Attack Scenario
FortiNDR uses attack scenarios to identify malware attacks. FortiNDR scientifically classifies the malware attack times into attack scenarios, making FortiNDR your personal malware analyst on the network.
Most security technologies can only tell you that your network is infected with virus names without much context. FortiNDR moves beyond that to tell you exactly what the malware is trying to achieve providing SOC analysts more insightful information for their investigation.
The Attack Scenario Summary counts the number of incidents of all the attack scenario types. They are organized into Critical, High, Medium, or Low severity.
Scenario types
FortiNDR can detect the following attack scenarios:
Severity |
Scenario |
Description |
---|---|---|
Low | Cryptojacking | Cryptojacking is a type of cybercrime where a malicious actor uses a victim’s computing power to generate cryptocurrency. |
Low | Application | A broad category of software that might download and install additional, unwanted software that could perform activities not approved or expected by the user. |
Low | Web Shell | A script that can be uploaded to a web server to allow remote administration of the machine. Infected web servers can be Internet-facing or internal to the network where the web shell is used to pivot further to internal hosts. |
Low | SEP | Attackers use Search Engine Poisoning to take advantage of your rankings on search engine result pages. |
Low | Phishing | A fraudulent attempt to obtain sensitive information such as usernames, passwords, and credit card details by disguising itself as a trustworthy entity in an electronic communication. |
Medium | Sophisticated | Malware that contains more than one attack scenario. |
Medium | Scenario Heuristic | Scenario heuristic identifies applications or software that demonstrates an array of suspicious traits. |
Medium | DoS | This can access connection handling remotely, perform denial of service, or distributed DoS. |
Medium | Generic Trojan | Any malicious computer program which misleads users of its true intent. |
High | Banking Trojan | Malicious software that can access confidential information stored or processed through online banking systems. |
High | Backdoor | This can give a hacker unauthorized access and control of your computer. |
High | Data Leak | A data leak is when sensitive data is exposed physically on the Internet where malicious actors can access it. |
High | Rootkit | Software tools that enable an unauthorized user to get control of a computer system without being detected. |
High | Exploit | A piece of software, a chunk of data, or a sequence of commands that uses a bug or vulnerability to cause unintended or unanticipated behavior on computer software, hardware, or something electronic, usually computerized. |
High | Botnet | A botnet is a network of hijacked computers and devices infected with bot malware and remotely controlled by a hacker. |
Critical | Ransomware | Malicious software that can block access to a computer system until money is paid. |
Critical | Fileless | A variant of computer-related malicious software that is exclusively a computer memory-based artifact. |
Critical | Wiper | Malware that erases contents in the hard disk of an infected computer. It's usually designed to destroy as many computers as possible inside the victim's networks. |
Critical | Industroyer | A malware framework originally designed to deliver specific cyberattacks on power grids. The recent generation of this malware has also started to target industrial control systems. |
Critical | Worm Activity | A worm is capable of spreading itself to other systems on a network. |