Forensics Signals
The Forensics feature must be enabled for software agents to capture and report forensic events. The feature can be enabled in Software Agent Config. For more information, see the Software Agent Config section.
When the Forensics feature is enabled, the agent reports the following forensic events.
|
Signal |
Description |
|---|---|
|
Privilege Escalation |
Privilege escalations, such as commands executed with sudo. |
|
User Logon |
User login events. |
|
User Logon Failed |
User login failed attempts. |
|
Shellcode |
Suspicious shell executions resembling shellcode attempts. |
|
File Access |
Accesses on sensitive files such as password files. |
|
User Account |
Adding or removing user accounts. |
|
Unseen Command |
New commands that the agent has not seen. Users can use the command anomaly score to tune results based on scope. See Unseen Command for details. |
|
Unseen Library |
New library that agent have not seen process that is loaded before. |
|
Raw Socket Creation |
Processes creating raw sockets. For example, port knocking. |
|
Binary Changed |
Changes to hash values or modification times of known binaries. |
|
Library Changed |
Changes to hash values or modification times of known libraries. |
|
Side Channel |
Side channel attack attempts (Meltdown). |
|
Follow User Logon |
Descendant processes forked or executed after the login events. |
|
Follow Process |
Follow Process events report processes that match user forensic config rules based on process attributes such as binary path, command string, and others. |
|
Network Anomaly |
Anomalies in network traffic of the workload, see PCR-based Network Anomaly detection for more information. |
|
Signal |
Description |
|---|---|
|
Privilege Escalation |
Privilege escalations, such as commands executed with sudo. |
|
Raw Socket Creation |
Processes creating raw sockets. For example, port knocking. |
|
User Account |
Adding or removing user accounts. |