Running Malicious Software

The following out-of-the-box alert rules are assigned to the (Windows/Mac) Category: RUNNING MALICIOUS SOFTWARE.

ALERT RULE	Description
Running command-line-based hacking tool	An alert is triggered upon running a hacking tool in the form of a script or executable in command line tools.
Running hacking or spoofing tools	An alert is triggered upon running one of the predefined hacking or spoofing tools on a Windows system that can be used to gain access to restricted areas or to create damage to the organization’s assets.
Running password cracking tools	An alert is triggered upon running one of the predefined password cracking tools that can be used to try and break a password-protected file with potentially sensitive information.
Running port scanning tools	An alert is triggered upon running one of the predefined port scanning tools that can be used as a port scanning attack to gain knowledge about which services are running on a specific machine, and what is the installed OS.

The following out-of-the-box alert rules are assigned to the (Unix/Linux) Category: RUNNING MALICIOUS SOFTWARE.

ALERT RULE	Description
Running a malicious command	An alert is triggered upon running a predefined malicious command. (It is suggested that you periodically review the malicious commands list.)
Running a non-standard SETUID program	An alert is triggered upon detecting the execution of a SETUID program which is not included in the standard SETUID programs.
Running hacking or spoofing tools on Linux	An alert is triggered upon running one of the predefined hacking or spoofing tools on a Linux system that can be used to gain access to restricted areas or to create damage to the organization assets.
Running the NC (netcat) utility	An alert is triggered upon running the NC utility (netcat) that can be used to perform advanced networking actions, such as opening TCP connections, sending UDP packets, and scanning ports.