Skip to content

Symantec/Broadcom Endpoint Security

Overview

Symantec Endpoint Protection is a client-server solution that protects laptops, desktops, and servers in your network against malware, risks, and vulnerabilities. This product is supported by Broadcom.

The following Sekoia.io built-in rules match the intake Broadcom/Symantec Endpoint Security. This documentation is updated automatically and is based solely on the fields used by the intake which are checked against our rules. This means that some rules will be listed but might not be relevant with the intake.

SEKOIA.IO x Broadcom/Symantec Endpoint Security on ATT&CK Navigator

AdFind Usage

Detects the usage of the AdFind tool. AdFind.exe is a free tool that extracts information from Active Directory. Wizard Spider (Bazar, TrickBot, Ryuk), FIN6 and MAZE operators have used AdFind.exe to collect information about Active Directory organizational units and trust objects

  • Effort: elementary
Adexplorer Usage

Detects the usage of Adexplorer, a legitimate tool from the Sysinternals suite that could be abused by attackers as it can saves snapshots of the Active Directory Database.

  • Effort: advanced
AutoIt3 Execution From Suspicious Folder

Detects AutoIt3 execution from an unusual/suspicious folder. Legitimate folders are "Program Files" and "AppData\Local". AutoIt3.exe is a legitimate process used to execute AutoIt program files, which are used by legitimate software, custom scripts, but also malware. Finding AutoIt3 execution from unusual/suspicious folder can help detect malware activities, such as DarkGate execution. The detection rule can be tailored to your environment and your use of AutoIt3 by filtering out folder's execution of legitimate applications or scripts.

  • Effort: advanced
Bloodhound and Sharphound Tools Usage

Detects default process names and default command line parameters used by Bloodhound and Sharphound tools.

  • Effort: intermediate
Broadcom/Symantec Endpoint Security Event Blocked

Broadcom/Symantec Endpoint Security blocked an action. Careful when activating this rule, it generates lots of events that are not always relevant for detection.

  • Effort: master
Broadcom/Symantec Endpoint Security Event Cleaned

Broadcom/Symantec Endpoint Security had cleaned action. Careful when activating this rule, it generates lots of events that are not always relevant for detection.

  • Effort: master
Broadcom/Symantec Endpoint Security Event Quarantined

Broadcom/Symantec Endpoint Security had a quarantined action. Careful when activating this rule, it generates lots of events that are not always relevant for detection.

  • Effort: master
Broadcom/Symantec Endpoint Security Event Terminate

Broadcom/Symantec Endpoint Security had a process terminate action. Careful when activating this rule, it generates lots of events that are not always relevant for detection.

  • Effort: master
Burp Suite Tool Detected

Burp Suite is a cybersecurity tool. When used as a proxy service, its purpose is to intercept packets and modify them to send them to the server. Burp Collaborator is a network service that Burp Suite uses to help discover many kinds of vulnerabilities (vulnerabilities scanner)

  • Effort: intermediate
CVE-2020-0688 Microsoft Exchange Server Exploit

Detects the exploitation of CVE-2020-0688. The POC exploit a .NET serialization vulnerability in the Exchange Control Panel (ECP) web page. The vulnerability is due to Microsoft Exchange Server not randomizing the keys on a per-installation basis resulting in them using the same validationKey and decryptionKey values. With knowledge of these, values an attacker can craft a special viewstate to use an OS command to be executed by NT_AUTHORITY\SYSTEM using .NET deserialization. To exploit this vulnerability, an attacker needs to leverage the credentials of an account it had already compromised to authenticate to OWA.

  • Effort: elementary
CVE-2020-17530 Apache Struts RCE

Detects the exploitation of the Apache Struts vulnerability (CVE-2020-17530).

  • Effort: intermediate
CVE-2021-20021 SonicWall Unauthenticated Administrator Access

Detects the exploitation of SonicWall Unauthenticated Admin Access.

  • Effort: advanced
CVE-2021-20023 SonicWall Arbitrary File Read

Detects Arbitrary File Read, which can be used with other vulnerabilities as a mean to obtain outputs generated by attackers, or sensitive data.

  • Effort: advanced
CVE-2021-22893 Pulse Connect Secure RCE Vulnerability

Detects potential exploitation of the authentication by-pass vulnerability that can allow an unauthenticated user to perform remote arbitrary file execution on the Pulse Connect Secure gateway. It is highly recommended to apply the Pulse Secure mitigations and seach for indicators of compromise on affected servers if you are in doubt over the integrity of your Pulse Connect Secure product.

  • Effort: intermediate
Certificate Authority Modification

Installation of new certificate(s) in the Certificate Authority can be used to trick user when spoofing website or to add trusted destinations.

  • Effort: master
Detect requests to Konni C2 servers

This rule detects requests to Konni C2 servers. These patterns come from an analysis done in 2022, September.

  • Effort: elementary
Disabled Service

Service disabling can be abused by attacker to deny security mecanisms (eg: firewall, EDR, ect) and it is also often used by cryptominer to exploit as much RAM & CPU as possible on infected host.

  • Effort: advanced
Download Files From Suspicious TLDs

Detects download of certain file types from hosts in suspicious TLDs

  • Effort: master
Exfiltration And Tunneling Tools Execution

Execution of well known tools for data exfiltration and tunneling

  • Effort: advanced
Hijack Legit RDP Session To Move Laterally

Identifies suspicious file creations in the startup folder of a remote system. An adversary could abuse this to move laterally by dropping a malicious script or executable that will be executed after a reboot or user logon.

  • Effort: intermediate
Interactive Terminal Spawned via Python

Identifies when a terminal (tty) is spawned via Python. Attackers may upgrade a simple reverse shell to a fully interactive tty after obtaining initial access to a host.

  • Effort: advanced
Kernel Module Alteration

Kernel module installation can be used to configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems.

  • Effort: advanced
Koadic MSHTML Command

Detects Koadic payload using MSHTML module

  • Effort: intermediate
Network Scanning and Discovery

Tools and command lines used for network discovery from current system

  • Effort: advanced
Network Sniffing

List of common tools used for network packages sniffing

  • Effort: advanced
Network Sniffing Windows

Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

  • Effort: intermediate
PasswordDump SecurityXploded Tool

Detects the execution of the PasswordDump SecurityXploded Tool

  • Effort: elementary
Phorpiex Process Masquerading

Detects specific process executable path used by the Phorpiex botnet to masquerade its system process network activity. It looks for a pattern of a system process executable name that is not legitimate and running from a folder that is created via a random algorithm 13-15 numbers long.

  • Effort: elementary
Possible Malicious File Double Extension

Detects request to potential malicious file with double extension

  • Effort: elementary
Potential DNS Tunnel

Detects domain name which is longer than 95 characters. Long domain names are distinctive of DNS tunnels.

  • Effort: advanced
ProxyShell Exchange Suspicious Paths

Detects suspicious calls to Exchange resources, in locations related to webshells observed in campaigns using this vulnerability.

  • Effort: elementary
PsExec Process

Detects PsExec execution, command line which contains pstools or installation of the PsExec service. PsExec is a SysInternals which can be used to execute a program on another computer. The tool is as much used by attackers as by administrators.

  • Effort: advanced
Python Exfiltration Tools

Python has some built-in modules or library that could be installed and later be used as exflitration tool by an attacker

  • Effort: advanced
RDP Session Discovery

Detects use of RDP session discovery via qwinsta or quser. Used by some threat actors to know if someone is working via RDP on a server.

  • Effort: advanced
Remote Monitoring and Management Software - AnyDesk

Detect artifacts related to the installation or execution of the Remote Monitoring and Management tool AnyDesk.

  • Effort: master
SEKOIA.IO Intelligence Feed

Detect threats based on indicators of compromise (IOCs) collected by SEKOIA's Threat and Detection Research team.

  • Effort: elementary
SELinux Disabling

An attacker can disable SELinux to make workstation or server compromise easier as it disables several protections.

  • Effort: intermediate
Suspicious Double Extension

Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spearphishing campaigns

  • Effort: advanced
Suspicious URI Used In A Lazarus Campaign

Detects suspicious requests to a specific URI, usually on an .asp page. The website is often compromised.

  • Effort: intermediate
System Info Discovery

System info discovery, attempt to detects basic command use to fingerprint a host

  • Effort: master
Telegram Bot API Request

Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind

  • Effort: advanced
Venom Multi-hop Proxy agent detection

Detects Venom Multi-hop Proxy agent.

  • Effort: intermediate
WMI Persistence Script Event Consumer File Write

Detects file writes through WMI script event consumer.

  • Effort: advanced

Event Categories

The following table lists the data source offered by this integration.

Data Source Description
Anti-virus Symantec Endpoint Protection analyses processes and files to prevent malicious actions.

In details, the following table denotes the type of events produced by this integration.

Name Values
Kind event
Category intrusion_detection, malware, network, process
Type ``

Event Samples

Find below few samples of events and how they are normalized by Sekoia.io.

{
    "message": "Site: OSTAM,Server Name: STR04,Domain Name: MyDomain,The client has downloaded the content package successfully,STV02,ADMIN,stv02.local",
    "event": {
        "category": [
            "network"
        ],
        "kind": "event",
        "reason": "The client has downloaded the content package successfully",
        "type": [
            "info"
        ]
    },
    "broadcom": {
        "endpoint_protection": {
            "server": {
                "domain": "MyDomain",
                "name": "STR04"
            }
        }
    },
    "host": {
        "hostname": "STV02",
        "name": "stv02.local"
    },
    "observer": {
        "product": "Symantec Endpoint Protection",
        "vendor": "Broadcom"
    },
    "related": {
        "hosts": [
            "STV02"
        ],
        "user": [
            "ADMIN"
        ]
    },
    "user": {
        "name": "ADMIN"
    }
}
{
    "message": "INT23456,,Blocked,C:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection\\14.3.4615.2000.105\\Bin64\\ccSvcHst.exe,,Begin: 2022-08-29 11:58:20,End Time: 2022-08-29 11:58:20,Rule: ,4428,C:\\PROGRAM FILES\\SMART-X\\CONTROLUPAGENT\\VERSION 8.1.5.634\\CUAGENT.EXE,0,,C:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection\\14.3.4615.2000.105\\Bin64\\ccSvcHst.exe,User Name: Admin,Domain Name: ,Action Type: 55,File size (bytes): ,Device ID: ",
    "event": {
        "action": "Blocked",
        "category": [
            "process"
        ],
        "end": "2022-08-29T11:58:20Z",
        "kind": "event",
        "start": "2022-08-29T11:58:20Z",
        "type": [
            "denied"
        ]
    },
    "@timestamp": "2022-08-29T11:58:20Z",
    "host": {
        "hostname": "INT23456",
        "name": "INT23456"
    },
    "observer": {
        "product": "Symantec Endpoint Protection",
        "vendor": "Broadcom"
    },
    "process": {
        "args": [
            "C:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection\f.3.4615.2000.105\\Bin64\\ccSvcHst.exe"
        ],
        "executable": "C:\\PROGRAM FILES\\SMART-X\\CONTROLUPAGENT\\VERSION 8.1.5.634\\CUAGENT.EXE",
        "name": "CUAGENT.EXE",
        "pid": 4428,
        "working_directory": "C:\\PROGRAM FILES\\SMART-X\\CONTROLUPAGENT\\VERSION 8.1.5.634"
    },
    "related": {
        "hosts": [
            "INT23456"
        ],
        "user": [
            "Admin"
        ]
    },
    "user": {
        "name": "Admin"
    }
}
{
    "message": "INT23456,1.2.3.4,Continue,Le contr\u00f4le des applications et des p\u00e9riph\u00e9riques est pr\u00eat.,Syst\u00e8me,Begin: 2022-10-19 06:45:39,End Time: 2022-10-19 06:45:39,Rule: R\u00e8gle int\u00e9gr\u00e9e,0,SysPlant,0,SysPlant,Aucun(e),User Name: Aucun(e),Domain Name: DOMAIN,Action Type: ,File size (bytes): 0,Device ID: ",
    "event": {
        "action": "Continue",
        "category": [
            "process"
        ],
        "end": "2022-10-19T06:45:39Z",
        "kind": "event",
        "reason": "Le contr\u00f4le des applications et des p\u00e9riph\u00e9riques est pr\u00eat.",
        "start": "2022-10-19T06:45:39Z",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2022-10-19T06:45:39Z",
    "broadcom": {
        "endpoint_protection": {
            "server": {
                "domain": "DOMAIN"
            }
        }
    },
    "file": {
        "size": 0
    },
    "host": {
        "hostname": "INT23456",
        "ip": "1.2.3.4",
        "name": "INT23456"
    },
    "observer": {
        "product": "Symantec Endpoint Protection",
        "vendor": "Broadcom"
    },
    "process": {
        "executable": "SysPlant",
        "name": "SysPlant",
        "pid": 0
    },
    "related": {
        "hosts": [
            "INT23456"
        ],
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4"
    }
}
{
    "message": "INT23456,Category: 2,LiveUpdate Manager,\"Event Description: L\u2019installation d\u2019une mise \u00e0 jour de Revocation Data a \u00e9chou\u00e9. Erreur : Echec de la correction de contenu (0xE0010005), DuResult: Succ\u00e8s (0).\",Event time: 2022-10-18 18:09:26,Group Name: MyDomain\\Servers",
    "event": {
        "category": [
            "process"
        ],
        "kind": "event",
        "reason": "L\u2019installation d\u2019une mise \u00e0 jour de Revocation Data a \u00e9chou\u00e9. Erreur : Echec de la correction de contenu (0xE0010005), DuResult: Succ\u00e8s (0).",
        "start": "2022-10-18T18:09:26Z",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2022-10-18T18:09:26Z",
    "broadcom": {
        "endpoint_protection": {
            "server": {
                "group": "MyDomain\\Servers"
            },
            "source": "LiveUpdate Manager"
        }
    },
    "host": {
        "hostname": "INT23456",
        "name": "INT23456"
    },
    "observer": {
        "product": "Symantec Endpoint Protection",
        "vendor": "Broadcom"
    },
    "related": {
        "hosts": [
            "INT23456"
        ]
    }
}
{
    "message": "INT23456,Category: 2,LiveUpdate Manager,\"Event Description: L\u2019installation d\u2019une mise \u00e0 jour de Virus and Spyware Definitions SDS Win64 (Reduced) a \u00e9chou\u00e9. Erreur : Echec de la correction de contenu (0xE0010005), DuResult: Succ\u00e8s (0).\",Event time: 2022-10-19 07:32:25,Group Name: MyDomain\\Servers",
    "event": {
        "category": [
            "malware"
        ],
        "kind": "event",
        "reason": "L\u2019installation d\u2019une mise \u00e0 jour de Virus and Spyware Definitions SDS Win64 (Reduced) a \u00e9chou\u00e9. Erreur : Echec de la correction de contenu (0xE0010005), DuResult: Succ\u00e8s (0).",
        "start": "2022-10-19T07:32:25Z",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2022-10-19T07:32:25Z",
    "broadcom": {
        "endpoint_protection": {
            "server": {
                "group": "MyDomain\\Servers"
            },
            "source": "LiveUpdate Manager"
        }
    },
    "host": {
        "hostname": "INT23456",
        "name": "INT23456"
    },
    "observer": {
        "product": "Symantec Endpoint Protection",
        "vendor": "Broadcom"
    },
    "related": {
        "hosts": [
            "INT23456"
        ]
    }
}
{
    "message": "INT23456,Event Description: [SID\u00a0: 32329] attaque de Audit: Malicious Scan Attempt 2 d\u00e9tect\u00e9e mais pas bloqu\u00e9e. Chemin d\u2019application\u00a0: SYSTEM,Event Type: ,Local Host IP: 1.2.3.4,Local Host MAC: 000000000000,Remote Host Name: ,Remote Host IP: 5.6.7.8,Remote Host MAC: 000000000000,Outbound,TCP,,Begin: 2022-10-19 09:25:40,End Time: 2022-10-19 09:25:40,Occurrences: 1,Application: SYSTEM,Location: Par d\u00e9faut,User Name: none,Domain Name: ,Local Port: 443,Remote Port: 14867,CIDS Signature ID: 32329,CIDS Signature string: Audit: Malicious Scan Attempt 2,CIDS Signature SubID: 68040,Intrusion URL: http://9.8.7.6:443/,Intrusion Payload URL: ,SHA-256: 0000000000000000000000000000000000000000000000000000000000000000,MD-5: ,Intensive Protection Level: N/A,URL Risk: N/A,URL Category: N/A",
    "event": {
        "category": [
            "intrusion_detection"
        ],
        "end": "2022-10-19T09:25:40Z",
        "kind": "event",
        "reason": "attaque de Audit: Malicious Scan Attempt 2 d\u00e9tect\u00e9e mais pas bloqu\u00e9e. Chemin d\u2019application\u00a0: SYSTEM",
        "start": "2022-10-19T09:25:40Z",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2022-10-19T09:25:40Z",
    "broadcom": {
        "endpoint_protection": {
            "application": {
                "name": "SYSTEM"
            },
            "cids": {
                "signature": {
                    "id": 32329,
                    "label": "Audit: Malicious Scan Attempt 2",
                    "sub_id": 68040
                }
            }
        }
    },
    "destination": {
        "address": "5.6.7.8",
        "ip": "5.6.7.8",
        "port": 14867
    },
    "host": {
        "hostname": "INT23456",
        "ip": "1.2.3.4",
        "name": "INT23456"
    },
    "network": {
        "direction": "outbound",
        "transport": "tcp"
    },
    "observer": {
        "product": "Symantec Endpoint Protection",
        "vendor": "Broadcom"
    },
    "related": {
        "hosts": [
            "INT23456"
        ],
        "ip": [
            "1.2.3.4",
            "5.6.7.8"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 443
    },
    "threat": {
        "enrichments": [
            {
                "indicator": {
                    "sightings": 1,
                    "type": "file"
                }
            }
        ]
    },
    "url": {
        "domain": "9.8.7.6",
        "original": "http://9.8.7.6:443/",
        "path": "/",
        "port": 443,
        "scheme": "http"
    }
}
{
    "message": "Scan ID: 1664847558,Begin: 2022-10-04 17:42:10,End Time: 2022-10-04 17:44:22,Completed,Duration (seconds): 132,User1: Syst\u00e8me,User2: Syst\u00e8me,Analyse lanc\u00e9e sur lecteurs et dossiers s\u00e9lectionn\u00e9s et toutes les extensions.,Analyse Installation standard : Risques : 0 Analys\u00e9s : 1553 Fichiers/Dossiers/Lecteurs omis : 0 Fichiers approuv\u00e9s ignor\u00e9s : 844,Command: Not a command scan (),Threats: 0,Infected: 0,Total files: 1553,Omitted: 0,Computer: DNHFF3453,IP Address: 1.2.3.4,Domain Name: MyDomain,Group Name: MyDomain\\Subdivision\\Citrix VDI persistants,Server Name: XXXXX01,Scan Type: DefWatch",
    "event": {
        "category": [
            "malware"
        ],
        "end": "2022-10-04T17:44:22Z",
        "kind": "event",
        "reason": "Analyse lanc\u00e9e sur lecteurs et dossiers s\u00e9lectionn\u00e9s et toutes les extensions.",
        "start": "2022-10-04T17:42:10Z",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2022-10-04T17:44:22Z",
    "broadcom": {
        "endpoint_protection": {
            "scan": {
                "command": "Not a command scan ()",
                "duration": 132,
                "id": "1664847558",
                "result": {
                    "infections": 0,
                    "omitted": 0,
                    "threats": 0,
                    "total": 1553
                },
                "status": "completed",
                "type": "DefWatch"
            },
            "server": {
                "domain": "MyDomain",
                "group": "MyDomain\\Subdivision\\Citrix VDI persistants",
                "name": "XXXXX01"
            }
        }
    },
    "host": {
        "hostname": "DNHFF3453",
        "ip": "1.2.3.4",
        "name": "DNHFF3453"
    },
    "observer": {
        "product": "Symantec Endpoint Protection",
        "vendor": "Broadcom"
    },
    "related": {
        "hosts": [
            "DNHFF3453"
        ],
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "Syst\u00e8me"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4"
    },
    "user": {
        "name": "Syst\u00e8me"
    }
}
{
    "message": "SONAR detection now allowed,IP Address: 1.2.3.4,Computer name: DNHFF3453,Source: Auto-Protect scan,Risk name: WS.Reputation.1,Occurrences: 1,File path: c:\\program files (x86)\\visualxxxxxxxxxx\\vtomxvision.exe,Description: ,Actual action: Action invalid,Requested action: Process terminate pending restart,Secondary action: 102,Event time: 2022-07-07 17:01:05,Event Insert Time: 2022-07-07 17:24:14,End Time: 2022-07-07 17:01:05,Last update time: 2022-07-07 17:24:14,Domain Name: MyDomain,Group Name: MyDomain\\Subdivision\\Citrix VDI persistants,Server Name: XXXXX01,User Name: Doe,Source Computer Name: ,Source Computer IP: ,Disposition: Good,Download site: ,Web domain: ,Downloaded by: c:/windows/explorer.exe,Prevalence: This file has been seen by fewer than 50 Symantec users.,Confidence: There is some evidence that this file is trustworthy.,URL Tracking Status: On,First Seen: Symantec has known about this file approximately 2 days.,Sensitivity: ,Allowed application reason: User allow list,Application hash: E13D72DE479A65E6448C779B3B2BCE45DB7B5AE52B1BAA0FE915380A667D3C01,Hash type: SHA2,Company name: Absyss S.A.S,Application name: Visual TOM,Application version: 6.6.1 (FR),Application type: 127,File size (bytes): 67352,Category set: Malware,Category type: Insight Network Threat,Location: MyDomain,Intensive Protection Level: 0,Certificate issuer: Absyss,Certificate signer: Sectigo RSA Code Signing CA,Certificate thumbprint: D31433F4C8C0BE4846E7E90318CD0CF5046EE95C,Signing timestamp: 1649155201,Certificate serial number: 044541E287C90A879334BFD15D6A3ED3",
    "event": {
        "action": "Process terminate pending restart",
        "category": [
            "process"
        ],
        "kind": "event",
        "reason": "SONAR detection now allowed",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2022-07-07T17:24:14Z",
    "broadcom": {
        "endpoint_protection": {
            "action": {
                "main": "Action invalid",
                "secondary": "102"
            },
            "application": {
                "code_signature": {
                    "certificate": {
                        "serial_number": "044541E287C90A879334BFD15D6A3ED3",
                        "thumbprint": "D31433F4C8C0BE4846E7E90318CD0CF5046EE95C"
                    },
                    "digest_algorithm": "sha2",
                    "signer": "Sectigo RSA Code Signing CA",
                    "subject_name": "Absyss",
                    "timestamp": "2022-04-05T10:40:01.000000Z"
                },
                "hash": {
                    "sha2": "E13D72DE479A65E6448C779B3B2BCE45DB7B5AE52B1BAA0FE915380A667D3C01"
                },
                "name": "Visual TOM",
                "version": "6.6.1 (FR)"
            },
            "confidence": "There is some evidence that this file is trustworthy.",
            "downloaded_by": {
                "file": {
                    "path": "c:/windows/explorer.exe"
                }
            },
            "prevalence": "This file has been seen by fewer than 50 Symantec users.",
            "protection": {
                "level": 0
            },
            "server": {
                "domain": "MyDomain",
                "group": "MyDomain\\Subdivision\\Citrix VDI persistants",
                "name": "XXXXX01"
            },
            "source": "Auto-Protect scan",
            "threat": {
                "category": "Malware",
                "type": "Insight Network Threat"
            }
        }
    },
    "file": {
        "directory": "c:\\program files (x86)\\visualxxxxxxxxxx",
        "name": "vtomxvision.exe",
        "path": "c:\\program files (x86)\\visualxxxxxxxxxx\\vtomxvision.exe",
        "size": 67352
    },
    "host": {
        "hostname": "DNHFF3453",
        "ip": "1.2.3.4",
        "name": "DNHFF3453"
    },
    "observer": {
        "product": "Symantec Endpoint Protection",
        "vendor": "Broadcom"
    },
    "related": {
        "hosts": [
            "DNHFF3453"
        ],
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "Doe"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4"
    },
    "threat": {
        "enrichments": [
            {
                "indicator": {
                    "description": "WS.Reputation.1",
                    "file": {
                        "path": "c:\\program files (x86)\\visualxxxxxxxxxx\\vtomxvision.exe",
                        "size": 67352
                    },
                    "first_seen": "2022-07-07T17:01:05.000000Z",
                    "last_seen": "2022-07-07T17:01:05.000000Z",
                    "modified_at": "2022-07-07T17:24:14.000000Z",
                    "sightings": 1,
                    "type": "file"
                }
            }
        ]
    },
    "user": {
        "name": "Doe"
    }
}
{
    "message": "OND345,Category: 2,REP,Event Description: Impossible d\u2019assigner un jeton d\u2019authentification client. Une erreur de communication g\u00e9n\u00e9rale est survenue.,Event time: 2022-08-29 11:35:29,Group Name: Company\\Own",
    "event": {
        "category": [
            "network"
        ],
        "kind": "event",
        "reason": "Impossible d\u2019assigner un jeton d\u2019authentification client. Une erreur de communication g\u00e9n\u00e9rale est survenue.",
        "start": "2022-08-29T11:35:29Z",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2022-08-29T11:35:29Z",
    "broadcom": {
        "endpoint_protection": {
            "server": {
                "group": "Company\\Own"
            },
            "source": "REP"
        }
    },
    "host": {
        "hostname": "OND345",
        "name": "OND345"
    },
    "observer": {
        "product": "Symantec Endpoint Protection",
        "vendor": "Broadcom"
    },
    "related": {
        "hosts": [
            "OND345"
        ]
    }
}
{
    "message": "Virus found,IP Address: 1.2.3.4,Computer name: DNHFF3453,Source: Auto-Protect scan,Risk name: EICAR Test String,Occurrences: 1,File path: C:\\Users\\admin\\Desktop\\test.txt,Description: AP realtime deferred scanning,Actual action: Cleaned by deletion,Requested action: Cleaned,Secondary action: Quarantined,Event time: 2022-07-07 14:28:39,Event Insert Time: 2022-07-07 14:30:43,End Time: 2022-07-07 14:28:39,Last update time: 2022-07-07 14:30:43,Domain Name: MyDomain,Group Name: MyDomain\\Subdivision\\Citrix VDI persistants,Server Name: XXXXX01,User Name: ADMIN,Source Computer Name: ,Source Computer IP: ,Disposition: Bad,Download site: ,Web domain: ,Downloaded by: ,Prevalence: This file has been seen by millions of Symantec users.,Confidence: This file is untrustworthy.,URL Tracking Status: On,First Seen: Reputation was not used in this detection.,Sensitivity: ,Allowed application reason: Not on the allow list,Application hash: 275A021BBFB6489E54D471899F7DB9D1663FC695EC2FE2A2C4538AABF651FD0F,Hash type: SHA2,Company name: ,Application name: Nouveau document texte.txt,Application version: ,Application type: 127,File size (bytes): 68,Category set: Malware,Category type: Virus,Location: MyDomain,Intensive Protection Level: 0,Certificate issuer: ,Certificate signer: ,Certificate thumbprint: ,Signing timestamp: ,Certificate serial number: ",
    "event": {
        "action": "Cleaned",
        "category": [
            "malware"
        ],
        "kind": "event",
        "reason": "Virus found",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2022-07-07T14:30:43Z",
    "broadcom": {
        "endpoint_protection": {
            "action": {
                "main": "Cleaned by deletion",
                "secondary": "Quarantined"
            },
            "application": {
                "code_signature": {
                    "digest_algorithm": "sha2"
                },
                "hash": {
                    "sha2": "275A021BBFB6489E54D471899F7DB9D1663FC695EC2FE2A2C4538AABF651FD0F"
                },
                "name": "Nouveau document texte.txt"
            },
            "confidence": "This file is untrustworthy.",
            "prevalence": "This file has been seen by millions of Symantec users.",
            "protection": {
                "level": 0
            },
            "server": {
                "domain": "MyDomain",
                "group": "MyDomain\\Subdivision\\Citrix VDI persistants",
                "name": "XXXXX01"
            },
            "source": "Auto-Protect scan",
            "threat": {
                "category": "Malware",
                "type": "Virus"
            }
        }
    },
    "file": {
        "directory": "C:\\Users\\admin\\Desktop",
        "name": "test.txt",
        "path": "C:\\Users\\admin\\Desktop\\test.txt",
        "size": 68
    },
    "host": {
        "hostname": "DNHFF3453",
        "ip": "1.2.3.4",
        "name": "DNHFF3453"
    },
    "observer": {
        "product": "Symantec Endpoint Protection",
        "vendor": "Broadcom"
    },
    "related": {
        "hosts": [
            "DNHFF3453"
        ],
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "ADMIN"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4"
    },
    "threat": {
        "enrichments": [
            {
                "indicator": {
                    "description": "EICAR Test String",
                    "file": {
                        "path": "C:\\Users\\admin\\Desktop\\test.txt",
                        "size": 68
                    },
                    "first_seen": "2022-07-07T14:28:39.000000Z",
                    "last_seen": "2022-07-07T14:28:39.000000Z",
                    "modified_at": "2022-07-07T14:30:43.000000Z",
                    "sightings": 1,
                    "type": "file"
                }
            }
        ]
    },
    "user": {
        "name": "ADMIN"
    }
}
{
    "message": "Virus found,IP Address: 1.2.3.4,Computer name: MyComputer,Source: Auto-Protect scan,Risk name: EICAR Test String,Occurrences: 1,File path: /tmp/eicar.txt,Description: ,Actual action: Quarantined,Requested action: Cleaned,Secondary action: Quarantined,Event time: 2022-10-04 19:10:48,Event Insert Time: 2022-10-04 19:15:22,End Time: 2022-10-04 19:10:48,Last update time: 2022-10-04 19:15:22,Domain Name: Par d\u00e9faut,Group Name: Mydomain\\\\Servers\\\\Linux,Server Name: XXXX01,User Name: user,Source Computer Name: ,Source Computer IP: ,Disposition: Reputation was not used in this detection.,Download site: ,Web domain: ,Downloaded by: ,Prevalence: Reputation was not used in this detection.,Confidence: Reputation was not used in this detection.,URL Tracking Status: N/A,First Seen: Reputation was not used in this detection.,Sensitivity: Low,Allowed application reason: Not on the allow list,Application hash: 131f95c51cc819465fa1797f6ccacf9d494aaaff46fa3eac73ae63ffbdfd8267,Hash type: SHA2,Company name: ,Application name: Unknown,Application version: ,Application type: -1,File size (bytes): 69,Category set: Malware,Category type: Virus,Location: ,Intensive Protection Level: 0,Certificate issuer: ,Certificate signer: ,Certificate thumbprint: ,Signing timestamp: 0,Certificate serial number: ",
    "event": {
        "action": "Cleaned",
        "category": [
            "malware"
        ],
        "kind": "event",
        "reason": "Virus found",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2022-10-04T19:15:22Z",
    "broadcom": {
        "endpoint_protection": {
            "action": {
                "main": "Quarantined",
                "secondary": "Quarantined"
            },
            "application": {
                "code_signature": {
                    "digest_algorithm": "sha2"
                },
                "hash": {
                    "sha2": "131f95c51cc819465fa1797f6ccacf9d494aaaff46fa3eac73ae63ffbdfd8267"
                },
                "name": "Unknown"
            },
            "confidence": "Reputation was not used in this detection.",
            "prevalence": "Reputation was not used in this detection.",
            "protection": {
                "level": 0
            },
            "server": {
                "domain": "Par d\u00e9faut",
                "group": "Mydomain\\\\Servers\\\\Linux",
                "name": "XXXX01"
            },
            "source": "Auto-Protect scan",
            "threat": {
                "category": "Malware",
                "type": "Virus"
            }
        }
    },
    "file": {
        "directory": "/tmp",
        "name": "eicar.txt",
        "path": "/tmp/eicar.txt",
        "size": 69
    },
    "host": {
        "hostname": "MyComputer",
        "ip": "1.2.3.4",
        "name": "MyComputer"
    },
    "observer": {
        "product": "Symantec Endpoint Protection",
        "vendor": "Broadcom"
    },
    "related": {
        "hosts": [
            "MyComputer"
        ],
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "user"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4"
    },
    "threat": {
        "enrichments": [
            {
                "indicator": {
                    "description": "EICAR Test String",
                    "file": {
                        "path": "/tmp/eicar.txt",
                        "size": 69
                    },
                    "first_seen": "2022-10-04T19:10:48.000000Z",
                    "last_seen": "2022-10-04T19:10:48.000000Z",
                    "modified_at": "2022-10-04T19:15:22.000000Z",
                    "sightings": 1,
                    "type": "file"
                }
            }
        ]
    },
    "user": {
        "name": "user"
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name Type Description
@timestamp date Date/time when the event originated.
broadcom.endpoint_protection.action.main keyword
broadcom.endpoint_protection.action.secondary keyword
broadcom.endpoint_protection.application.code_signature.certificate.serial_number keyword
broadcom.endpoint_protection.application.code_signature.certificate.thumbprint keyword
broadcom.endpoint_protection.application.code_signature.digest_algorithm keyword
broadcom.endpoint_protection.application.code_signature.signer keyword
broadcom.endpoint_protection.application.code_signature.subject_name keyword
broadcom.endpoint_protection.application.code_signature.timestamp keyword
broadcom.endpoint_protection.application.hash.sha2 keyword
broadcom.endpoint_protection.application.name keyword
broadcom.endpoint_protection.application.version keyword
broadcom.endpoint_protection.cids.signature.id number The identifier of the CIDS sgnature
broadcom.endpoint_protection.cids.signature.label string The label of the CIDS sgnature
broadcom.endpoint_protection.cids.signature.sub_id number The sub-identifier of the CIDS sgnature
broadcom.endpoint_protection.confidence keyword
broadcom.endpoint_protection.downloaded_by.file.path keyword
broadcom.endpoint_protection.prevalence keyword
broadcom.endpoint_protection.protection.level number The level of intensve protection
broadcom.endpoint_protection.scan.command keyword The command scan
broadcom.endpoint_protection.scan.duration number The duration of the scan in seconds
broadcom.endpoint_protection.scan.id keyword The identifier of the scan
broadcom.endpoint_protection.scan.result.infections number The number of infected files
broadcom.endpoint_protection.scan.result.omitted number The number of omitted files
broadcom.endpoint_protection.scan.result.threats number The number of detected threats
broadcom.endpoint_protection.scan.result.total number The number of total files scanned
broadcom.endpoint_protection.scan.status keyword The status of the scan
broadcom.endpoint_protection.scan.type keyword The type of scan
broadcom.endpoint_protection.server.domain keyword
broadcom.endpoint_protection.server.group keyword
broadcom.endpoint_protection.server.name keyword
broadcom.endpoint_protection.source keyword
broadcom.endpoint_protection.threat.category keyword
broadcom.endpoint_protection.threat.payload string The url of the intrusion payload
broadcom.endpoint_protection.threat.risk string The risk associated to the intrusion url
broadcom.endpoint_protection.threat.type keyword
destination.domain keyword The domain name of the destination.
destination.ip ip IP address of the destination.
destination.mac keyword MAC address of the destination.
destination.port long Port of the destination.
event.action keyword The action captured by the event.
event.category keyword Event category. The second categorization field in the hierarchy.
event.end date event.end contains the date when the event ended or when the activity was last observed.
event.kind keyword The kind of the event. The highest categorization field in the hierarchy.
event.reason keyword Reason why this event happened, according to the source
event.start date event.start contains the date when the event started or when the activity was first observed.
file.hash.md5 keyword MD5 hash.
file.hash.sha256 keyword SHA256 hash.
file.path keyword Full path to the file, including the file name.
file.size long File size in bytes.
host.hostname keyword Hostname of the host.
host.ip ip Host ip addresses.
host.mac keyword Host MAC addresses.
host.name keyword Name of the host.
network.direction keyword Direction of the network traffic.
network.transport keyword Protocol Name corresponding to the field iana_number.
observer.product keyword The product name of the observer.
observer.vendor keyword Vendor name of the observer.
process.args keyword Array of process arguments.
process.executable keyword Absolute path to the process executable.
process.name keyword Process name.
process.pid long Process id.
process.working_directory keyword The working directory of the process.
source.ip ip IP address of the source.
source.port long Port of the source.
threat.enrichments array
url.original wildcard Unmodified original url as seen in the event source.
user.name keyword Short name or login of the user.

Configure

In this guide, you will configure your Symantec Endpoint Protection Manager or your Symantec Endpoint Security to forward events through syslog.

Prerequisites

An internal syslog concentrator is required to collect and forward events to Sekoia.io.

Enable Syslog forwarding

Log on the console of our management server and follow this guide to enable logs forwarding and provide the IP, the transport protocol (we are recommending TCP) and the listening port (514) of the concentrator.

Create the intake

Go to the intake page and create a new intake from the format Symantec Endpoint Protection.

Forward logs to Sekoia.io

Please consult the Syslog Forwarding documentation to forward these logs to Sekoia.io.