EVID : 18060 : EPO - Exploit Attempt Detected

Vendor Documentation

https://kcm.trellix.com/corporate/index?page=content&id=KB54677

Classification

Rule Name	Rule Type	Classification	Common Event
EVID : 18060 : EPO - Exploit Attempt Detected	Base Rule	Failed Attack	Failed General Attack Activity

Mapping with LogRhythm Schema

Device Key in Log Message	LogRhythm Schema	Data Type	Schema Description
MachineName	N/A	N/A	Name of the system hosting the detecting product.
AgentGUID	N/A	N/A	Unique identifier of the agent that forwarded the event.
IPAddress	N/A	N/A	IP address of the system hosting the detecting product (if given in the event).
OSName	N/A	N/A	N/A
UserName	N/A	N/A	N/A
TimeZoneBias	N/A	N/A	N/A
RawMACAddress	N/A	N/A	MAC address of the system hosting the detecting product.
ProductName	<vendorinfo>	Text/String	Name of the detecting managed product.
ProductVersion	<version>	Text/String/Number	Version number of the detecting product.
ProductFamily	N/A	N/A	N/A
Analyzer	N/A	N/A	N/A
AnalyzerName	N/A	N/A	Name of the detecting managed product.
AnalyzerVersion	N/A	N/A	Version number of the detecting product.
AnalyzerHostName	N/A	N/A	Name of the system hosting the detecting product.
AnalyzerDetectionMethod	N/A	N/A	The name of the task or task type that was responsible for detecting the threat.
EventID	<vmid>	Number	Unique identifier of the event class.
Severity	N/A	N/A	N/A
GMTTime	N/A	N/A	N/A
ThreatCategory	<subject>	Text/String	Category of the event. Possible categories depend on the product.
ThreatEventID	N/A	N/A	Unique identifier of the event class.
ThreatName	<threatname>	Text/String	Name of the threat.
ThreatType	N/A	N/A	Class of the threat.
DetectedUTC	N/A	N/A	N/A
ThreatActionTaken	<action>	Text/String	The action taken by the product in response to the threat.
ThreatHandled	<result>	Text/String	Specifies whether the action taken was successful.
SourceUserName	<domainorigin> <login>	Text/String	User name from which the threat originated (if given in the event).
SourceProcessName	<process>	Text/String	The process name from which the threat originated.
SourceIPV4	<sip>	IP Address	IPv4 address of the system from which the threat originated (if given in the event).
SourceMAC	<smac>	Text/String	MAC address of the system from which the threat originated (if given in the event).
TargetHostName	<dname>	Text/String	Name of the system that created the event.
TargetUserName	<account>	Text/String	The threat source user name or email address.
TargetFileName	<object>	Text/String	Location of the threat on the detecting system.
TargetIPV4	<dip>	IP Address	IPv4 address of the system that sent the event.
TargetPort	<dport>	Number	The threat target port for threat classes.
TargetMAC	<dmac>	Text/String	MAC address of the system that sent the event.
ThreatSeverity	<severity>	Text/String/Number	The severity of the detected threat as defined by each managed product.