table TrendMicroCAS (10 rules)

Detection Rules

Kusto #

ApexOne - Attack Discovery Detection source high: 'Detects Attack Discovery Detection events.'T1190
ApexOne - C&C callback events source high: 'Detects C&C callback events.'T1071
ApexOne - Commands in Url source high: 'Detects commands in Url.'T1133, T1190
ApexOne - Device access permissions was changed source medium: 'Query shows device access permissions was changed.'T1078
ApexOne - Inbound remote access connection source high: 'Detects inbound remote access connection.'T1021
ApexOne - Multiple deny or terminate actions on single IP source high: 'Detects multiple deny or terminate actions on single IP.'T1190
ApexOne - Possible exploit or execute operation source high: 'Detects possible exploit or execute operation.'T1546
ApexOne - Spyware with failed response source high: 'Detects spyware with failed response.'T1190
ApexOne - Suspicious commandline arguments source high: 'Detects suspicious commandline arguments.'T1059
ApexOne - Suspicious connections source high: 'Detects suspicious connections.'T1102

Show 10 more

Trend Micro CAS - DLP violation source high: 'Detects when DLP policy violation occurs.'T1048
Trend Micro CAS - Infected user source high: 'Detects when malware was detected for user account.'T1566
Trend Micro CAS - Multiple infected users source high: 'Detects when same malware was detected for multiple user account.'T1566
Trend Micro CAS - Possible phishing mail source medium: 'Detects possible phishing mail.'T1566
Trend Micro CAS - Ransomware infection source high: 'Triggeres when ransomware was detected.'T1486
Trend Micro CAS - Ransomware outbreak source high: 'Triggeres when ransomware was detected on several accounts.'T1486
Trend Micro CAS - Suspicious filename source medium: 'Detects unexpected filename.'T1566
Trend Micro CAS - Threat detected and not blocked source high: 'Detects when threat was not blocked by CAS solution.'T1685
Trend Micro CAS - Unexpected file on file share source medium: 'Detects unexpected files on file share.'T1566
Trend Micro CAS - Unexpected file via mail source medium: 'Detects when unexpected file received via mail.'T1566

Compatible Rules

These rules declare Trend Micro connector or schema compatibility without a product-specific query filter.

Kusto #

Detect Malicious Usage of Recovery Tools to Delete Backup Files source high: This analytic rule detects usage of recovery tools vssadmin, wbadmin, wmic and bcedit to delete backup files or change recovery configuration. Adversaries may use these tools to delete shadow copies and backup files to prevent recovery of files. https://attack.mitre.org/techniques/T1490/T1490
Detect Print Processors Registry Driver Key Creation/Modification source medium: This analytic rule detects any registry value creation or modification of print processor registry Driver key. This will load the executable at startup with print spooler service. This could be an indication of a persistence attempt by an adversary.T1547
Detect Registry Run Key Creation/Modification source medium: This analytic rule detects any registry value or key creation in the registry run keys. This could be an indication of a persistence attempt by an adversary.T1112, T1547
Detect Windows Allow Firewall Rule Addition/Modification source medium: This analytic rule detects any registry value creation or modification of Windows firewall registry keys to allow network traffic. This could be an indication of defense evasion by an adversary to allow network traffic to/from a compromised host.T1685
Detect Windows Update Disabled from Registry source medium: This analytic rule detects any registry value creation or modification of Windows Update registry keys to disable Windows Update. This could be an indication of defense evasion by an adversary on a compromised host.T1685
Network endpoint to host executable correlation source medium: 'Correlates blocked URLs hosting [malicious] executables with host endpoint data to identify potential instances of executables of the same name having been recently run.T1204
Process Creation with Suspicious CommandLine Arguments source medium: This analytic rule detects process creation events with base64 encoded command line arguments. This could be an indication of a malicious process being executed.T1027, T1059

Trend Micro

Telemetry Evidence

Kusto

Detection Rules

Kusto #

Other Index Content

Kusto #

Compatible Rules

Kusto #