rsync templates

Templates for building policies based on rsync tool usage.

Connection made using rsync

Requirements: Agent version 4.2.5 or later

Detects when a user connects to a host using an rsync utility.

Parameter	Type	Description
rsync parameters
rsync binary name list	Advanced asset list	A list of rsync tool binary names (e.g. rsync, rsync.exe). Case-insensitive matching is used.
Connection parameters
IP addresses	Advanced asset list	A list of IP addresses in CIDR format (e.g. 192.0.2.1/16 or 2001:db8::68/128) to which rsync utilities are authorized or unauthorized to connect.

Tactic	Technique	Sub-technique
TA0042 (Resource Development) attack.mitre.org/tactics/TA0042/	T1588 (Obtain Capabilities) attack.mitre.org/techniques/T1588/

Note: MITRE ATT&CK indicators require Agent 11.4.1+.

Incident clustering rule	Default
Cluster by destination IP	Disabled
Cluster by policy	Disabled

Supported actions: Display message, Lock, Isolate, Take screenshot, Reboot, Kill process

File copied using rsync

Requirements: Agent version 7.8.0 or later

Detects when a user copies a file using an rsync utility.

Parameter	Type	Description
rsync parameters
rsync binary name list	Advanced asset list	A list of rsync tool binary names (e.g. rsync, rsync.exe). Case-insensitive matching is used.
Monitor copy direction	String list	Monitor files when they are copied to or from a directory using rsync.
Ignore rsync between local directories	Boolean	The toggle to enable/disable monitoring rsync where both the source and destination locations are local directories.
File parameters
File paths	Advanced asset list	A list of file paths that users are authorized or unauthorized to copy using rsync. The path can use glob-style pattern matching rules (e.g. C:\Users\**\Shared\** would match all files in the Shared folder under users' home directories and **\*.pdf would match all PDF files). Case-insensitive matching is used.
File path keywords	Advanced asset list	A list of keywords that match if they appear anywhere in the file path (e.g. passwords, secret, confidential) that users are authorized or unauthorized to copy using rsync. Case-insensitive matching is used.
File types	Advanced asset list	A list of MIME type patterns (e.g. audio/mpeg, image/*, application/pdf) to filter on. The * wildcard character can be used to match all MIME types beginning with the specified prefix (e.g. image/* would match files of type image/png, and application/dns* would match files of type application/dns-message). If this parameter is configured and the Agent version supports MIME type identification, the "File extensions" parameter will be ignored. Requires Agent 9.1.0+.
File extensions	Advanced asset list	A list of file extensions (e.g. .doc, .docx, .pdf) that users are authorized or unauthorized to copy using rsync. The dot can be omitted, and case-insensitive matching is used. Note: This parameter is deprecated from Agent 9.1.0+ and will only be used if the "File types" parameter has not been configured or the Agent version does not support MIME type identification. The "File types" parameter should be used instead to identify files of a particular type. For example, PDF files should be matched using the MIME type "application/pdf" (or alternatively, the glob pattern "**\*.pdf") instead of the file extension ".pdf".

Tactic	Technique	Sub-technique
TA0010 (Exfiltration) attack.mitre.org/tactics/TA0010/	T1048 (Exfiltration Over Alternative Protocol) attack.mitre.org/techniques/T1048/

Note: MITRE ATT&CK indicators require Agent 11.4.1+.

Incident clustering rule	Default
Cluster by filename	Disabled
Cluster by file extension	Disabled
Cluster by policy	Disabled

Supported actions: Display message, Lock, Isolate, Take screenshot, Reboot, Kill process, Make shadow copy