LogRhythm Echo Use Cases and Their AIE Rules, Lists, and SmartResponses

Required Out-of-the-Box AIE Rules

CSC: Temporary Account Used
CSC: Password Modified by Another User
CSC: Accounts Disabled by Admin
Lateral: Account Added to Admin Group
Lateral: Multiple Account Passwords Modified by Admin

AIE Rule Use Cases

The following table has additional information about which AIE rules go with which use cases.

[ID] Use Case	AIE Rule	Import File
[1] UEBA Finance Data *	Finance Account Anomaly: Privilege Escalation v2 Finance Account Anomaly: Suspicious File Access v2 Finance Account Anomaly: Temporary Account Usage v2 Finance Account Compromise: Corroborated Anomalies v2	UC1a_AIERule.airx UC1b_AIERule.airx UC1c_AIERule.airx UC1d_AIERule.airx
[8] Sensitive Data Exfiltration *	Suspicious: Sensitive Data Exfiltration v2	UC8_AIERule.airx
[14] SSH on Non-Standard Port	Inbound SSH on Non-standard Port	UC14_AIERule.airx
[17] Carbon Black – Unknown Binary	Suspicious Process - Carbon Black - Unknown Binary Running	UC17_AIERule.airx
[18] Concurrent VPN Account Usage	Concurrent VPN from Multiple Locations	UC18_AIERule.airx
[19] Temporary Account Used	CSC: Temporary Account Used	OOTB
[23] NetMon/LogRhythm DPA – Detect Credit Card	DPA rule and AIE rule together	UC23_AIERule.airx
[25] Account Anomaly – Password Modified by Another User	CSC: Password Modified by Another User	OOTB
[26] Admin Changing Multiple Account Passwords	Lateral: Multiple Account Passwords Modified by Admin	OOTB
[27] Account Anomaly - Admin Disabling Multiple Accounts	CSC: Accounts Disabled by Admin	OOTB
[28] Account Anomaly - Account Added to Administrator Group	Lateral: Account Added to Admin Group	OOTB
[29] Single Password Changed by Admin	Password Modified by Admin	UC29_AIERule.airx
[34] Carbon Black – End User PowerShell Network Activity	Carbon Black - End User PowerShell Network Activity	UC34_AIERule.airx
[34] Carbon Black – End User PowerShell Network Activity	[SmartResponse] Endpoint Lockdown Used by AIE Rule “Carbon Black - End User PowerShell Network Activity”	UC34_SRPlugin.lpi
[35] Ops - Printer Misuse: Excessive Pages Printed	Excessive Pages Printed	UC35_AIERule.airx
[39] Unauthorized Sudo Attempt	CSC: Linux sudo Failure	UC39_AIERule.airx
[43] VPN While Logged in Locally Admin	Concurrent VPN from Multiple Locations	UC43_AIERule.airx
[46] Cylance - Malware Outbreak	Cylance - Malware Detected	UC46_AIERule.airx

MITRE ATT&CK Use Cases

With the introduction of Echo 2.0.14 in LogRhythm SIEM version 7.26.0, the available use case library has been expanded with 20 MITRE ATT&CK-aligned use cases designed to accelerate validation, testing, and demonstration activities. These optional use cases are automatically available through the Bulk Importer function. Additional MITRE ATT&CK use cases and content can be developed and customised through LogRhythm Professional Services, with more than 280 potential detection scenarios available for implementation.

The [X] IDs shown below are provided as placeholders. Because these MITRE ATT&CK use cases are optional and imported separately through the Bulk Importer, the assigned use case IDs may vary depending on the import order and existing content within the Echo database. These use cases are not pre-populated in the default usecases.db and are assigned identifiers when imported, so the IDs may be different for different users.

[ID] Use Case	MITRE Technique	Import File
[X] LSASS Dump via ProcDump	T1003.001 - OS Credential Dumping	T1003.001_LSASS_Dump_via_ProcDump.xml
[X] LSASS Dump via comsvcs.dll	T1003.001 - OS Credential Dumping	T1003.001_LSASS_Dump_via_comsvcs_dll.xml
[X] /etc/passwd and /etc/shadow Dump	T1003.008 - OS Credential Dumping	T1003.008__etc_passwd_and_etc_shadow_Dump.xml
[X] Credentials from Browser	T1555.003 - Credentials from Web Browsers	T1555.003_Credentials_from_Browser.xml
[X] Golden Ticket Attack	T1558.001 - Golden Ticket	T1558.001_Golden_Ticket_Attack.xml
[X] Kerberoasting	T1558.003 - Kerberoasting	T1558.003_Kerberoasting.xml
[X] RDP Lateral Movement - Cisco ASA	T1021.001 - Remote Desktop Protocol	T1021.001_Remote_Services_RDP-Lateral_Movement_Detected-Cisco_ASA.xml
[X] DCOM Lateral Movement via MMC20	T1021.003 - Distributed Component Object Model	T1021.003_DCOM_Lateral_Movement_via_MMC20_Application.xml
[X] WMI Remote Execution	T1047 - Windows Management Instrumentation	T1047_WMI_Remote_Execution_for_Lateral_Movement.xml
[X] Remote Scheduled Task Creation	T1053.005 - Scheduled Task/Job	T1053.005_Remote_Scheduled_Task_Creation.xml
[X] Domain Account Created	T1136.002 - Create Domain Account	T1136.002_Domain_Account_Created.xml
[X] Registry Run Keys Persistence	T1547.001 - Registry Run Keys / Startup Folder	T1547.001_Boot_Autostart-Registry_Run_Keys.xml
[X] Kernel Module Rootkit	T1547.006 - Kernel Modules and Extensions	T1547.006_Kernel_Module-Persistence_via_Rootkit.xml
[X] PowerShell AMSI Bypass	T1059.001 - PowerShell	T1059.001_PS_AMSI_Bypass.xml
[X] Unix Shell Reverse Shell	T1059.004 - Unix Shell	T1059.004_Unix_Shell-Reverse_Shell.xml
[X] Setuid/Setgid Abuse	T1548.001 - Setuid and Setgid	T1548.001_Setuid_Setgid_Abuse-Privilege_Escalation.xml
[X] UAC Bypass	T1548.002 - Bypass User Account Control	T1548.002_Abuse_Elevation-Bypass_UAC.xml
[X] HTTP C2 Beaconing	T1071.001 - Web Protocols	T1071.001_C2_HTTP_Beaconing-Cisco_ASA.xml
[X] VPN Auth After Multiple Failures	T1078 - Valid Accounts	T1078_Valid_Accounts-Successful_VPN_Auth_After_Multiple_Failures-Cisco_ASA.xml
[X] Brute Force - Cisco ASA Admin	T1110 - Brute Force	T1110_Brute_Force-Cisco_ASA_Admin.xml