New detection rules and observations
This page lists the new detections rules and observations in FortiNDR Cloud. New rules are created every month; however, it possible that a rule is created in a category that already exists.
2024.10.0
| Primary ATT&CK Name | ATR Category |
|---|---|
| Application Layer Protocol | Attack:Command and Control > Connectivity Check |
| DNS | Attack:Command and Control > DNS Tunneling |
| Ingress Tool Transfer | Attack:Installation > Remote File Copy from External |
| LLMNR/NBT-NS Poisoning and SMB Relay | Posture:Anomalous Activity |
| Remote Access Software | Posture:Potentially Unauthorized Software or Device > Remote Admin Tools |
| Symmetric Cryptography | Attack:Command and Control > Other Protocol |
2024.9.0
| Primary ATT&CK Name | ATR Category |
|---|---|
| Abuse Elevation Control Mechanism | Attack:Exploitation |
| Application Layer Protocol | Attack:Command and Control > Web Shell |
| Exploit Public-Facing Application | Attack:Exploitation > Exploit Public-facing Application |
| Non-Application Layer Protocol | Attack:Command and Control > Custom Protocol |
| Web Protocols | Attack:Command and Control > HTTP(S) Beaconing |
2024.8.0
|
Primary ATT&CK Name |
ATR Category |
|---|---|
|
Application Layer Protocol |
Attack:Command and Control > Other Protocol |
|
Domain Account |
Attack:Discovery > Remote System Scanning |
|
Domain Controller Authentication |
Attack:Miscellaneous |
|
Exploit Public-Facing Application |
Attack:Exploitation > Exploit Public-facing Application |
|
Exploitation for Client Execution |
Attack:Exploitation |
|
Exploitation for Privilege Escalation |
Attack:Miscellaneous |
|
Network Denial of Service |
Attack:Impact > Network DoS |
|
Non-Application Layer Protocol |
Attack:Command and Control > Custom Protocol |
2024.6.0
|
Primary ATT&CK Name |
ATR Category |
|---|---|
| Exploit Public-Facing Application | Attack: Exploitation > Exploit Public-facing Application |
| Non-Application Layer Protocol | Attack: Command and Control > Other Protocol |
|
Application Layer Protocol |
Attack: Command and Control > Other Protocol |
|
Web Protocols |
Attack: Command and Control > HTTP(S) Beaconing |
|
Non-Application Layer Protocol |
Attack: Command and Control > Custom Protocol |
|
Ingress Tool Transfer |
Attack: Installation > Remote File Copy from External |
2024.5.0
Rules
|
Primary ATT&CK Name |
ATR Category |
|---|---|
| Exploit Public-Facing Application | Attack: Command and Control > Other Protocol |
|
Non-Application Layer Protocol |
Attack:Command and Control > Other Protocol |
2024.4.0
Rules
|
Primary ATT&CK Name |
ATR Category |
|---|---|
| Network Denial of Service | Attack: Impact > Network DoS |
| Exploit Public-Facing Application | Attack: Exploitation > Exploit Public-facing Application |
| Network Denial of Service | Attack: Impact > Network DoS |
| Network Denial of Service | Posture: Anomalous Activity |
| Network Denial of Service | Attack: Impact > Service DoS |
| Network Denial of Service | Attack: Impact > Network DoS |
2024.3.1
Rules
|
Primary ATT&CK Name |
ATR Category |
|---|---|
| Application Layer Protocol | PUA:Adware |
| Command and Scripting Interpreter | Attack:Exploitation > Exploit Public-facing Application |
| Exfiltration Over Web Service | Attack:Exfiltration > C2 Server Upload |
| Exploit Public-Facing Application | Attack:Exploitation > Exploit Public-facing Application |
| Non-Application Layer Protocol | Attack:Command and Control > Custom Protocol |
| Web Protocols | Attack:Command and Control > HTTP(S) Beaconing |
2024.3.0
Rules
|
Primary ATT&CK Name |
ATR Category |
|---|---|
| Exploit Public-Facing Application | Attack:Exploitation > Exploit Public-facing Application |
| Non-Application Layer Protocol | Posture:Potentially Unauthorized Software or Device |
2024.2.0
Observations
|
Name |
Description |
|---|---|
|
SSL C2 Beaconing Similarity |
Identify SSL connections that resemble Command and Control (C2) beaconing activity: telemetry that tells a C2 server the client is active and /or requests command(s) to execute. This observation performs statistical characterizations of the SSL connection to look for client software that calls back to a server on an extremely periodic schedule. |
Rules
|
Primary ATT&CK Name |
ATR Category |
|---|---|
|
Web Protocols |
Attack:Command and Control > Web Shell |
|
Ingress Tool Transfer |
Attack:Installation > Remote File Copy from External |
|
Domain Groups |
Attack:Discovery > Network Directory Scanning |
|
LLMNR/NBT-NS Poisoning and SMB Relay |
Attack:Infection Vector > LLMNR/NBT-NS Poisoning |
|
Exploitation for Client Execution |
Attack:Exploitation |
|
Lateral Tool Transfer |
Attack:Installation > Remote File Copy from External |
|
Application Layer Protocol |
PUA:Spyware |