Symantec/Broadcom Endpoint Security
Overview
Symantec Endpoint Protection is a client-server solution that protects laptops, desktops, and servers in your network against malware, risks, and vulnerabilities. This product is supported by Broadcom.
Related Built-in Rules
The following Sekoia.io built-in rules match the intake Broadcom/Symantec Endpoint Security. This documentation is updated automatically and is based solely on the fields used by the intake which are checked against our rules. This means that some rules will be listed but might not be relevant with the intake.
SEKOIA.IO x Broadcom/Symantec Endpoint Security on ATT&CK Navigator
AdFind Usage
Detects the usage of the AdFind tool. AdFind.exe is a free tool that extracts information from Active Directory. Wizard Spider (Bazar, TrickBot, Ryuk), FIN6 and MAZE operators have used AdFind.exe to collect information about Active Directory organizational units and trust objects
- Effort: elementary
Adexplorer Usage
Detects the usage of Adexplorer, a legitimate tool from the Sysinternals suite that could be abused by attackers as it can saves snapshots of the Active Directory Database.
- Effort: advanced
AutoIt3 Execution From Suspicious Folder
Detects AutoIt3 execution from an unusual/suspicious folder. Legitimate folders are "Program Files" and "AppData\Local". AutoIt3.exe is a legitimate process used to execute AutoIt program files, which are used by legitimate software, custom scripts, but also malware. Finding AutoIt3 execution from unusual/suspicious folder can help detect malware activities, such as DarkGate execution. The detection rule can be tailored to your environment and your use of AutoIt3 by filtering out folder's execution of legitimate applications or scripts.
- Effort: advanced
Bloodhound and Sharphound Tools Usage
Detects default process names and default command line parameters used by Bloodhound and Sharphound tools.
- Effort: intermediate
Broadcom/Symantec Endpoint Security Event Blocked
Broadcom/Symantec Endpoint Security blocked an action. Careful when activating this rule, it generates lots of events that are not always relevant for detection.
- Effort: master
Broadcom/Symantec Endpoint Security Event Cleaned
Broadcom/Symantec Endpoint Security had cleaned action. Careful when activating this rule, it generates lots of events that are not always relevant for detection.
- Effort: master
Broadcom/Symantec Endpoint Security Event Quarantined
Broadcom/Symantec Endpoint Security had a quarantined action. Careful when activating this rule, it generates lots of events that are not always relevant for detection.
- Effort: master
Broadcom/Symantec Endpoint Security Event Terminate
Broadcom/Symantec Endpoint Security had a process terminate action. Careful when activating this rule, it generates lots of events that are not always relevant for detection.
- Effort: master
Burp Suite Tool Detected
Burp Suite is a cybersecurity tool. When used as a proxy service, its purpose is to intercept packets and modify them to send them to the server. Burp Collaborator is a network service that Burp Suite uses to help discover many kinds of vulnerabilities (vulnerabilities scanner)
- Effort: intermediate
CVE-2020-0688 Microsoft Exchange Server Exploit
Detects the exploitation of CVE-2020-0688. The POC exploit a .NET serialization vulnerability in the Exchange Control Panel (ECP) web page. The vulnerability is due to Microsoft Exchange Server not randomizing the keys on a per-installation basis resulting in them using the same validationKey and decryptionKey values. With knowledge of these, values an attacker can craft a special viewstate to use an OS command to be executed by NT_AUTHORITY\SYSTEM using .NET deserialization. To exploit this vulnerability, an attacker needs to leverage the credentials of an account it had already compromised to authenticate to OWA.
- Effort: elementary
CVE-2020-17530 Apache Struts RCE
Detects the exploitation of the Apache Struts vulnerability (CVE-2020-17530).
- Effort: intermediate
CVE-2021-20021 SonicWall Unauthenticated Administrator Access
Detects the exploitation of SonicWall Unauthenticated Admin Access.
- Effort: advanced
CVE-2021-20023 SonicWall Arbitrary File Read
Detects Arbitrary File Read, which can be used with other vulnerabilities as a mean to obtain outputs generated by attackers, or sensitive data.
- Effort: advanced
CVE-2021-22893 Pulse Connect Secure RCE Vulnerability
Detects potential exploitation of the authentication by-pass vulnerability that can allow an unauthenticated user to perform remote arbitrary file execution on the Pulse Connect Secure gateway. It is highly recommended to apply the Pulse Secure mitigations and seach for indicators of compromise on affected servers if you are in doubt over the integrity of your Pulse Connect Secure product.
- Effort: intermediate
Certificate Authority Modification
Installation of new certificate(s) in the Certificate Authority can be used to trick user when spoofing website or to add trusted destinations.
- Effort: master
Detect requests to Konni C2 servers
This rule detects requests to Konni C2 servers. These patterns come from an analysis done in 2022, September.
- Effort: elementary
Disabled Service
Service disabling can be abused by attacker to deny security mecanisms (eg: firewall, EDR, ect) and it is also often used by cryptominer to exploit as much RAM & CPU as possible on infected host.
- Effort: advanced
Download Files From Suspicious TLDs
Detects download of certain file types from hosts in suspicious TLDs
- Effort: master
Exfiltration And Tunneling Tools Execution
Execution of well known tools for data exfiltration and tunneling
- Effort: advanced
Hijack Legit RDP Session To Move Laterally
Identifies suspicious file creations in the startup folder of a remote system. An adversary could abuse this to move laterally by dropping a malicious script or executable that will be executed after a reboot or user logon.
- Effort: intermediate
Interactive Terminal Spawned via Python
Identifies when a terminal (tty) is spawned via Python. Attackers may upgrade a simple reverse shell to a fully interactive tty after obtaining initial access to a host.
- Effort: advanced
Kernel Module Alteration
Kernel module installation can be used to configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems.
- Effort: advanced
Koadic MSHTML Command
Detects Koadic payload using MSHTML module
- Effort: intermediate
Network Scanning and Discovery
Tools and command lines used for network discovery from current system
- Effort: advanced
Network Sniffing
List of common tools used for network packages sniffing
- Effort: advanced
Network Sniffing Windows
Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
- Effort: intermediate
PasswordDump SecurityXploded Tool
Detects the execution of the PasswordDump SecurityXploded Tool
- Effort: elementary
Phorpiex Process Masquerading
Detects specific process executable path used by the Phorpiex botnet to masquerade its system process network activity. It looks for a pattern of a system process executable name that is not legitimate and running from a folder that is created via a random algorithm 13-15 numbers long.
- Effort: elementary
Possible Malicious File Double Extension
Detects request to potential malicious file with double extension
- Effort: elementary
Potential DNS Tunnel
Detects domain name which is longer than 95 characters. Long domain names are distinctive of DNS tunnels.
- Effort: advanced
ProxyShell Exchange Suspicious Paths
Detects suspicious calls to Exchange resources, in locations related to webshells observed in campaigns using this vulnerability.
- Effort: elementary
PsExec Process
Detects PsExec execution, command line which contains pstools or installation of the PsExec service. PsExec is a SysInternals which can be used to execute a program on another computer. The tool is as much used by attackers as by administrators.
- Effort: advanced
Python Exfiltration Tools
Python has some built-in modules or library that could be installed and later be used as exflitration tool by an attacker
- Effort: advanced
RDP Session Discovery
Detects use of RDP session discovery via qwinsta or quser. Used by some threat actors to know if someone is working via RDP on a server.
- Effort: advanced
RYUK Ransomeware - martinstevens Username
Detects user name "martinstevens". Wizard Spider is used to add the user name "martinstevens" to the AD of its victims. It was observed in several campaigns; in 2019 and 2020.
- Effort: elementary
Remote Monitoring and Management Software - AnyDesk
Detect artifacts related to the installation or execution of the Remote Monitoring and Management tool AnyDesk.
- Effort: master
SEKOIA.IO Intelligence Feed
Detect threats based on indicators of compromise (IOCs) collected by SEKOIA's Threat and Detection Research team.
- Effort: elementary
SELinux Disabling
An attacker can disable SELinux to make workstation or server compromise easier as it disables several protections.
- Effort: intermediate
Suspicious Double Extension
Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spearphishing campaigns
- Effort: advanced
Suspicious URI Used In A Lazarus Campaign
Detects suspicious requests to a specific URI, usually on an .asp page. The website is often compromised.
- Effort: intermediate
System Info Discovery
System info discovery, attempt to detects basic command use to fingerprint a host
- Effort: master
Telegram Bot API Request
Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind
- Effort: advanced
Venom Multi-hop Proxy agent detection
Detects Venom Multi-hop Proxy agent.
- Effort: intermediate
WMI Persistence Script Event Consumer File Write
Detects file writes through WMI script event consumer.
- Effort: advanced
Event Categories
The following table lists the data source offered by this integration.
| Data Source | Description |
|---|---|
Anti-virus |
Symantec Endpoint Protection analyses processes and files to prevent malicious actions. |
In details, the following table denotes the type of events produced by this integration.
| Name | Values |
|---|---|
| Kind | event |
| Category | intrusion_detection, malware, network, process |
| Type | `` |
Event Samples
Find below few samples of events and how they are normalized by Sekoia.io.
{
"message": "Site: OSTAM,Server Name: STR04,Domain Name: MyDomain,The client has downloaded the content package successfully,STV02,ADMIN,stv02.local",
"event": {
"category": [
"network"
],
"kind": "event",
"reason": "The client has downloaded the content package successfully",
"type": [
"info"
]
},
"broadcom": {
"endpoint_protection": {
"server": {
"domain": "MyDomain",
"name": "STR04"
}
}
},
"host": {
"hostname": "STV02",
"name": "stv02.local"
},
"observer": {
"product": "Symantec Endpoint Protection",
"vendor": "Broadcom"
},
"related": {
"hosts": [
"STV02"
],
"user": [
"ADMIN"
]
},
"user": {
"name": "ADMIN"
}
}
{
"message": "INT23456,,Blocked,C:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection\\14.3.4615.2000.105\\Bin64\\ccSvcHst.exe,,Begin: 2022-08-29 11:58:20,End Time: 2022-08-29 11:58:20,Rule: ,4428,C:\\PROGRAM FILES\\SMART-X\\CONTROLUPAGENT\\VERSION 8.1.5.634\\CUAGENT.EXE,0,,C:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection\\14.3.4615.2000.105\\Bin64\\ccSvcHst.exe,User Name: Admin,Domain Name: ,Action Type: 55,File size (bytes): ,Device ID: ",
"event": {
"action": "Blocked",
"category": [
"process"
],
"end": "2022-08-29T11:58:20Z",
"kind": "event",
"start": "2022-08-29T11:58:20Z",
"type": [
"denied"
]
},
"@timestamp": "2022-08-29T11:58:20Z",
"host": {
"hostname": "INT23456",
"name": "INT23456"
},
"observer": {
"product": "Symantec Endpoint Protection",
"vendor": "Broadcom"
},
"process": {
"args": [
"C:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection\f.3.4615.2000.105\\Bin64\\ccSvcHst.exe"
],
"executable": "C:\\PROGRAM FILES\\SMART-X\\CONTROLUPAGENT\\VERSION 8.1.5.634\\CUAGENT.EXE",
"name": "CUAGENT.EXE",
"pid": 4428,
"working_directory": "C:\\PROGRAM FILES\\SMART-X\\CONTROLUPAGENT\\VERSION 8.1.5.634"
},
"related": {
"hosts": [
"INT23456"
],
"user": [
"Admin"
]
},
"user": {
"name": "Admin"
}
}
{
"message": "INT23456,1.2.3.4,Continue,Le contr\u00f4le des applications et des p\u00e9riph\u00e9riques est pr\u00eat.,Syst\u00e8me,Begin: 2022-10-19 06:45:39,End Time: 2022-10-19 06:45:39,Rule: R\u00e8gle int\u00e9gr\u00e9e,0,SysPlant,0,SysPlant,Aucun(e),User Name: Aucun(e),Domain Name: DOMAIN,Action Type: ,File size (bytes): 0,Device ID: ",
"event": {
"action": "Continue",
"category": [
"process"
],
"end": "2022-10-19T06:45:39Z",
"kind": "event",
"reason": "Le contr\u00f4le des applications et des p\u00e9riph\u00e9riques est pr\u00eat.",
"start": "2022-10-19T06:45:39Z",
"type": [
"info"
]
},
"@timestamp": "2022-10-19T06:45:39Z",
"broadcom": {
"endpoint_protection": {
"server": {
"domain": "DOMAIN"
}
}
},
"file": {
"size": 0
},
"host": {
"hostname": "INT23456",
"ip": "1.2.3.4",
"name": "INT23456"
},
"observer": {
"product": "Symantec Endpoint Protection",
"vendor": "Broadcom"
},
"process": {
"executable": "SysPlant",
"name": "SysPlant",
"pid": 0
},
"related": {
"hosts": [
"INT23456"
],
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4"
}
}
{
"message": "INT23456,Category: 2,LiveUpdate Manager,\"Event Description: L\u2019installation d\u2019une mise \u00e0 jour de Revocation Data a \u00e9chou\u00e9. Erreur : Echec de la correction de contenu (0xE0010005), DuResult: Succ\u00e8s (0).\",Event time: 2022-10-18 18:09:26,Group Name: MyDomain\\Servers",
"event": {
"category": [
"process"
],
"kind": "event",
"reason": "L\u2019installation d\u2019une mise \u00e0 jour de Revocation Data a \u00e9chou\u00e9. Erreur : Echec de la correction de contenu (0xE0010005), DuResult: Succ\u00e8s (0).",
"start": "2022-10-18T18:09:26Z",
"type": [
"info"
]
},
"@timestamp": "2022-10-18T18:09:26Z",
"broadcom": {
"endpoint_protection": {
"server": {
"group": "MyDomain\\Servers"
},
"source": "LiveUpdate Manager"
}
},
"host": {
"hostname": "INT23456",
"name": "INT23456"
},
"observer": {
"product": "Symantec Endpoint Protection",
"vendor": "Broadcom"
},
"related": {
"hosts": [
"INT23456"
]
}
}
{
"message": "INT23456,Category: 2,LiveUpdate Manager,\"Event Description: L\u2019installation d\u2019une mise \u00e0 jour de Virus and Spyware Definitions SDS Win64 (Reduced) a \u00e9chou\u00e9. Erreur : Echec de la correction de contenu (0xE0010005), DuResult: Succ\u00e8s (0).\",Event time: 2022-10-19 07:32:25,Group Name: MyDomain\\Servers",
"event": {
"category": [
"malware"
],
"kind": "event",
"reason": "L\u2019installation d\u2019une mise \u00e0 jour de Virus and Spyware Definitions SDS Win64 (Reduced) a \u00e9chou\u00e9. Erreur : Echec de la correction de contenu (0xE0010005), DuResult: Succ\u00e8s (0).",
"start": "2022-10-19T07:32:25Z",
"type": [
"info"
]
},
"@timestamp": "2022-10-19T07:32:25Z",
"broadcom": {
"endpoint_protection": {
"server": {
"group": "MyDomain\\Servers"
},
"source": "LiveUpdate Manager"
}
},
"host": {
"hostname": "INT23456",
"name": "INT23456"
},
"observer": {
"product": "Symantec Endpoint Protection",
"vendor": "Broadcom"
},
"related": {
"hosts": [
"INT23456"
]
}
}
{
"message": "INT23456,Event Description: [SID\u00a0: 32329] attaque de Audit: Malicious Scan Attempt 2 d\u00e9tect\u00e9e mais pas bloqu\u00e9e. Chemin d\u2019application\u00a0: SYSTEM,Event Type: ,Local Host IP: 1.2.3.4,Local Host MAC: 000000000000,Remote Host Name: ,Remote Host IP: 5.6.7.8,Remote Host MAC: 000000000000,Outbound,TCP,,Begin: 2022-10-19 09:25:40,End Time: 2022-10-19 09:25:40,Occurrences: 1,Application: SYSTEM,Location: Par d\u00e9faut,User Name: none,Domain Name: ,Local Port: 443,Remote Port: 14867,CIDS Signature ID: 32329,CIDS Signature string: Audit: Malicious Scan Attempt 2,CIDS Signature SubID: 68040,Intrusion URL: http://9.8.7.6:443/,Intrusion Payload URL: ,SHA-256: 0000000000000000000000000000000000000000000000000000000000000000,MD-5: ,Intensive Protection Level: N/A,URL Risk: N/A,URL Category: N/A",
"event": {
"category": [
"intrusion_detection"
],
"end": "2022-10-19T09:25:40Z",
"kind": "event",
"reason": "attaque de Audit: Malicious Scan Attempt 2 d\u00e9tect\u00e9e mais pas bloqu\u00e9e. Chemin d\u2019application\u00a0: SYSTEM",
"start": "2022-10-19T09:25:40Z",
"type": [
"info"
]
},
"@timestamp": "2022-10-19T09:25:40Z",
"broadcom": {
"endpoint_protection": {
"application": {
"name": "SYSTEM"
},
"cids": {
"signature": {
"id": 32329,
"label": "Audit: Malicious Scan Attempt 2",
"sub_id": 68040
}
}
}
},
"destination": {
"address": "5.6.7.8",
"ip": "5.6.7.8",
"port": 14867
},
"host": {
"hostname": "INT23456",
"ip": "1.2.3.4",
"name": "INT23456"
},
"network": {
"direction": "outbound",
"transport": "tcp"
},
"observer": {
"product": "Symantec Endpoint Protection",
"vendor": "Broadcom"
},
"related": {
"hosts": [
"INT23456"
],
"ip": [
"1.2.3.4",
"5.6.7.8"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 443
},
"threat": {
"enrichments": [
{
"indicator": {
"sightings": 1,
"type": "file"
}
}
]
},
"url": {
"domain": "9.8.7.6",
"original": "http://9.8.7.6:443/",
"path": "/",
"port": 443,
"scheme": "http"
}
}
{
"message": "Scan ID: 1664847558,Begin: 2022-10-04 17:42:10,End Time: 2022-10-04 17:44:22,Completed,Duration (seconds): 132,User1: Syst\u00e8me,User2: Syst\u00e8me,Analyse lanc\u00e9e sur lecteurs et dossiers s\u00e9lectionn\u00e9s et toutes les extensions.,Analyse Installation standard : Risques : 0 Analys\u00e9s : 1553 Fichiers/Dossiers/Lecteurs omis : 0 Fichiers approuv\u00e9s ignor\u00e9s : 844,Command: Not a command scan (),Threats: 0,Infected: 0,Total files: 1553,Omitted: 0,Computer: DNHFF3453,IP Address: 1.2.3.4,Domain Name: MyDomain,Group Name: MyDomain\\Subdivision\\Citrix VDI persistants,Server Name: XXXXX01,Scan Type: DefWatch",
"event": {
"category": [
"malware"
],
"end": "2022-10-04T17:44:22Z",
"kind": "event",
"reason": "Analyse lanc\u00e9e sur lecteurs et dossiers s\u00e9lectionn\u00e9s et toutes les extensions.",
"start": "2022-10-04T17:42:10Z",
"type": [
"info"
]
},
"@timestamp": "2022-10-04T17:44:22Z",
"broadcom": {
"endpoint_protection": {
"scan": {
"command": "Not a command scan ()",
"duration": 132,
"id": "1664847558",
"result": {
"infections": 0,
"omitted": 0,
"threats": 0,
"total": 1553
},
"status": "completed",
"type": "DefWatch"
},
"server": {
"domain": "MyDomain",
"group": "MyDomain\\Subdivision\\Citrix VDI persistants",
"name": "XXXXX01"
}
}
},
"host": {
"hostname": "DNHFF3453",
"ip": "1.2.3.4",
"name": "DNHFF3453"
},
"observer": {
"product": "Symantec Endpoint Protection",
"vendor": "Broadcom"
},
"related": {
"hosts": [
"DNHFF3453"
],
"ip": [
"1.2.3.4"
],
"user": [
"Syst\u00e8me"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4"
},
"user": {
"name": "Syst\u00e8me"
}
}
{
"message": "SONAR detection now allowed,IP Address: 1.2.3.4,Computer name: DNHFF3453,Source: Auto-Protect scan,Risk name: WS.Reputation.1,Occurrences: 1,File path: c:\\program files (x86)\\visualxxxxxxxxxx\\vtomxvision.exe,Description: ,Actual action: Action invalid,Requested action: Process terminate pending restart,Secondary action: 102,Event time: 2022-07-07 17:01:05,Event Insert Time: 2022-07-07 17:24:14,End Time: 2022-07-07 17:01:05,Last update time: 2022-07-07 17:24:14,Domain Name: MyDomain,Group Name: MyDomain\\Subdivision\\Citrix VDI persistants,Server Name: XXXXX01,User Name: Doe,Source Computer Name: ,Source Computer IP: ,Disposition: Good,Download site: ,Web domain: ,Downloaded by: c:/windows/explorer.exe,Prevalence: This file has been seen by fewer than 50 Symantec users.,Confidence: There is some evidence that this file is trustworthy.,URL Tracking Status: On,First Seen: Symantec has known about this file approximately 2 days.,Sensitivity: ,Allowed application reason: User allow list,Application hash: E13D72DE479A65E6448C779B3B2BCE45DB7B5AE52B1BAA0FE915380A667D3C01,Hash type: SHA2,Company name: Absyss S.A.S,Application name: Visual TOM,Application version: 6.6.1 (FR),Application type: 127,File size (bytes): 67352,Category set: Malware,Category type: Insight Network Threat,Location: MyDomain,Intensive Protection Level: 0,Certificate issuer: Absyss,Certificate signer: Sectigo RSA Code Signing CA,Certificate thumbprint: D31433F4C8C0BE4846E7E90318CD0CF5046EE95C,Signing timestamp: 1649155201,Certificate serial number: 044541E287C90A879334BFD15D6A3ED3",
"event": {
"action": "Process terminate pending restart",
"category": [
"process"
],
"kind": "event",
"reason": "SONAR detection now allowed",
"type": [
"info"
]
},
"@timestamp": "2022-07-07T17:24:14Z",
"broadcom": {
"endpoint_protection": {
"action": {
"main": "Action invalid",
"secondary": "102"
},
"application": {
"code_signature": {
"certificate": {
"serial_number": "044541E287C90A879334BFD15D6A3ED3",
"thumbprint": "D31433F4C8C0BE4846E7E90318CD0CF5046EE95C"
},
"digest_algorithm": "sha2",
"signer": "Sectigo RSA Code Signing CA",
"subject_name": "Absyss",
"timestamp": "2022-04-05T10:40:01.000000Z"
},
"hash": {
"sha2": "E13D72DE479A65E6448C779B3B2BCE45DB7B5AE52B1BAA0FE915380A667D3C01"
},
"name": "Visual TOM",
"version": "6.6.1 (FR)"
},
"confidence": "There is some evidence that this file is trustworthy.",
"downloaded_by": {
"file": {
"path": "c:/windows/explorer.exe"
}
},
"prevalence": "This file has been seen by fewer than 50 Symantec users.",
"protection": {
"level": 0
},
"server": {
"domain": "MyDomain",
"group": "MyDomain\\Subdivision\\Citrix VDI persistants",
"name": "XXXXX01"
},
"source": "Auto-Protect scan",
"threat": {
"category": "Malware",
"type": "Insight Network Threat"
}
}
},
"file": {
"directory": "c:\\program files (x86)\\visualxxxxxxxxxx",
"name": "vtomxvision.exe",
"path": "c:\\program files (x86)\\visualxxxxxxxxxx\\vtomxvision.exe",
"size": 67352
},
"host": {
"hostname": "DNHFF3453",
"ip": "1.2.3.4",
"name": "DNHFF3453"
},
"observer": {
"product": "Symantec Endpoint Protection",
"vendor": "Broadcom"
},
"related": {
"hosts": [
"DNHFF3453"
],
"ip": [
"1.2.3.4"
],
"user": [
"Doe"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4"
},
"threat": {
"enrichments": [
{
"indicator": {
"description": "WS.Reputation.1",
"file": {
"path": "c:\\program files (x86)\\visualxxxxxxxxxx\\vtomxvision.exe",
"size": 67352
},
"first_seen": "2022-07-07T17:01:05.000000Z",
"last_seen": "2022-07-07T17:01:05.000000Z",
"modified_at": "2022-07-07T17:24:14.000000Z",
"sightings": 1,
"type": "file"
}
}
]
},
"user": {
"name": "Doe"
}
}
{
"message": "OND345,Category: 2,REP,Event Description: Impossible d\u2019assigner un jeton d\u2019authentification client. Une erreur de communication g\u00e9n\u00e9rale est survenue.,Event time: 2022-08-29 11:35:29,Group Name: Company\\Own",
"event": {
"category": [
"network"
],
"kind": "event",
"reason": "Impossible d\u2019assigner un jeton d\u2019authentification client. Une erreur de communication g\u00e9n\u00e9rale est survenue.",
"start": "2022-08-29T11:35:29Z",
"type": [
"info"
]
},
"@timestamp": "2022-08-29T11:35:29Z",
"broadcom": {
"endpoint_protection": {
"server": {
"group": "Company\\Own"
},
"source": "REP"
}
},
"host": {
"hostname": "OND345",
"name": "OND345"
},
"observer": {
"product": "Symantec Endpoint Protection",
"vendor": "Broadcom"
},
"related": {
"hosts": [
"OND345"
]
}
}
{
"message": "Virus found,IP Address: 1.2.3.4,Computer name: DNHFF3453,Source: Auto-Protect scan,Risk name: EICAR Test String,Occurrences: 1,File path: C:\\Users\\admin\\Desktop\\test.txt,Description: AP realtime deferred scanning,Actual action: Cleaned by deletion,Requested action: Cleaned,Secondary action: Quarantined,Event time: 2022-07-07 14:28:39,Event Insert Time: 2022-07-07 14:30:43,End Time: 2022-07-07 14:28:39,Last update time: 2022-07-07 14:30:43,Domain Name: MyDomain,Group Name: MyDomain\\Subdivision\\Citrix VDI persistants,Server Name: XXXXX01,User Name: ADMIN,Source Computer Name: ,Source Computer IP: ,Disposition: Bad,Download site: ,Web domain: ,Downloaded by: ,Prevalence: This file has been seen by millions of Symantec users.,Confidence: This file is untrustworthy.,URL Tracking Status: On,First Seen: Reputation was not used in this detection.,Sensitivity: ,Allowed application reason: Not on the allow list,Application hash: 275A021BBFB6489E54D471899F7DB9D1663FC695EC2FE2A2C4538AABF651FD0F,Hash type: SHA2,Company name: ,Application name: Nouveau document texte.txt,Application version: ,Application type: 127,File size (bytes): 68,Category set: Malware,Category type: Virus,Location: MyDomain,Intensive Protection Level: 0,Certificate issuer: ,Certificate signer: ,Certificate thumbprint: ,Signing timestamp: ,Certificate serial number: ",
"event": {
"action": "Cleaned",
"category": [
"malware"
],
"kind": "event",
"reason": "Virus found",
"type": [
"info"
]
},
"@timestamp": "2022-07-07T14:30:43Z",
"broadcom": {
"endpoint_protection": {
"action": {
"main": "Cleaned by deletion",
"secondary": "Quarantined"
},
"application": {
"code_signature": {
"digest_algorithm": "sha2"
},
"hash": {
"sha2": "275A021BBFB6489E54D471899F7DB9D1663FC695EC2FE2A2C4538AABF651FD0F"
},
"name": "Nouveau document texte.txt"
},
"confidence": "This file is untrustworthy.",
"prevalence": "This file has been seen by millions of Symantec users.",
"protection": {
"level": 0
},
"server": {
"domain": "MyDomain",
"group": "MyDomain\\Subdivision\\Citrix VDI persistants",
"name": "XXXXX01"
},
"source": "Auto-Protect scan",
"threat": {
"category": "Malware",
"type": "Virus"
}
}
},
"file": {
"directory": "C:\\Users\\admin\\Desktop",
"name": "test.txt",
"path": "C:\\Users\\admin\\Desktop\\test.txt",
"size": 68
},
"host": {
"hostname": "DNHFF3453",
"ip": "1.2.3.4",
"name": "DNHFF3453"
},
"observer": {
"product": "Symantec Endpoint Protection",
"vendor": "Broadcom"
},
"related": {
"hosts": [
"DNHFF3453"
],
"ip": [
"1.2.3.4"
],
"user": [
"ADMIN"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4"
},
"threat": {
"enrichments": [
{
"indicator": {
"description": "EICAR Test String",
"file": {
"path": "C:\\Users\\admin\\Desktop\\test.txt",
"size": 68
},
"first_seen": "2022-07-07T14:28:39.000000Z",
"last_seen": "2022-07-07T14:28:39.000000Z",
"modified_at": "2022-07-07T14:30:43.000000Z",
"sightings": 1,
"type": "file"
}
}
]
},
"user": {
"name": "ADMIN"
}
}
{
"message": "Virus found,IP Address: 1.2.3.4,Computer name: MyComputer,Source: Auto-Protect scan,Risk name: EICAR Test String,Occurrences: 1,File path: /tmp/eicar.txt,Description: ,Actual action: Quarantined,Requested action: Cleaned,Secondary action: Quarantined,Event time: 2022-10-04 19:10:48,Event Insert Time: 2022-10-04 19:15:22,End Time: 2022-10-04 19:10:48,Last update time: 2022-10-04 19:15:22,Domain Name: Par d\u00e9faut,Group Name: Mydomain\\\\Servers\\\\Linux,Server Name: XXXX01,User Name: user,Source Computer Name: ,Source Computer IP: ,Disposition: Reputation was not used in this detection.,Download site: ,Web domain: ,Downloaded by: ,Prevalence: Reputation was not used in this detection.,Confidence: Reputation was not used in this detection.,URL Tracking Status: N/A,First Seen: Reputation was not used in this detection.,Sensitivity: Low,Allowed application reason: Not on the allow list,Application hash: 131f95c51cc819465fa1797f6ccacf9d494aaaff46fa3eac73ae63ffbdfd8267,Hash type: SHA2,Company name: ,Application name: Unknown,Application version: ,Application type: -1,File size (bytes): 69,Category set: Malware,Category type: Virus,Location: ,Intensive Protection Level: 0,Certificate issuer: ,Certificate signer: ,Certificate thumbprint: ,Signing timestamp: 0,Certificate serial number: ",
"event": {
"action": "Cleaned",
"category": [
"malware"
],
"kind": "event",
"reason": "Virus found",
"type": [
"info"
]
},
"@timestamp": "2022-10-04T19:15:22Z",
"broadcom": {
"endpoint_protection": {
"action": {
"main": "Quarantined",
"secondary": "Quarantined"
},
"application": {
"code_signature": {
"digest_algorithm": "sha2"
},
"hash": {
"sha2": "131f95c51cc819465fa1797f6ccacf9d494aaaff46fa3eac73ae63ffbdfd8267"
},
"name": "Unknown"
},
"confidence": "Reputation was not used in this detection.",
"prevalence": "Reputation was not used in this detection.",
"protection": {
"level": 0
},
"server": {
"domain": "Par d\u00e9faut",
"group": "Mydomain\\\\Servers\\\\Linux",
"name": "XXXX01"
},
"source": "Auto-Protect scan",
"threat": {
"category": "Malware",
"type": "Virus"
}
}
},
"file": {
"directory": "/tmp",
"name": "eicar.txt",
"path": "/tmp/eicar.txt",
"size": 69
},
"host": {
"hostname": "MyComputer",
"ip": "1.2.3.4",
"name": "MyComputer"
},
"observer": {
"product": "Symantec Endpoint Protection",
"vendor": "Broadcom"
},
"related": {
"hosts": [
"MyComputer"
],
"ip": [
"1.2.3.4"
],
"user": [
"user"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4"
},
"threat": {
"enrichments": [
{
"indicator": {
"description": "EICAR Test String",
"file": {
"path": "/tmp/eicar.txt",
"size": 69
},
"first_seen": "2022-10-04T19:10:48.000000Z",
"last_seen": "2022-10-04T19:10:48.000000Z",
"modified_at": "2022-10-04T19:15:22.000000Z",
"sightings": 1,
"type": "file"
}
}
]
},
"user": {
"name": "user"
}
}
Extracted Fields
The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.
| Name | Type | Description |
|---|---|---|
@timestamp |
date |
Date/time when the event originated. |
broadcom.endpoint_protection.action.main |
keyword |
|
broadcom.endpoint_protection.action.secondary |
keyword |
|
broadcom.endpoint_protection.application.code_signature.certificate.serial_number |
keyword |
|
broadcom.endpoint_protection.application.code_signature.certificate.thumbprint |
keyword |
|
broadcom.endpoint_protection.application.code_signature.digest_algorithm |
keyword |
|
broadcom.endpoint_protection.application.code_signature.signer |
keyword |
|
broadcom.endpoint_protection.application.code_signature.subject_name |
keyword |
|
broadcom.endpoint_protection.application.code_signature.timestamp |
keyword |
|
broadcom.endpoint_protection.application.hash.sha2 |
keyword |
|
broadcom.endpoint_protection.application.name |
keyword |
|
broadcom.endpoint_protection.application.version |
keyword |
|
broadcom.endpoint_protection.cids.signature.id |
number |
The identifier of the CIDS sgnature |
broadcom.endpoint_protection.cids.signature.label |
string |
The label of the CIDS sgnature |
broadcom.endpoint_protection.cids.signature.sub_id |
number |
The sub-identifier of the CIDS sgnature |
broadcom.endpoint_protection.confidence |
keyword |
|
broadcom.endpoint_protection.downloaded_by.file.path |
keyword |
|
broadcom.endpoint_protection.prevalence |
keyword |
|
broadcom.endpoint_protection.protection.level |
number |
The level of intensve protection |
broadcom.endpoint_protection.scan.command |
keyword |
The command scan |
broadcom.endpoint_protection.scan.duration |
number |
The duration of the scan in seconds |
broadcom.endpoint_protection.scan.id |
keyword |
The identifier of the scan |
broadcom.endpoint_protection.scan.result.infections |
number |
The number of infected files |
broadcom.endpoint_protection.scan.result.omitted |
number |
The number of omitted files |
broadcom.endpoint_protection.scan.result.threats |
number |
The number of detected threats |
broadcom.endpoint_protection.scan.result.total |
number |
The number of total files scanned |
broadcom.endpoint_protection.scan.status |
keyword |
The status of the scan |
broadcom.endpoint_protection.scan.type |
keyword |
The type of scan |
broadcom.endpoint_protection.server.domain |
keyword |
|
broadcom.endpoint_protection.server.group |
keyword |
|
broadcom.endpoint_protection.server.name |
keyword |
|
broadcom.endpoint_protection.source |
keyword |
|
broadcom.endpoint_protection.threat.category |
keyword |
|
broadcom.endpoint_protection.threat.payload |
string |
The url of the intrusion payload |
broadcom.endpoint_protection.threat.risk |
string |
The risk associated to the intrusion url |
broadcom.endpoint_protection.threat.type |
keyword |
|
destination.domain |
keyword |
The domain name of the destination. |
destination.ip |
ip |
IP address of the destination. |
destination.mac |
keyword |
MAC address of the destination. |
destination.port |
long |
Port of the destination. |
event.action |
keyword |
The action captured by the event. |
event.category |
keyword |
Event category. The second categorization field in the hierarchy. |
event.end |
date |
event.end contains the date when the event ended or when the activity was last observed. |
event.kind |
keyword |
The kind of the event. The highest categorization field in the hierarchy. |
event.reason |
keyword |
Reason why this event happened, according to the source |
event.start |
date |
event.start contains the date when the event started or when the activity was first observed. |
file.hash.md5 |
keyword |
MD5 hash. |
file.hash.sha256 |
keyword |
SHA256 hash. |
file.path |
keyword |
Full path to the file, including the file name. |
file.size |
long |
File size in bytes. |
host.hostname |
keyword |
Hostname of the host. |
host.ip |
ip |
Host ip addresses. |
host.mac |
keyword |
Host MAC addresses. |
host.name |
keyword |
Name of the host. |
network.direction |
keyword |
Direction of the network traffic. |
network.transport |
keyword |
Protocol Name corresponding to the field iana_number. |
observer.product |
keyword |
The product name of the observer. |
observer.vendor |
keyword |
Vendor name of the observer. |
process.args |
keyword |
Array of process arguments. |
process.executable |
keyword |
Absolute path to the process executable. |
process.name |
keyword |
Process name. |
process.pid |
long |
Process id. |
process.working_directory |
keyword |
The working directory of the process. |
source.ip |
ip |
IP address of the source. |
source.port |
long |
Port of the source. |
threat.enrichments |
array |
|
url.original |
wildcard |
Unmodified original url as seen in the event source. |
user.name |
keyword |
Short name or login of the user. |
Configure
In this guide, you will configure your Symantec Endpoint Protection Manager or your Symantec Endpoint Security to forward events through syslog.
Prerequisites
An internal syslog concentrator is required to collect and forward events to Sekoia.io.
Enable Syslog forwarding
Log on the console of our management server and follow this guide to enable logs forwarding and provide the IP, the transport protocol (we are recommending TCP) and the listening port (514) of the concentrator.
Create the intake
Go to the intake page and create a new intake from the format Symantec Endpoint Protection.
Forward logs to Sekoia.io
Please consult the Syslog Forwarding documentation to forward these logs to Sekoia.io.