Skip to content

Symantec/Broadcom Endpoint Security

Overview

Symantec Endpoint Protection is a client-server solution that protects laptops, desktops, and servers in your network against malware, risks, and vulnerabilities. This product is supported by Broadcom.

Benefit from SEKOIA.IO built-in rules and upgrade Broadcom/Symantec Endpoint Security with the following detection capabilities out-of-the-box.

SEKOIA.IO x Broadcom/Symantec Endpoint Security on ATT&CK Navigator

AdFind Usage

Detects the usage of the AdFind tool. AdFind.exe is a free tool that extracts information from Active Directory. Wizard Spider (Bazar, TrickBot, Ryuk), FIN6 and MAZE operators have used AdFind.exe to collect information about Active Directory organizational units and trust objects

  • Effort: elementary
Adexplorer Usage

Detects the usage of Adexplorer, a legitimate tool from the Sysinternals suite that could be abused by attackers as it can saves snapshots of the Active Directory Database.

  • Effort: advanced
Bloodhound and Sharphound Tools Usage

Detects default process names and default command line parameters used by Bloodhound and Sharphound tools.

  • Effort: intermediate
Burp Suite Tool Detected

Burp Suite is a cybersecurity tool. When used as a proxy service, its purpose is to intercept packets and modify them to send them to the server. Burp Collaborator is a network service that Burp Suite uses to help discover many kinds of vulnerabilities (vulnerabilities scanner)

  • Effort: intermediate
CMSTP Execution

Detects various indicators of Microsoft Connection Manager Profile Installer execution

  • Effort: intermediate
CVE-2020-0688 Microsoft Exchange Server Exploit

Detects the exploitation of CVE-2020-0688. The POC exploit a .NET serialization vulnerability in the Exchange Control Panel (ECP) web page. The vulnerability is due to Microsoft Exchange Server not randomizing the keys on a per-installation basis resulting in them using the same validationKey and decryptionKey values. With knowledge of these, values an attacker can craft a special viewstate to use an OS command to be executed by NT_AUTHORITY\SYSTEM using .NET deserialization. To exploit this vulnerability, an attacker needs to leverage the credentials of an account it had already compromised to authenticate to OWA.

  • Effort: elementary
CVE-2020-17530 Apache Struts RCE

Detects the exploitation of the Apache Struts vulnerability (CVE-2020-17530).

  • Effort: intermediate
CVE-2021-20021 SonicWall Unauthenticated Administrator Access

Detects the exploitation of SonicWall Unauthenticated Admin Access.

  • Effort: advanced
CVE-2021-20023 SonicWall Arbitrary File Read

Detects Arbitrary File Read, which can be used with other vulnerabilities as a mean to obtain outputs generated by attackers, or sensitive data.

  • Effort: advanced
CVE-2021-22893 Pulse Connect Secure RCE Vulnerability

Detects potential exploitation of the authentication by-pass vulnerability that can allow an unauthenticated user to perform remote arbitrary file execution on the Pulse Connect Secure gateway. It is highly recommended to apply the Pulse Secure mitigations and seach for indicators of compromise on affected servers if you are in doubt over the integrity of your Pulse Connect Secure product.

  • Effort: intermediate
Certificate Authority Modification

Installation of new certificate(s) in the Certificate Authority can be used to trick user when spoofing website or to add trusted destinations.

  • Effort: master
Disabled Service

Service disabling can be abused by attacker to deny security mecanisms (eg: firewall, EDR, ect) and it is also often used by cryptominer to exploit as much RAM & CPU as possible on infected host.

  • Effort: advanced
Download Files From Suspicious TLDs

Detects download of certain file types from hosts in suspicious TLDs

  • Effort: master
Exfiltration And Tunneling Tools Execution

Execution of well known tools for data exfiltration and tunneling

  • Effort: advanced
Hijack Legit RDP Session To Move Laterally

Identifies suspicious file creations in the startup folder of a remote system. An adversary could abuse this to move laterally by dropping a malicious script or executable that will be executed after a reboot or user logon.

  • Effort: intermediate
Interactive Terminal Spawned via Python

Identifies when a terminal (tty) is spawned via Python. Attackers may upgrade a simple reverse shell to a fully interactive tty after obtaining initial access to a host.

  • Effort: advanced
Kernel Module Alteration

Kernel module installation can be used to configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems.

  • Effort: advanced
Koadic MSHTML Command

Detects Koadic payload using MSHTML module

  • Effort: intermediate
Network Scanning and Discovery

Tools and command lines used for network discovery from current system

  • Effort: advanced
Network Sniffing

List of common tools used for network packages sniffing

  • Effort: advanced
Network Sniffing Windows

Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

  • Effort: intermediate
PasswordDump SecurityXploded Tool

Detects the execution of the PasswordDump SecurityXploded Tool

  • Effort: elementary
Phorpiex Process Masquerading

Detects specific process executable path used by the Phorpiex botnet to masquerade its system process network activity. It looks for a pattern of a system process executable name that is not legitimate and running from a folder that is created via a random algorithm 13-15 numbers long.

  • Effort: elementary
Possible Malicious File Double Extension

Detects request to potential malicious file with double extension

  • Effort: elementary
ProxyShell Exchange Suspicious Paths

Detects suspicious calls to Exchange resources, in locations related to webshells observed in campaigns using this vulnerability.

  • Effort: elementary
PsExec Process

Detects PsExec execution, command line which contains pstools or installation of the PsExec service. PsExec is a SysInternals which can be used to execute a program on another computer. The tool is as much used by attackers as by administrators.

  • Effort: advanced
Python Exfiltration Tools

Python has some built-in modules or library that could be installed and later be used as exflitration tool by an attacker

  • Effort: advanced
RDP Session Discovery

Detects use of RDP session discovery via qwinsta or quser. Used by some threat actors to know if someone is working via RDP on a server.

  • Effort: advanced
RYUK Ransomeware - martinstevens Username

Detects user name "martinstevens". Wizard Spider is used to add the user name "martinstevens" to the AD of its victims. It was observed in several campaigns; in 2019 and 2020.

  • Effort: elementary
Raccoon Stealer 2.0 Legitimate Third-Party DLL Download URL

Detects Raccoon Stealer 2.0 malware downloading legitimate third-party DLLs from its C2 server. These legitimate DLLs are used by the information stealer to collect data on the compromised hosts.

  • Effort: elementary
SEKOIA.IO Intelligence Feed

Detect threats based on indicators of compromise (IOCs) collected by SEKOIA's Threat and Detection Research team.

  • Effort: elementary
SELinux Disabling

An attacker can disable SELinux to make workstation or server compromise easier as it disables several protections.

  • Effort: intermediate
Suspicious Double Extension

Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spearphishing campaigns

  • Effort: elementary
Suspicious URI Used In A Lazarus Campaign

Detects suspicious requests to a specific URI, usually on an .asp page. The website is often compromised.

  • Effort: intermediate
Symantec EPP Event Blocked

Symantec EPP blocked an action. Careful when activating this rule, it generates lots of events that are not always relevant for detection.

  • Effort: master
Symantec EPP Event Cleaned

Symantec EPP had cleaned action. Careful when activating this rule, it generates lots of events that are not always relevant for detection.

  • Effort: master
Symantec EPP Event Quarantined

Symantec EPP had a quarantined action. Careful when activating this rule, it generates lots of events that are not always relevant for detection.

  • Effort: master
Symantec EPP Event Terminate

Symantec EPP had a process terminate action. Careful when activating this rule, it generates lots of events that are not always relevant for detection.

  • Effort: master
System Info Discovery

System info discovery, attempt to detects basic command use to fingerprint a host

  • Effort: master
Telegram Bot API Request

Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind

  • Effort: advanced
WMI Persistence Script Event Consumer File Write

Detects file writes through WMI script event consumer.

  • Effort: advanced

Event Categories

The following table lists the data source offered by this integration.

Data Source Description
Anti-virus Symantec Endpoint Protection analyses processes and files to prevent malicious actions.

In details, the following table denotes the type of events produced by this integration.

Name Values
Kind event
Category malware, network, process
Type ``

Event Samples

Find below few samples of events and how they are normalized by SEKOIA.IO.

{
    "message": "Site: OSTAM,Server Name: STR04,Domain Name: MyDomain,The client has downloaded the content package successfully,STV02,ADMIN,stv02.local",
    "event": {
        "kind": "event",
        "category": [
            "network"
        ],
        "reason": "The client has downloaded the content package successfully",
        "type": [
            "info"
        ]
    },
    "observer": {
        "vendor": "Broadcom",
        "product": "Symantec Endpoint Protection"
    },
    "host": {
        "hostname": "STV02",
        "name": "stv02.local"
    },
    "user": {
        "name": "ADMIN"
    },
    "broadcom": {
        "endpoint_protection": {
            "server": {
                "domain": "MyDomain",
                "name": "STR04"
            }
        }
    },
    "related": {
        "hosts": [
            "STV02"
        ],
        "user": [
            "ADMIN"
        ]
    }
}
{
    "message": "INT23456,,Blocked,C:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection\\14.3.4615.2000.105\\Bin64\\ccSvcHst.exe,,Begin: 2022-08-29 11:58:20,End Time: 2022-08-29 11:58:20,Rule: ,4428,C:\\PROGRAM FILES\\SMART-X\\CONTROLUPAGENT\\VERSION 8.1.5.634\\CUAGENT.EXE,0,,C:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection\\14.3.4615.2000.105\\Bin64\\ccSvcHst.exe,User Name: Admin,Domain Name: ,Action Type: 55,File size (bytes): ,Device ID: ",
    "event": {
        "kind": "event",
        "category": [
            "process"
        ],
        "action": "Blocked",
        "start": "2022-08-29T11:58:20.000000Z",
        "type": [
            "denied"
        ]
    },
    "observer": {
        "vendor": "Broadcom",
        "product": "Symantec Endpoint Protection"
    },
    "host": {
        "hostname": "INT23456",
        "name": "INT23456"
    },
    "user": {
        "name": "Admin"
    },
    "process": {
        "pid": 4428,
        "executable": "C:\\PROGRAM FILES\\SMART-X\\CONTROLUPAGENT\\VERSION 8.1.5.634\\CUAGENT.EXE",
        "name": "CUAGENT.EXE",
        "working_directory": "C:\\PROGRAM FILES\\SMART-X\\CONTROLUPAGENT\\VERSION 8.1.5.634",
        "args": [
            "C:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection\f.3.4615.2000.105\\Bin64\\ccSvcHst.exe"
        ]
    },
    "related": {
        "hosts": [
            "INT23456"
        ],
        "user": [
            "Admin"
        ]
    }
}
{
    "message": "INT23456,Category: 2,LiveUpdate Manager,\"Event Description: L\u2019installation d\u2019une mise \u00e0 jour de Revocation Data a \u00e9chou\u00e9. Erreur : Echec de la correction de contenu (0xE0010005), DuResult: Succ\u00e8s (0).\",Event time: 2022-10-18 18:09:26,Group Name: MyDomain\\Servers",
    "event": {
        "kind": "event",
        "category": [
            "process"
        ],
        "reason": "L\u2019installation d\u2019une mise \u00e0 jour de Revocation Data a \u00e9chou\u00e9. Erreur : Echec de la correction de contenu (0xE0010005), DuResult: Succ\u00e8s (0).",
        "start": "2022-10-18T18:09:26.000000Z",
        "type": [
            "info"
        ]
    },
    "observer": {
        "vendor": "Broadcom",
        "product": "Symantec Endpoint Protection"
    },
    "host": {
        "hostname": "INT23456",
        "name": "INT23456"
    },
    "broadcom": {
        "endpoint_protection": {
            "source": "LiveUpdate Manager",
            "server": {
                "group": "MyDomain\\Servers"
            }
        }
    },
    "related": {
        "hosts": [
            "INT23456"
        ]
    }
}
{
    "message": "Scan ID: 1664847558,Begin: 2022-10-04 17:42:10,End Time: 2022-10-04 17:44:22,Completed,Duration (seconds): 132,User1: Syst\u00e8me,User2: Syst\u00e8me,Analyse lanc\u00e9e sur lecteurs et dossiers s\u00e9lectionn\u00e9s et toutes les extensions.,Analyse Installation standard : Risques : 0 Analys\u00e9s : 1553 Fichiers/Dossiers/Lecteurs omis : 0 Fichiers approuv\u00e9s ignor\u00e9s : 844,Command: Not a command scan (),Threats: 0,Infected: 0,Total files: 1553,Omitted: 0,Computer: DNHFF3453,IP Address: 1.2.3.4,Domain Name: MyDomain,Group Name: MyDomain\\Subdivision\\Citrix VDI persistants,Server Name: XXXXX01,Scan Type: DefWatch",
    "event": {
        "kind": "event",
        "category": [
            "malware"
        ],
        "reason": "Analyse lanc\u00e9e sur lecteurs et dossiers s\u00e9lectionn\u00e9s et toutes les extensions.",
        "start": "2022-10-04T17:42:10.000000Z",
        "type": [
            "info"
        ]
    },
    "observer": {
        "vendor": "Broadcom",
        "product": "Symantec Endpoint Protection"
    },
    "host": {
        "ip": [
            "1.2.3.4"
        ],
        "hostname": "DNHFF3453",
        "name": "DNHFF3453"
    },
    "user": {
        "name": "Syst\u00e8me"
    },
    "broadcom": {
        "endpoint_protection": {
            "server": {
                "domain": "MyDomain",
                "group": "MyDomain\\Subdivision\\Citrix VDI persistants",
                "name": "XXXXX01"
            },
            "scan": {
                "id": "1664847558",
                "duration": 132,
                "command": "Not a command scan ()",
                "type": "DefWatch",
                "result": {
                    "threats": 0,
                    "infections": 0,
                    "total": 1553,
                    "omitted": 0
                },
                "status": "completed"
            }
        }
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "hosts": [
            "DNHFF3453"
        ],
        "user": [
            "Syst\u00e8me"
        ]
    }
}
{
    "message": "SONAR detection now allowed,IP Address: 1.2.3.4,Computer name: DNHFF3453,Source: Auto-Protect scan,Risk name: WS.Reputation.1,Occurrences: 1,File path: c:\\program files (x86)\\visualxxxxxxxxxx\\vtomxvision.exe,Description: ,Actual action: Action invalid,Requested action: Process terminate pending restart,Secondary action: 102,Event time: 2022-07-07 17:01:05,Event Insert Time: 2022-07-07 17:24:14,End Time: 2022-07-07 17:01:05,Last update time: 2022-07-07 17:24:14,Domain Name: MyDomain,Group Name: MyDomain\\Subdivision\\Citrix VDI persistants,Server Name: XXXXX01,User Name: Doe,Source Computer Name: ,Source Computer IP: ,Disposition: Good,Download site: ,Web domain: ,Downloaded by: c:/windows/explorer.exe,Prevalence: This file has been seen by fewer than 50 Symantec users.,Confidence: There is some evidence that this file is trustworthy.,URL Tracking Status: On,First Seen: Symantec has known about this file approximately 2 days.,Sensitivity: ,Allowed application reason: User allow list,Application hash: E13D72DE479A65E6448C779B3B2BCE45DB7B5AE52B1BAA0FE915380A667D3C01,Hash type: SHA2,Company name: Absyss S.A.S,Application name: Visual TOM,Application version: 6.6.1 (FR),Application type: 127,File size (bytes): 67352,Category set: Malware,Category type: Insight Network Threat,Location: MyDomain,Intensive Protection Level: 0,Certificate issuer: Absyss,Certificate signer: Sectigo RSA Code Signing CA,Certificate thumbprint: D31433F4C8C0BE4846E7E90318CD0CF5046EE95C,Signing timestamp: 1649155201,Certificate serial number: 044541E287C90A879334BFD15D6A3ED3",
    "event": {
        "reason": "SONAR detection now allowed",
        "kind": "event",
        "category": [
            "process"
        ],
        "type": [
            "info"
        ],
        "action": "Process terminate pending restart"
    },
    "observer": {
        "vendor": "Broadcom",
        "product": "Symantec Endpoint Protection"
    },
    "host": {
        "ip": [
            "1.2.3.4"
        ],
        "hostname": "DNHFF3453",
        "name": "DNHFF3453"
    },
    "user": {
        "name": "Doe"
    },
    "related": {
        "hosts": [
            "DNHFF3453"
        ],
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "Doe"
        ]
    },
    "threat": {
        "enrichments": [
            {
                "indicator": {
                    "type": "file",
                    "first_seen": "2022-07-07T17:01:05.000000Z",
                    "last_seen": "2022-07-07T17:01:05.000000Z",
                    "modified_at": "2022-07-07T17:24:14.000000Z",
                    "sightings": 1,
                    "description": "WS.Reputation.1",
                    "file": {
                        "path": "c:\\program files (x86)\\visualxxxxxxxxxx\\vtomxvision.exe",
                        "size": 67352
                    }
                }
            }
        ]
    },
    "file": {
        "path": "c:\\program files (x86)\\visualxxxxxxxxxx\\vtomxvision.exe",
        "size": 67352
    },
    "broadcom": {
        "endpoint_protection": {
            "source": "Auto-Protect scan",
            "server": {
                "domain": "MyDomain",
                "group": "MyDomain\\Subdivision\\Citrix VDI persistants",
                "name": "XXXXX01"
            },
            "threat": {
                "type": "Insight Network Threat",
                "category": "Malware"
            },
            "application": {
                "code_signature": {
                    "digest_algorithm": "sha2",
                    "subject_name": "Absyss",
                    "signer": "Sectigo RSA Code Signing CA",
                    "timestamp": "2022-04-05T10:40:01.000000Z",
                    "certificate": {
                        "thumbprint": "D31433F4C8C0BE4846E7E90318CD0CF5046EE95C",
                        "serial_number": "044541E287C90A879334BFD15D6A3ED3"
                    }
                },
                "hash": {
                    "sha2": "E13D72DE479A65E6448C779B3B2BCE45DB7B5AE52B1BAA0FE915380A667D3C01"
                },
                "name": "Visual TOM",
                "version": "6.6.1 (FR)"
            },
            "downloaded_by": {
                "file": {
                    "path": "c:/windows/explorer.exe"
                }
            },
            "action": {
                "main": "Action invalid",
                "secondary": "102"
            },
            "prevalence": "This file has been seen by fewer than 50 Symantec users.",
            "confidence": "There is some evidence that this file is trustworthy."
        }
    }
}
{
    "message": "OND345,Category: 2,REP,Event Description: Impossible d\u2019assigner un jeton d\u2019authentification client. Une erreur de communication g\u00e9n\u00e9rale est survenue.,Event time: 2022-08-29 11:35:29,Group Name: Company\\Own",
    "event": {
        "kind": "event",
        "category": [
            "network"
        ],
        "reason": "Impossible d\u2019assigner un jeton d\u2019authentification client. Une erreur de communication g\u00e9n\u00e9rale est survenue.",
        "start": "2022-08-29T11:35:29.000000Z",
        "type": [
            "info"
        ]
    },
    "observer": {
        "vendor": "Broadcom",
        "product": "Symantec Endpoint Protection"
    },
    "host": {
        "hostname": "OND345",
        "name": "OND345"
    },
    "broadcom": {
        "endpoint_protection": {
            "source": "REP",
            "server": {
                "group": "Company\\Own"
            }
        }
    },
    "related": {
        "hosts": [
            "OND345"
        ]
    }
}
{
    "message": "Virus found,IP Address: 1.2.3.4,Computer name: DNHFF3453,Source: Auto-Protect scan,Risk name: EICAR Test String,Occurrences: 1,File path: C:\\Users\\admin\\Desktop\\test.txt,Description: AP realtime deferred scanning,Actual action: Cleaned by deletion,Requested action: Cleaned,Secondary action: Quarantined,Event time: 2022-07-07 14:28:39,Event Insert Time: 2022-07-07 14:30:43,End Time: 2022-07-07 14:28:39,Last update time: 2022-07-07 14:30:43,Domain Name: MyDomain,Group Name: MyDomain\\Subdivision\\Citrix VDI persistants,Server Name: XXXXX01,User Name: ADMIN,Source Computer Name: ,Source Computer IP: ,Disposition: Bad,Download site: ,Web domain: ,Downloaded by: ,Prevalence: This file has been seen by millions of Symantec users.,Confidence: This file is untrustworthy.,URL Tracking Status: On,First Seen: Reputation was not used in this detection.,Sensitivity: ,Allowed application reason: Not on the allow list,Application hash: 275A021BBFB6489E54D471899F7DB9D1663FC695EC2FE2A2C4538AABF651FD0F,Hash type: SHA2,Company name: ,Application name: Nouveau document texte.txt,Application version: ,Application type: 127,File size (bytes): 68,Category set: Malware,Category type: Virus,Location: MyDomain,Intensive Protection Level: 0,Certificate issuer: ,Certificate signer: ,Certificate thumbprint: ,Signing timestamp: ,Certificate serial number: ",
    "event": {
        "reason": "Virus found",
        "kind": "event",
        "category": [
            "malware"
        ],
        "type": [
            "info"
        ],
        "action": "Cleaned"
    },
    "observer": {
        "vendor": "Broadcom",
        "product": "Symantec Endpoint Protection"
    },
    "host": {
        "ip": [
            "1.2.3.4"
        ],
        "hostname": "DNHFF3453",
        "name": "DNHFF3453"
    },
    "user": {
        "name": "ADMIN"
    },
    "related": {
        "hosts": [
            "DNHFF3453"
        ],
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "ADMIN"
        ]
    },
    "threat": {
        "enrichments": [
            {
                "indicator": {
                    "type": "file",
                    "first_seen": "2022-07-07T14:28:39.000000Z",
                    "last_seen": "2022-07-07T14:28:39.000000Z",
                    "modified_at": "2022-07-07T14:30:43.000000Z",
                    "sightings": 1,
                    "description": "EICAR Test String",
                    "file": {
                        "path": "C:\\Users\\admin\\Desktop\\test.txt",
                        "size": 68
                    }
                }
            }
        ]
    },
    "file": {
        "path": "C:\\Users\\admin\\Desktop\\test.txt",
        "size": 68
    },
    "broadcom": {
        "endpoint_protection": {
            "source": "Auto-Protect scan",
            "server": {
                "domain": "MyDomain",
                "group": "MyDomain\\Subdivision\\Citrix VDI persistants",
                "name": "XXXXX01"
            },
            "threat": {
                "type": "Virus",
                "category": "Malware"
            },
            "application": {
                "code_signature": {
                    "digest_algorithm": "sha2"
                },
                "hash": {
                    "sha2": "275A021BBFB6489E54D471899F7DB9D1663FC695EC2FE2A2C4538AABF651FD0F"
                },
                "name": "Nouveau document texte.txt"
            },
            "action": {
                "main": "Cleaned by deletion",
                "secondary": "Quarantined"
            },
            "prevalence": "This file has been seen by millions of Symantec users.",
            "confidence": "This file is untrustworthy."
        }
    }
}
{
    "message": "Virus found,IP Address: 1.2.3.4,Computer name: MyComputer,Source: Auto-Protect scan,Risk name: EICAR Test String,Occurrences: 1,File path: /tmp/eicar.txt,Description: ,Actual action: Quarantined,Requested action: Cleaned,Secondary action: Quarantined,Event time: 2022-10-04 19:10:48,Event Insert Time: 2022-10-04 19:15:22,End Time: 2022-10-04 19:10:48,Last update time: 2022-10-04 19:15:22,Domain Name: Par d\u00e9faut,Group Name: Mydomain\\\\Servers\\\\Linux,Server Name: XXXX01,User Name: user,Source Computer Name: ,Source Computer IP: ,Disposition: Reputation was not used in this detection.,Download site: ,Web domain: ,Downloaded by: ,Prevalence: Reputation was not used in this detection.,Confidence: Reputation was not used in this detection.,URL Tracking Status: N/A,First Seen: Reputation was not used in this detection.,Sensitivity: Low,Allowed application reason: Not on the allow list,Application hash: 131f95c51cc819465fa1797f6ccacf9d494aaaff46fa3eac73ae63ffbdfd8267,Hash type: SHA2,Company name: ,Application name: Unknown,Application version: ,Application type: -1,File size (bytes): 69,Category set: Malware,Category type: Virus,Location: ,Intensive Protection Level: 0,Certificate issuer: ,Certificate signer: ,Certificate thumbprint: ,Signing timestamp: 0,Certificate serial number: ",
    "event": {
        "kind": "event",
        "category": [
            "malware"
        ],
        "reason": "Virus found",
        "action": "Cleaned",
        "type": [
            "info"
        ]
    },
    "observer": {
        "vendor": "Broadcom",
        "product": "Symantec Endpoint Protection"
    },
    "host": {
        "ip": [
            "1.2.3.4"
        ],
        "hostname": "MyComputer",
        "name": "MyComputer"
    },
    "user": {
        "name": "user"
    },
    "file": {
        "path": "/tmp/eicar.txt",
        "size": 69
    },
    "threat": {
        "enrichments": [
            {
                "indicator": {
                    "type": "file",
                    "first_seen": "2022-10-04T19:10:48.000000Z",
                    "last_seen": "2022-10-04T19:10:48.000000Z",
                    "modified_at": "2022-10-04T19:15:22.000000Z",
                    "sightings": 1,
                    "description": "EICAR Test String",
                    "file": {
                        "path": "/tmp/eicar.txt",
                        "size": 69
                    }
                }
            }
        ]
    },
    "broadcom": {
        "endpoint_protection": {
            "source": "Auto-Protect scan",
            "server": {
                "domain": "Par d\u00e9faut",
                "group": "Mydomain\\\\Servers\\\\Linux",
                "name": "XXXX01"
            },
            "application": {
                "hash": {
                    "sha2": "131f95c51cc819465fa1797f6ccacf9d494aaaff46fa3eac73ae63ffbdfd8267"
                },
                "name": "Unknown",
                "code_signature": {
                    "digest_algorithm": "sha2",
                    "timestamp": "1970-01-01T00:00:00.000000Z"
                }
            },
            "action": {
                "main": "Quarantined",
                "secondary": "Quarantined"
            },
            "prevalence": "Reputation was not used in this detection.",
            "confidence": "Reputation was not used in this detection.",
            "threat": {
                "type": "Virus",
                "category": "Malware"
            }
        }
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "hosts": [
            "MyComputer"
        ],
        "user": [
            "user"
        ]
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name Type Description
broadcom.endpoint_protection.action.main keyword
broadcom.endpoint_protection.action.secondary keyword
broadcom.endpoint_protection.application.code_signature.certificate.serial_number keyword
broadcom.endpoint_protection.application.code_signature.certificate.thumbprint keyword
broadcom.endpoint_protection.application.code_signature.digest_algorithm keyword
broadcom.endpoint_protection.application.code_signature.signer keyword
broadcom.endpoint_protection.application.code_signature.subject_name keyword
broadcom.endpoint_protection.application.code_signature.timestamp keyword
broadcom.endpoint_protection.application.hash.sha2 keyword
broadcom.endpoint_protection.application.name keyword
broadcom.endpoint_protection.application.version keyword
broadcom.endpoint_protection.confidence keyword
broadcom.endpoint_protection.downloaded_by.file.path keyword
broadcom.endpoint_protection.prevalence keyword
broadcom.endpoint_protection.scan.command keyword The command scan
broadcom.endpoint_protection.scan.duration number The duration of the scan in seconds
broadcom.endpoint_protection.scan.id keyword The identifier of the scan
broadcom.endpoint_protection.scan.result.infections number The number of infected files
broadcom.endpoint_protection.scan.result.omitted number The number of omitted files
broadcom.endpoint_protection.scan.result.threats number The number of detected threats
broadcom.endpoint_protection.scan.result.total number The number of total files scanned
broadcom.endpoint_protection.scan.status keyword The status of the scan
broadcom.endpoint_protection.scan.type keyword The type of scan
broadcom.endpoint_protection.server.domain keyword
broadcom.endpoint_protection.server.group keyword
broadcom.endpoint_protection.server.name keyword
broadcom.endpoint_protection.source keyword
broadcom.endpoint_protection.threat.category keyword
broadcom.endpoint_protection.threat.type keyword
event.action keyword The action captured by the event.
event.category keyword Event category. The second categorization field in the hierarchy.
event.end date event.end contains the date when the event ended or when the activity was last observed.
event.kind keyword The kind of the event. The highest categorization field in the hierarchy.
event.reason keyword Reason why this event happened, according to the source
event.start date event.start contains the date when the event started or when the activity was first observed.
file.path keyword Full path to the file, including the file name.
file.size long File size in bytes.
host.hostname keyword Hostname of the host.
host.ip ip Host ip addresses.
host.name keyword Name of the host.
observer.product keyword The product name of the observer.
observer.vendor keyword Vendor name of the observer.
process.args keyword Array of process arguments.
process.executable keyword Absolute path to the process executable.
process.name keyword Process name.
process.pid long Process id.
process.working_directory keyword The working directory of the process.
threat.enrichments array
user.name keyword Short name or login of the user.

Configure

In this guide, you will configure your Symantec Endpoint Protection Manager or your Symantec Endpoint Security to forward events through syslog.

Prerequisites

An internal log concentrator (Rsyslog) is required to collect and forward events to SEKOIA.IO.

Enable Syslog forwarding

Log on the console of our management server and follow this guide to enable logs forwarding and provide the IP, the transport protocol (we are recommending TCP) and the listening port (514) of the concentrator.

Create the intake

Go to the intake page and create a new intake from the format Symantec Endpoint Protection.

Transport to SEKOIA.IO

Please consult the Rsyslog Transport documentation to forward these logs to SEKOIA.IO.