NIST – AI Engine Rules

CCF: Data Exfiltration Observed

External attack or compromise followed by data leaving the same system.

Security : Compromise

1. Include All Log Sources

2. Include All Log Sources

CCF: LogRhythm Data Loss Defender Log Inv

No

1193

CCF: Disabled Account Auth Success

Recently disabled or deleted account authenticates or accesses resources on the network.

Security : Compromise

1. Include All Log Sources

2. Include All Log Sources

N/A

No

1194

CCF: Large Outbound Transfer

Single host is seen sending over 1GB of data within 30 minutes out of the network.

Security : Compromise

N/A

No

1195

CCF: Local Account Created and Used

An account is created on a host and then used shortly thereafter on the same host.

Security : Compromise

1. Include All Log Sources

2. Include All Log Sources

N/A

No

1196

CCF: External Brute Force Auths

Successful authentication after multiple failed attempts from different external origin hosts to the same impacted host.

Security : Compromise

1. Include All Log Sources

2. Include All Log Sources

N/A

No

1197

CCF: Auth After Numerous Failed Auths

Multiple external unique login attempts are seen on the same impacted host within a short period of time, followed by a successful authentication.

Security : Compromise

1. Include All Log Sources

2. Include All Log Sources

N/A

No

1199

CCF: Auth After Security Event

An observed attack, compromise, or other security event followed by successful access or authentication from the attacking host.

Security : Compromise

1. Include All Log Sources

2. Include All Log Sources

N/A

No

1200

CCF: Corroborated Data Access Anomalies

2 or more unique behavioral anomalies for data within a 3 hour periods. The alarm requires rule IDs 300-302 be turned on for this alarm to trigger.

Security : Compromise

CCF: Suspicious Users Inv

No

1201

CCF: Data Destruction

Attack event followed by a FIM delete/modify event on the same host.

Security : Compromise

CCF: LogRhythm Data Loss Defender Log Inv

No

1202

CCF: Distributed Brute Force

A successful brute force authentication -- multiple failed authentication attempts from different external hosts to the same host using the same origin login, followed by an authentication success.

Security : Compromise

1. Include All Log Sources

2. Include All Log Sources

N/A

No

1203

CCF: Blacklist Location Auth

Authentication success from a blacklisted location.

No

1204

CCF: Concurrent VPN from Multiple Locations

Multiple VPN authentication successes from the same origin login are observed from different regions within a given time period (default 3 hours).

Security : Compromise

N/A

No

1205

CCF: Critical Event After Attack

An external attack or compromise followed by a critical event on the same host.

Action: This alarm can identify when an error message is generated as the result of a successful attack. This can be unexpected process termination or a hardware fail

Audit : Other Audit Success

1. Include All Log Sources

2. Include All Log Sources

N/A

No

1206

CCF: Corroborated Account Anomalies

3 or more unique behavioral anomalies for a given user within a 3 hour period. This rule requires Rule IDs 285 - 289 be turned on.

Use Case : An account has been compromised.

Security : Compromise

CCF: Suspicious Users Inv

No

1207

CCF: Abnormal Origin Location

First tracks geographic locations for VPN logins. Afterwards, triggers when a new origin location is seen for a user.

Security : Attack

1. Include All Log Sources

2. Include All Log Sources

N/A

No

1208

CCF: LogRhythm Silent Log Source Error Alarm

This AIE Rule creates an alert and provides information when a LogRhythm Log Source has not received logs from a critical or production server-system during the defined error period.

Operations : Warning

CCF: Audit Log Inv

Yes

1209

CCF: Critical/PRD Envir Config/Policy Change Alarm

This AIE rule creates an alert any time a configuration or policy modification logs are received from a critical or production environment (entity structure).

Audit : Policy

CCF: Config/Policy Change Inv

Yes

1210

CCF: Attack then External Connection

An observed external attack or compromise followed by data leaving the system and going to the attacker.

Security : Compromise

1. Include All Log Sources

2. Include All Log Sources

N/A

No

1211

CCF: Critical/PRD Envir Patch Failure Alarm

This AIE rule creates an alert any time a patch fails to apply to the critical or production environments (entity structure).

Operations : Error

CCF: Critical Environment Error Inv

Yes

1212

CCF: Critical/PRD Envir Signature Failure Alarm

This AIE Rule creates an alert on signature update failures on critical or production environments (entity structure).

Operations : Error

CCF: Critical Environment Error Inv

Yes

1213

CCF: Config Change After Attack

Attack event on a host followed by a configuration change made to that host within 3 minutes.

Audit : Policy

1. Include All Log Sources

2. Include All Log Sources

CCF: Config/Policy Change Inv

No

1214

CCF: Time Sync Error Alarm

This AIE Rule creates an event and alerts for any time sync errors occurring on any Log Source.

Operations : Warning

CCF: Time Sync Error Inv

Yes

1215

CCF: Config Change then Critical Error

Configuration change followed by a critical error on the same host indicating an erroneous configuration, malicious intent or otherwise.

Audit : Policy

1. Include All Log Sources

2. Include All Log Sources

CCF: Config/Policy Change Inv

No

1216

CCF: Malware Alarm

This AIE Rule provides details on malware activity across the organization's environment where malware detection/prevention is applied.

Security : Malware

CCF: Malware Detected Inv

Yes

1217

CCF: Vulnerability Detected Alarm

This AIE Rule alerts on the occurrence of vulnerabilities or suspicious events across the organization's environment.

Security : Vulnerability

CCF: Vulnerability Detected Inv

Yes

1218

CCF: Config Deleted/Disabled

Configuration deleted or disabled within the organization infrastructure.  

Audit : Policy

CCF: Config/Policy Change Inv

No

1219

CCF: Rogue Access Point Alarm

This AIE Rule alerts on the occurrence of any rogue access point detection events against the organization's environment.

Security : Suspicious

CCF: Rogue Access Point Inv

Yes

1220

CCF: Config Modified

Configuration modified within the organization infrastructure.

Audit : Policy

CCF: Config/Policy Change Inv

No

1221

CCF: Non-Encrypted Protocol Alarm

This investigation provides details of unencrypted applications being utilized within the critical and production systems or environments (entity structure).

Operations : Information

CCF: Use Of Non-Encrypted Protocols Inv

Yes

1222

CCF: Suspected Wireless Attack Alarm

This AIE Rule creates an event and alerts on suspected wireless attacks (success/failure) against the boundary monitoring devices.

Security : Attack

CCF: Suspected Wireless Attack Inv

Yes

1223

CCF: FIM Information

This AIE Rule creates events for general file integrity monitoring information.

Operations : Information

N/A

No

1229

CCF: Abnormal Amount of Data Transferred

This rule alerts whenever a significant change (400% increase or 75% decrease) in Bytes In or Bytes Out from a specific host.

Operations : Warning

1. Include All Log Sources

2. Include All Log Sources

N/A

No

1230

CCF: Misuse

This AIE Rule provides details on misuse activity.

Security : Misuse

CCF: User Misuse Inv

No

1231

CCF: Data Loss Prevention

This AIE Rule provides details of data generated by the LogRhythm Data Loss Defender or other data loss prevention solutions, when configured.

Operations : Information

CCF: LogRhythm Data Loss Defender Log Inv

No

1232

CCF: FIM Abnormal Activity

This AIE Rule creates events for all abnormal file integrity monitoring activity.

Security: Suspicious

1. Include All Log Sources

2. Include All Log Sources

N/A

No

1233

CCF: FIM Add Activity

This AIE Rule creates events for all file integrity monitoring add activity.

Security: Activity

N/A

No

1234

CCF: FIM Delete Activity Alarm

This AIE Rule alarms on file integrity monitoring delete activity.

Security: Activity

N/A

Yes

1235

CCF: Backup Failure Alarm

More than 10 backup failure events are detected.

Operations : Error

CCF: Backup Activity Inv

Yes

1236

CCF: Backup Information

This AIE Rule creates events for information from backup software.

Operations : Information

CCF: Backup Activity Inv

No

1237

CCF: Early TLS/SSL Alarm

This AIE Rule alerts on the occurrence of any identified TLS LogRhythm Network Monitor event.

Security : Activity

N/A

Yes

1238

CCF: FIM General Activity

This rule creates an event fir file integrity monitoring activity including adds, deletes, modifies, group changes, owner changes, and permissions. The FIM log source can be established from LogRhythm's FIM or other FIM solutions.

Operations : Information

N/A

No

1239

CCF: GeoIP General Activity

This rule is designed to use with the Data Processor's GeoIP functionality, to represent general GeoIP activity.

Security : Suspicious

CCF: GeoIP Inv

No

1240

CCF: GeoIP Blacklisted Region Activity

This rule tracks activity associated with Blacklisted Regions (list).

Security : Suspicious

CCF: GeoIP Inv

No

1241

CCF: Social Media Event

This rule tracks social media activity, to help identify if private or personal data that should not be in transmission is present within the environment's traffic.

Security : Suspicious

CCF: Social Media Inv

No

1242

CCF: Unknown User Account Alarm

This rule identifies activity originating from unknown user accounts, based off of the CCF user lists.

Security : Suspicious

CCF: Unknown User Account Inv

Yes

1243

CCF: Windows RunAs Privilege Escalation

User not in the LogRhythm List "Privileged Users" chooses to Run a Windows program as an administrator using the "Run as administrator" option.

Security : Suspicious

CCF: Privileged Account Escalation Inv

No

1321

CCF: Priv Group Access Granted Alarm

This AIE Rule provides details on access granted to privileged groups (administrators, dnsadmins, domain admins, enterprise admins, schema admins) within the organization infrastructure.

Audit: Access Granted

CCF: Privileged Account Modification Inv

Yes

1324

CCF: Password Modified by Admin

Privileged user changes the password of another account.

Security : Suspicious

CCF: Password Modified Inv

No

1325

CCF: Admin Password Modified

User changes the password of a different privileged user account.

Security: Suspicious

CCF: Password Modified Inv

No

1326

CCF: Multiple Account Passwords Modified by Admin

An observed login by a user in the privileged user list followed by the change of two or more other account passwords.

Security : Suspicious

CCF: Password Modified Inv

No

1327

CCF: Audit Logging Stopped Alarm

This AIE Rule provides details on audit logging being stopped.

Audit : Configuration

CCF: Audit Log Inv

Yes

1328

CCF: Privilege Escalation After Attack Alarm

Compromised host event followed by a new account created or account modified on the same host.

Security : Compromise

CCF: Privileged Account Modification Inv

Yes

1329

CCF: Linux sudo Privilege Escalation

User not in the LogRhythm list "CCF: Privileged Accounts" and not in the local 'sudoers' file tries to use sudo on a Linux host.

Security : Suspicious

CCF: Privileged Account Escalation Inv

No

1330

CCF: Audit Log Cleared Alarm

This AIE Rule provides details on audit log clearing.

Audit : Access Success

CCF: Audit Log Inv

Yes

1331

CCF: Failed Audit Log Write Alarm

This AIE Rule provides details on audit log write failures.

Audit : Other Audit Failure

CCF: Audit Log Inv

Yes

1332

CCF: Password Modified by Another User

User changes the password of another account (not their own).

Audit: Account Modified

CCF: Password Modified Inv

No

1333

CCF: Blacklisted Account Alarm

This AIE creates an alarm when a blacklisted account activity occurs within the environment. This requires the CCF: User Blacklist to be populated and updated regularly.

Audit : Other Audit Success

N/A

Yes

1334

CCF: Compromise Detected Alarm

This AIE rule creates an event and alerts on potential compromises across the environment.

Security : Compromise

CCF: Compromises Detected Inv

Yes

1335

CCF: Account Deleted Rule

This rule provides details of accounts that have been deleted

Audit : Account Deleted

CCF: Deleted Account Inv

No

1367

CCF: Account Enabled Rule

This AIE Rule alerts on the occurrence of any access granting to accounts.

Audit : Access Granted

CCF: Enabled Account Inv

Yes

1368

CCF: Account Disabled Rule

This AIE Rule alerts on the occurrence of any access revoking to accounts.

Audit : Access Revoked

CCF: Disabled Account Inv

No

1369

CCF: Account Modification

This AIE Rule creates a common event and provides detail around account modification activity.

Audit : Account Modified

CCF: Account Modification Inv

No

1377

CCF: Excessive Authentication Failure Rule

This AIE Rule supports alerting on > 10 authentication failures in 30 minutes (login failures). Match this threshold to your organization's specific authentication failure policies.

Audit : Authentication Failure

CCF: Excessive Authentication Failure Inv

Yes

1370

CCF: Software Install Rule

This AIE rule creates an event and alerts on any software installation activity across the environment.

Audit : Configuration

N/A

No

1371

CCF: Software Uninstall Rule

This AIE rule creates an event and alerts on any software uninstallation activity across the environment.

Audit : Configuration

N/A

No

1372

CCF: Concurrent VPN from Same User

This AIE Rule alerts on the occurrence of concurrent VPN from the same user

Security : Suspicious

N/A

No

1373

CCF: Software Uninstall Failure Alarm

This alerts on failed or interrupted software uninstallations.

Audit : Configuration

N/A

Yes

1374

CCF: Software Install Failure Alarm

This alerts on failed and incomplete updates attempts to update or install in the organization.

Audit : Configuration

N/A

Yes

1375

CCF: Denial Of Service Alert

This AIE Rule alerts on the occurrence of any identified Denial of Service event.

Security : Denial Of Service

CCF: Denial of Service Inv

Yes

1376