The operations part defines which operations executed by a process raise the indicator. If empty, the indicator is triggered when the process generates an event.
Operations are defined using an operation element with a type attribute and an expression element.
<operation type="WriteFile">Expression</operation>
The following components are supported by all operation.
•
DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
BitsJobAddFile
A file was added to a BITS job.
Supported components:
• BitsJobAddFile
Returns information about a BITS job.
Property
|
Type
|
Description
|
Example
|
FileCount
|
Int
|
Number of files added to the job.
|
1
|
JobTitle
|
String
|
Display name of the BITS job.
|
"UpdateJob-2025-06-03"
|
LocalName
|
String
|
Local destination path for the file.
|
"C:\ProgramData\App\update.bin"
|
RemoteName
|
String
|
Source URL or remote path of the file.
|
"https://cdn.example.com/update.bin"
|
SidNameUse
|
Symbol
|
Which group (its SID type) is behind the given event
|
Groups are:
•1—User
•2—Group
•3—Domain
•4—Alias
•5—WellKnownGroup
•6—DeletedAccount
•7—Invalid
•8—Unknown
•9—Computer
•10—Label
•11—LogonSession |
UserName
|
String
|
Account that owns or created the job.
|
|
UserSid
|
String
|
Security Identifier (SID) of the account.
|
|
Supported operations
•BitsJobAddFile |
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
CodeInjection
A process was subject to some form of code injection.
Supported components:
• ClientProcessInfo
ClientProcessInfo is available only in combination with the WmiExecution, WmiQuery and CodeInjection operations, which have a client process. A client process is a process that actually executed a WMI method.
Property
|
Type
|
Description
|
Example
|
CaseSensitiveCommandLine
|
String
|
Allows creating rules for command line that is case sensitive
|
|
CommandLine
|
String
|
Process command line
|
file.txt
|
CommandLineLength
|
Int
|
Length of the command line
|
123
|
Compromised
|
Bool
|
The process was marked as compromised by a rule with MarkAsCompromised action
|
true/false or 1/0
|
IntegrityLevel
|
Symbol
|
Integrity level of the process
|
Possible values are:
•0—Untrusted
•4096—Low
•8192—Medium
•12288—High
•16384—System
•20480—Protected process |
LnkPath
|
String
|
Contains a path to a shortcut execution
|
|
ProcessDistance
|
Int
|
The distance of the process from the current process
|
123
|
ProcessLevel
|
Int
|
Depth of the process in process hierarchy
|
123
|
ProcessOwner
|
String
|
The user that created the process
|
|
RiskScore
|
Int
|
Score is tracked for each process on the Endpoint. You can use actions IncreaseParentRiskScore or IncreaseRiskScore to increase the value by set amount. When risk score threshold is reached, KillParentProcess or KillProcess action is triggered. You can specify risk score threshold via Policy > ESET Inspect Connector > Advanced settings. The risk score resets after a certain period of time, by default 6 hours.
|
1000
|
Supported operations
•Codeinjection
•WmiExecution
•WmiQuery |
• CodeInjectionInfo
For CodeInjection events, it reports information regarding the code injection technique used.
Property
|
Type
|
Description
|
Example
|
CodeInjectionType
|
Symbol
|
Code injection technique used
|
Possible values are:
•0—CreateRemoteThread
•1—SetThreadContext
•2—ApcQueue |
Supported operations
•CodeInjection |
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• Enterprise
Provides a statistic about modules in the monitored network.
Supported operations
•CreateProcess
•LoadDLL
•CodeInjection
•ModuleDrop |
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• FileItem
Return the information about the current file
Property
|
Type
|
Description
|
Example
|
ADS
|
String
|
The ADS part of the path
|
C:\windows\system32\notepad.exe:example -> example
|
Extension
|
String
|
The file extension
|
C:\windows\system32\notepad.exe -> exe
|
FileName
|
String
|
The filename with the file extension
|
C:\windows\system32\notepad.exe -> notepad.exe
|
FileNameWithoutExtension
|
String
|
Filename without the file extension
|
C:\windows\system32\notepad.exe -> notepad
|
FullPath
|
Path
|
The file path including filename
|
C:\windows\system32\notepad.exe -> C:\windows\system32\notepad.exe
|
NameLength
|
Int
|
The length of the name
|
C:\windows\system32\notepad.exe -> 7
|
Path
|
Path
|
The file path
|
C:\windows\system32\notepad.exe -> C:\windows\system32\
|
isSelf
|
Bool
|
Triggers if the operation is done by the file on itself (common for malware to delete itself)
|
true/false
|
Canary File
Path properties have a special variable for Canary files. The value to specify the path to the Canary file is %CanaryFile%.
<definition>
<operations>
<operation type="WriteFile">
<condition component="FileItem" property="Path" condition="is" value="%CanaryFile%" />
</operation>
</operations>
</definition>
|
Supported operations
•Codeinjection
•CreateNamedPipe
•CreateProcess
•DeleteFile
•LoadDLL
•LoadDriver
•ModuleDrop
•OpenProcess
•ReadFile
•RenameFile
•ScheduledTaskAdded
•ServiceInstalled
•ServiceStarted
•SetFileAttribute
•TruncateFile
•UnloadDriver
•VirtualDiskMounted
•WmiExecution
•WriteFile |
• LiveGrid
ESET LiveGrid is a preventative system that gathers information about threats from users worldwide. The LiveGrid database contains reputation information about potential threats. The reputation of executables helps you to filter rule results.
Property
|
Type
|
Description
|
Example
|
Age
|
Int
|
The number of days since the executable was first seen in LiveGrid. The number is rounded to the equivalent of the week, month, half of the year, year, etc.
|
|
Reputation
|
Int
|
The number on the reputation scale. The higher, the more trusted
|
Possible values are:
•9, 8—Trusted
•7, 6—OK
•5, 4—Risky
•3—PUA, Unknown (not seen by LiveGrid)
•2, 1—Malware |
Popularity
|
Int
|
The number of computers on which LiveGrid has seen an executable. It is rounded to numbers like 10, 100, 1000, 10000, etc. Malware usually does not exceed the popularity of 1000 until it is detected.
|
|
|
|
You cannot rely on LiveGrid values for new executables. Even the most popular and trusted executable (for example, installer of a new version of Google Chrome) has low popularity and an unknown reputation for some time after its release.
|
Supported operations
•CodeInjection
•CreateProcess
•LoadDLL
•ModuleDrop |
• Module
Return the information about the current module.
Property
|
Type
|
Description
|
Example
|
AugurScore
|
Int
|
The score number by ESET machine-learning engine. Possible values are 0 to 99
|
67
|
CompanyName
|
String
|
From version info, name of the company that produced the file
|
"Microsoft Corporation"
|
DaysSinceLastNearMiss
|
Int
|
Number of days since the file was recognized as nearmiss.
Nearmiss—the detection is triggered due to malware, but it may be a false positive (we cannot guarantee it is malware)
|
|
EmulationStatus
|
Int
|
The status of the file emulation (if the file was emulated by advanced heuristics)
|
0—Was not emulated
1—Was emulated
|
FileDescription
|
String
|
From version info, file description shown to users
|
"Microsoft Windows Resource Leak Diagnostic"
|
FileOrigin
|
Symbol
|
File delivered through RDP
|
Possible values are:
0—RDP
|
FileSize
|
Int
|
Filesize in bytes
|
41984
|
FileVersion
|
String
|
From version info, the version number of the file
|
"10.0.14393.0"
|
InternalName
|
String
|
From version info, internal name of the file
|
"RdrLeakDiag.exe"
|
IsDLL
|
Bool
|
The file is a PE DLLs
|
true/false
|
IsElf
|
Bool
|
The file is an ELF file
|
true/false
|
IsExe
|
Bool
|
The file is an executable
|
true/false
|
IsMacho
|
Bool
|
Defines whether a file is a Mach-O (macOS) file or not
|
true/false
|
IsNative
|
Bool
|
The file is a native PE executable
|
true/false
|
isPe
|
Bool
|
The file is a Windows executable
|
true/false
|
MD5
|
Hash
|
md5 hash of the executable
|
|
MachoIsProtected
|
Bool
|
Module is a protected Mach-O executable
|
|
MachoSignatureId
|
String
|
Identifier of a Mach-O file present in the signature
|
"com.apple.ls"
|
MachoSignerCns
|
Set of strings
|
Set of common names from certificates in Mach-O file
|
|
MachoUserId
|
String
|
Unique developer ID assigned by Apple
|
|
OriginalFileName
|
String
|
From version info, original name of the file
|
"RdrLeakDiag.exe"
|
PackerName1
|
String
|
Name of the packer
|
"UPX"
|
ProductName
|
String
|
From version info, name of the product with which the file is distributed
|
"Microsoft Windows Operating System"
|
ProductVersion
|
String
|
From version info, the version number of the product with which the file is distributed
|
"10.0.14393"
|
SFXName
|
String
|
Name of the sfx packer
|
"Zip"
|
Sha1
|
Hash
|
sha1 hash of the executable
|
fa7ebffd41bc44c47ea1b11928ee368c19f6d6a2
|
Sha256
|
Hash
|
sha256 hash of the executable
|
|
SignatureType
|
Symbol
|
Signature type of the executable
|
Possible values are:
•90—Trusted—The signature is trusted by Endpoint
•80—Valid—The signature is trusted by the OS
•75—Adhoc—The certificate is self signed
•70—None—There is no signature in the file
•60—Invalid—The signature is not valid/corrupted/revoked
•50—Present—The signature is present, but the certificate status is unknown
•50—Unknown—Failed to verify certificate |
SignerName
|
String
|
Name of the signer, if any
|
"Microsoft Windows"
|
Tags
|
String
|
Allows a user to filter by a module that has a specified tag attached
|
|
Whitelist
|
Symbol
|
Whitelist type of the executable
|
Possible values are:
•0—None—No whitelisting for this file
•1—Authoritative—The file is whitelisted by Endpoint
•2—LiveGrid—The file is whitelisted from LiveGrid
•3—Certificate—The file certificate is whitelisted |
|
|
1Names of packers may change in the future. Therefore we recommend using isnotempty or isempty value for the condition.
|
Supported operations
•CodeInjection
•CreateProcess
•LoadDLL
•LoadDriver
•ModuleDrop |
• ProcessInfo
Return information about the current process.
Property
|
Type
|
Description
|
Example
|
CaseSensitiveCommandLine
|
String
|
Allows creating rules for command line that is case sensitive
|
|
CommandLine
|
String
|
Process command line
|
file.txt
|
CommandLineLength
|
Int
|
Length of the command line
|
123
|
Compromised
|
Bool
|
The process was marked as compromised by a rule with MarkAsCompromised action
|
true/false or 1/0
|
IntegrityLevel
|
Symbol
|
Integrity level of the process
|
Possible values are:
•0—Untrusted
•4096—Low
•8192—Medium
•12288—High
•16384—System
•20480—Protected process |
LnkPath
|
String
|
Contains a path to a shortcut execution
|
|
ProcessDistance
|
Int
|
The distance of the process from the current process
|
123
|
ProcessLevel
|
Int
|
Depth of the process in process hierarchy
|
123
|
ProcessOwner
|
String
|
The user that created the process
|
|
RiskScore
|
Int
|
Score is tracked for each process on the Endpoint. You can use actions IncreaseParentRiskScore or IncreaseRiskScore to increase the value by set amount. When risk score threshold is reached, KillParentProcess or KillProcess action is triggered. You can specify risk score threshold via Policy > ESET Inspect Connector > Advanced settings. The risk score resets after a certain period of time, by default 6 hours.
|
1000
|
SentBytes
|
Int
|
Total number of bytes sent by the process.
|
|
Supported operations
•CodeInjection
•CreateProcess
•LoadDLL |
• ServiceProcessInfo
Return information about the current service process.
Property
|
Type
|
Description
|
Example
|
CaseSensitiveCommandLine
|
String
|
Allows creating rules for command line that is case sensitive
|
|
CommandLine
|
String
|
Process command line
|
file.txt
|
CommandLineLength
|
Int
|
Length of the command line
|
123
|
Compromised
|
Bool
|
The process was marked as compromised by a rule with MarkAsCompromised action
|
true/false or 1/0
|
IntegrityLevel
|
Symbol
|
Integrity level of the process
|
Possible values are:
•0—Untrusted
•4096—Low
•8192—Medium
•12288—High
•16384—System
•20480—Protected process |
LnkPath
|
String
|
Contains a path to a shortcut execution
|
|
ProcessDistance
|
Int
|
The distance of the process from the current process
|
123
|
ProcessLevel
|
Int
|
Depth of the process in process hierarchy
|
123
|
ProcessOwner
|
String
|
The user that created the process
|
|
RiskScore
|
Int
|
Score is tracked for each process on the Endpoint. You can use actions IncreaseParentRiskScore or IncreaseRiskScore to increase the value by set amount. When risk score threshold is reached, KillParentProcess or KillProcess action is triggered. You can specify risk score threshold via Policy > ESET Inspect Connector > Advanced settings. The risk score resets after a certain period of time, by default 6 hours.
|
1000
|
SentBytes
|
Int
|
Total number of bytes sent by the process.
|
|
Supported operations
•CodeInjection
•CreateProcess
•LoadDLL |
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
CreateNamedPipe
A named pipe was created.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• FileItem
Return the information about the current file
Property
|
Type
|
Description
|
Example
|
ADS
|
String
|
The ADS part of the path
|
C:\windows\system32\notepad.exe:example -> example
|
Extension
|
String
|
The file extension
|
C:\windows\system32\notepad.exe -> exe
|
FileName
|
String
|
The filename with the file extension
|
C:\windows\system32\notepad.exe -> notepad.exe
|
FileNameWithoutExtension
|
String
|
Filename without the file extension
|
C:\windows\system32\notepad.exe -> notepad
|
FullPath
|
Path
|
The file path including filename
|
C:\windows\system32\notepad.exe -> C:\windows\system32\notepad.exe
|
NameLength
|
Int
|
The length of the name
|
C:\windows\system32\notepad.exe -> 7
|
Path
|
Path
|
The file path
|
C:\windows\system32\notepad.exe -> C:\windows\system32\
|
isSelf
|
Bool
|
Triggers if the operation is done by the file on itself (common for malware to delete itself)
|
true/false
|
Canary File
Path properties have a special variable for Canary files. The value to specify the path to the Canary file is %CanaryFile%.
<definition>
<operations>
<operation type="WriteFile">
<condition component="FileItem" property="Path" condition="is" value="%CanaryFile%" />
</operation>
</operations>
</definition>
|
Supported operations
•Codeinjection
•CreateNamedPipe
•CreateProcess
•DeleteFile
•LoadDLL
•LoadDriver
•ModuleDrop
•OpenProcess
•ReadFile
•RenameFile
•ScheduledTaskAdded
•ServiceInstalled
•ServiceStarted
•SetFileAttribute
•TruncateFile
•UnloadDriver
•VirtualDiskMounted
•WmiExecution
•WriteFile |
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
CreateProcess
A process was created.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• Enterprise
Provides a statistic about modules in the monitored network.
Supported operations
•CreateProcess
•LoadDLL
•CodeInjection
•ModuleDrop |
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• FileItem
Return the information about the current file
Property
|
Type
|
Description
|
Example
|
ADS
|
String
|
The ADS part of the path
|
C:\windows\system32\notepad.exe:example -> example
|
Extension
|
String
|
The file extension
|
C:\windows\system32\notepad.exe -> exe
|
FileName
|
String
|
The filename with the file extension
|
C:\windows\system32\notepad.exe -> notepad.exe
|
FileNameWithoutExtension
|
String
|
Filename without the file extension
|
C:\windows\system32\notepad.exe -> notepad
|
FullPath
|
Path
|
The file path including filename
|
C:\windows\system32\notepad.exe -> C:\windows\system32\notepad.exe
|
NameLength
|
Int
|
The length of the name
|
C:\windows\system32\notepad.exe -> 7
|
Path
|
Path
|
The file path
|
C:\windows\system32\notepad.exe -> C:\windows\system32\
|
isSelf
|
Bool
|
Triggers if the operation is done by the file on itself (common for malware to delete itself)
|
true/false
|
Canary File
Path properties have a special variable for Canary files. The value to specify the path to the Canary file is %CanaryFile%.
<definition>
<operations>
<operation type="WriteFile">
<condition component="FileItem" property="Path" condition="is" value="%CanaryFile%" />
</operation>
</operations>
</definition>
|
Supported operations
•Codeinjection
•CreateNamedPipe
•CreateProcess
•DeleteFile
•LoadDLL
•LoadDriver
•ModuleDrop
•OpenProcess
•ReadFile
•RenameFile
•ScheduledTaskAdded
•ServiceInstalled
•ServiceStarted
•SetFileAttribute
•TruncateFile
•UnloadDriver
•VirtualDiskMounted
•WmiExecution
•WriteFile |
• LiveGrid
ESET LiveGrid is a preventative system that gathers information about threats from users worldwide. The LiveGrid database contains reputation information about potential threats. The reputation of executables helps you to filter rule results.
Property
|
Type
|
Description
|
Example
|
Age
|
Int
|
The number of days since the executable was first seen in LiveGrid. The number is rounded to the equivalent of the week, month, half of the year, year, etc.
|
|
Reputation
|
Int
|
The number on the reputation scale. The higher, the more trusted
|
Possible values are:
•9, 8—Trusted
•7, 6—OK
•5, 4—Risky
•3—PUA, Unknown (not seen by LiveGrid)
•2, 1—Malware |
Popularity
|
Int
|
The number of computers on which LiveGrid has seen an executable. It is rounded to numbers like 10, 100, 1000, 10000, etc. Malware usually does not exceed the popularity of 1000 until it is detected.
|
|
|
|
You cannot rely on LiveGrid values for new executables. Even the most popular and trusted executable (for example, installer of a new version of Google Chrome) has low popularity and an unknown reputation for some time after its release.
|
Supported operations
•CodeInjection
•CreateProcess
•LoadDLL
•ModuleDrop |
• Module
Return the information about the current module.
Property
|
Type
|
Description
|
Example
|
AugurScore
|
Int
|
The score number by ESET machine-learning engine. Possible values are 0 to 99
|
67
|
CompanyName
|
String
|
From version info, name of the company that produced the file
|
"Microsoft Corporation"
|
DaysSinceLastNearMiss
|
Int
|
Number of days since the file was recognized as nearmiss.
Nearmiss—the detection is triggered due to malware, but it may be a false positive (we cannot guarantee it is malware)
|
|
EmulationStatus
|
Int
|
The status of the file emulation (if the file was emulated by advanced heuristics)
|
0—Was not emulated
1—Was emulated
|
FileDescription
|
String
|
From version info, file description shown to users
|
"Microsoft Windows Resource Leak Diagnostic"
|
FileOrigin
|
Symbol
|
File delivered through RDP
|
Possible values are:
0—RDP
|
FileSize
|
Int
|
Filesize in bytes
|
41984
|
FileVersion
|
String
|
From version info, the version number of the file
|
"10.0.14393.0"
|
InternalName
|
String
|
From version info, internal name of the file
|
"RdrLeakDiag.exe"
|
IsDLL
|
Bool
|
The file is a PE DLLs
|
true/false
|
IsElf
|
Bool
|
The file is an ELF file
|
true/false
|
IsExe
|
Bool
|
The file is an executable
|
true/false
|
IsMacho
|
Bool
|
Defines whether a file is a Mach-O (macOS) file or not
|
true/false
|
IsNative
|
Bool
|
The file is a native PE executable
|
true/false
|
isPe
|
Bool
|
The file is a Windows executable
|
true/false
|
MD5
|
Hash
|
md5 hash of the executable
|
|
MachoIsProtected
|
Bool
|
Module is a protected Mach-O executable
|
|
MachoSignatureId
|
String
|
Identifier of a Mach-O file present in the signature
|
"com.apple.ls"
|
MachoSignerCns
|
Set of strings
|
Set of common names from certificates in Mach-O file
|
|
MachoUserId
|
String
|
Unique developer ID assigned by Apple
|
|
OriginalFileName
|
String
|
From version info, original name of the file
|
"RdrLeakDiag.exe"
|
PackerName1
|
String
|
Name of the packer
|
"UPX"
|
ProductName
|
String
|
From version info, name of the product with which the file is distributed
|
"Microsoft Windows Operating System"
|
ProductVersion
|
String
|
From version info, the version number of the product with which the file is distributed
|
"10.0.14393"
|
SFXName
|
String
|
Name of the sfx packer
|
"Zip"
|
Sha1
|
Hash
|
sha1 hash of the executable
|
fa7ebffd41bc44c47ea1b11928ee368c19f6d6a2
|
Sha256
|
Hash
|
sha256 hash of the executable
|
|
SignatureType
|
Symbol
|
Signature type of the executable
|
Possible values are:
•90—Trusted—The signature is trusted by Endpoint
•80—Valid—The signature is trusted by the OS
•75—Adhoc—The certificate is self signed
•70—None—There is no signature in the file
•60—Invalid—The signature is not valid/corrupted/revoked
•50—Present—The signature is present, but the certificate status is unknown
•50—Unknown—Failed to verify certificate |
SignerName
|
String
|
Name of the signer, if any
|
"Microsoft Windows"
|
Tags
|
String
|
Allows a user to filter by a module that has a specified tag attached
|
|
Whitelist
|
Symbol
|
Whitelist type of the executable
|
Possible values are:
•0—None—No whitelisting for this file
•1—Authoritative—The file is whitelisted by Endpoint
•2—LiveGrid—The file is whitelisted from LiveGrid
•3—Certificate—The file certificate is whitelisted |
|
|
1Names of packers may change in the future. Therefore we recommend using isnotempty or isempty value for the condition.
|
Supported operations
•CodeInjection
•CreateProcess
•LoadDLL
•LoadDriver
•ModuleDrop |
• ProcessInfo
Return information about the current process.
Property
|
Type
|
Description
|
Example
|
CaseSensitiveCommandLine
|
String
|
Allows creating rules for command line that is case sensitive
|
|
CommandLine
|
String
|
Process command line
|
file.txt
|
CommandLineLength
|
Int
|
Length of the command line
|
123
|
Compromised
|
Bool
|
The process was marked as compromised by a rule with MarkAsCompromised action
|
true/false or 1/0
|
IntegrityLevel
|
Symbol
|
Integrity level of the process
|
Possible values are:
•0—Untrusted
•4096—Low
•8192—Medium
•12288—High
•16384—System
•20480—Protected process |
LnkPath
|
String
|
Contains a path to a shortcut execution
|
|
ProcessDistance
|
Int
|
The distance of the process from the current process
|
123
|
ProcessLevel
|
Int
|
Depth of the process in process hierarchy
|
123
|
ProcessOwner
|
String
|
The user that created the process
|
|
RiskScore
|
Int
|
Score is tracked for each process on the Endpoint. You can use actions IncreaseParentRiskScore or IncreaseRiskScore to increase the value by set amount. When risk score threshold is reached, KillParentProcess or KillProcess action is triggered. You can specify risk score threshold via Policy > ESET Inspect Connector > Advanced settings. The risk score resets after a certain period of time, by default 6 hours.
|
1000
|
SentBytes
|
Int
|
Total number of bytes sent by the process.
|
|
Supported operations
•CodeInjection
•CreateProcess
•LoadDLL |
• ServiceProcessInfo
Return information about the current service process.
Property
|
Type
|
Description
|
Example
|
CaseSensitiveCommandLine
|
String
|
Allows creating rules for command line that is case sensitive
|
|
CommandLine
|
String
|
Process command line
|
file.txt
|
CommandLineLength
|
Int
|
Length of the command line
|
123
|
Compromised
|
Bool
|
The process was marked as compromised by a rule with MarkAsCompromised action
|
true/false or 1/0
|
IntegrityLevel
|
Symbol
|
Integrity level of the process
|
Possible values are:
•0—Untrusted
•4096—Low
•8192—Medium
•12288—High
•16384—System
•20480—Protected process |
LnkPath
|
String
|
Contains a path to a shortcut execution
|
|
ProcessDistance
|
Int
|
The distance of the process from the current process
|
123
|
ProcessLevel
|
Int
|
Depth of the process in process hierarchy
|
123
|
ProcessOwner
|
String
|
The user that created the process
|
|
RiskScore
|
Int
|
Score is tracked for each process on the Endpoint. You can use actions IncreaseParentRiskScore or IncreaseRiskScore to increase the value by set amount. When risk score threshold is reached, KillParentProcess or KillProcess action is triggered. You can specify risk score threshold via Policy > ESET Inspect Connector > Advanced settings. The risk score resets after a certain period of time, by default 6 hours.
|
1000
|
SentBytes
|
Int
|
Total number of bytes sent by the process.
|
|
Supported operations
•CodeInjection
•CreateProcess
•LoadDLL |
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
DeleteFile
A file was deleted.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• FileItem
Return the information about the current file
Property
|
Type
|
Description
|
Example
|
ADS
|
String
|
The ADS part of the path
|
C:\windows\system32\notepad.exe:example -> example
|
Extension
|
String
|
The file extension
|
C:\windows\system32\notepad.exe -> exe
|
FileName
|
String
|
The filename with the file extension
|
C:\windows\system32\notepad.exe -> notepad.exe
|
FileNameWithoutExtension
|
String
|
Filename without the file extension
|
C:\windows\system32\notepad.exe -> notepad
|
FullPath
|
Path
|
The file path including filename
|
C:\windows\system32\notepad.exe -> C:\windows\system32\notepad.exe
|
NameLength
|
Int
|
The length of the name
|
C:\windows\system32\notepad.exe -> 7
|
Path
|
Path
|
The file path
|
C:\windows\system32\notepad.exe -> C:\windows\system32\
|
isSelf
|
Bool
|
Triggers if the operation is done by the file on itself (common for malware to delete itself)
|
true/false
|
Canary File
Path properties have a special variable for Canary files. The value to specify the path to the Canary file is %CanaryFile%.
<definition>
<operations>
<operation type="WriteFile">
<condition component="FileItem" property="Path" condition="is" value="%CanaryFile%" />
</operation>
</operations>
</definition>
|
Supported operations
•Codeinjection
•CreateNamedPipe
•CreateProcess
•DeleteFile
•LoadDLL
•LoadDriver
•ModuleDrop
•OpenProcess
•ReadFile
•RenameFile
•ScheduledTaskAdded
•ServiceInstalled
•ServiceStarted
•SetFileAttribute
•TruncateFile
•UnloadDriver
•VirtualDiskMounted
•WmiExecution
•WriteFile |
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
DeleteVolumeShadowCopy
A shadow copy of a volume was deleted.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
• VolumeShadowCopyInfo
Returns information about shadow copy creation and existing backup snapshots.
Property
|
Type
|
Description
|
Example
|
OriginalVolumeName
|
String
|
The name of the volume that had been shadow copied
|
"(C:) \\?\Volume{9d1a2b34-5c67-48e1-9f2a-1b2c3d4e5f60}\"
|
OriginatingMachine
|
String
|
The name of the machine containing the original volume
|
"win-srv-01.corp.example.com"
|
ProviderName
|
String
|
The name of the provider used to create the shadow copy
|
"Microsoft Software Shadow Copy provider 1.0"
|
ServiceMachine
|
String
|
The name of the system providing the shadow copy service (usually same as originating machine in local backups)
|
"win-srv-01.corp.example.com"
|
SnapshotDeviceObject
|
String
|
The device path that represents the snapshot of the volume. The device object path can be thought of as the root of a shadow copy of a volume. Requesters will use this device name when accessing files on a shadow-copied volume that it needs to work with.
|
\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2
|
Supported operations
•DeleteVolumeShadowCopy |
DnsRequest
A DNS request was made (usually IP > domain, domain > IP).
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• DnsInfo
DnsInfo with the following properties:
Property
|
Type
|
Description
|
Example
|
DnsQuery
|
String
|
The DNS query
|
www.google.com
|
DnsQueryLength
|
Int
|
The length of the DNS query
|
100
|
DnsResponseIpAddressV4
|
Set of IPv4 addresses
|
The A records in the DNS response
|
216.58.201.67
|
DnsResponseIpAddressV6
|
Set of IPv6 addresses
|
The AAAA records in the DNS response
|
2001:db8:85a3:8131:4321:8a2e:370:7334
|
DnsResponseString
|
Set of strings
|
The NS, CNAME, PTR or TXT records in the DNS reponse
|
mobile-google.com
|
DnsResponseType
|
Set of symbols
|
The types of records present in the DNS response
|
HINFO
|
DnsResponsesLength
|
Int
|
The total length of the DNS reponse
|
100
|
For property DnsResponseType, there is a pre-defined scope of values that can be used (case insensitive):
For more information on DnsResponseType values, see the Resource Record (RR) TYPEs.
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Example
<rule>
<definition>
<operations>
<operation type="DnsRequest">
<condition component="DnsInfo" condition="contains" property="DnsResponseType" value="CNAME" />
</operation>
</operations>
</definition>
</rule>
|
Supported operations
•DnsRequest |
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
HttpRequest
A HTTP request was made.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• Network
Return information about network events
Property
|
Type
|
Description
|
Example
|
DestinationIpAddressV4
|
Ipv4 address
|
The Ipv4 destination address of Firewall detection. Supports masks.
|
192.168.0.1, supports masks - 192.168.0.0/16
|
DestinationIpAddressV6
|
Ipv6 address
|
The Ipv6 destination address of Firewall detection. Supports masks.
|
2001:db8:85a3:8d3:1319:8a2e:370:0, supports masks - 2001:db8:85a3:8d3:1319:8a2e:370:0/112
|
Hostname
|
String
|
The target hostname.
Is supported only with TCP IP events.
|
server2.domain.lan
go.microsoft.com
weathermapdata.blob.core.windows.net
gitlab.com
|
Inbound
|
Bool
|
The connection is inbound
|
true/false
|
IpAddressV4
|
Ipv4 address
|
The Ipv4 address target of the event. Supports masks.
|
192.168.0.1, supports masks - 192.168.0.0/16
|
IpAddressV6
|
Ipv6 address
|
The Ipv6 address target of the event. Supports masks.
|
2001:db8:85a3:8d3:1319:8a2e:370:0, supports masks - 2001:db8:85a3:8d3:1319:8a2e:370:0/112
|
Port
|
Int
|
The TCP/UDP target port
|
8080
|
Protocol
|
String
|
The protocol used by the connection
|
HTTP, HTTPS, etc.
|
SourceIpAddressV4
|
Ipv4 address
|
The Ipv4 source address of Firewall detection. Supports masks.
|
192.168.0.1, supports masks - 192.168.0.0/16
|
SourceIpAddressV6
|
Ipv6 address
|
The Ipv6 source address of Firewall detection. Supports masks.
|
2001:db8:85a3:8d3:1319:8a2e:370:0, supports masks - 2001:db8:85a3:8d3:1319:8a2e:370:0/112
|
Url
|
String
|
If the request involved a URL (for example, HTTP request)
Is supported with HTTP requests and Detections.
|
The target URL
|
Example
<definition>
<operations>
<operation type="TcpIpConnect">
<operator type="or">
<condition component="Network" property="IpAddressV4" condition="is" value="10.0.0.0/8" />
<condition component="Network" property="IpAddressV4" condition="is" value="172.16.0.0/12" />
<condition component="Network" property="IpAddressV4" condition="is" value="192.168.0.0/16" />
<condition component="Network" property="IpAddressV4" condition="is" value="127.0.0.0/8" />
<condition component="Network" property="IpAddressV6" condition="is" value="::1/128" />
<condition component="Network" property="IpAddressV6" condition="is" value="fc00::/7" />
</operator>
</operation>
</operations>
</definition>
|
Supported operations
•Detection
•HttpRequest
•TcpIpAccept
•TcpIpConnect
•TcpIpProtocolIdentified |
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
LoadDLL
A DLL was loaded.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• Enterprise
Provides a statistic about modules in the monitored network.
Supported operations
•CreateProcess
•LoadDLL
•CodeInjection
•ModuleDrop |
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• FileItem
Return the information about the current file
Property
|
Type
|
Description
|
Example
|
ADS
|
String
|
The ADS part of the path
|
C:\windows\system32\notepad.exe:example -> example
|
Extension
|
String
|
The file extension
|
C:\windows\system32\notepad.exe -> exe
|
FileName
|
String
|
The filename with the file extension
|
C:\windows\system32\notepad.exe -> notepad.exe
|
FileNameWithoutExtension
|
String
|
Filename without the file extension
|
C:\windows\system32\notepad.exe -> notepad
|
FullPath
|
Path
|
The file path including filename
|
C:\windows\system32\notepad.exe -> C:\windows\system32\notepad.exe
|
NameLength
|
Int
|
The length of the name
|
C:\windows\system32\notepad.exe -> 7
|
Path
|
Path
|
The file path
|
C:\windows\system32\notepad.exe -> C:\windows\system32\
|
isSelf
|
Bool
|
Triggers if the operation is done by the file on itself (common for malware to delete itself)
|
true/false
|
Canary File
Path properties have a special variable for Canary files. The value to specify the path to the Canary file is %CanaryFile%.
<definition>
<operations>
<operation type="WriteFile">
<condition component="FileItem" property="Path" condition="is" value="%CanaryFile%" />
</operation>
</operations>
</definition>
|
Supported operations
•Codeinjection
•CreateNamedPipe
•CreateProcess
•DeleteFile
•LoadDLL
•LoadDriver
•ModuleDrop
•OpenProcess
•ReadFile
•RenameFile
•ScheduledTaskAdded
•ServiceInstalled
•ServiceStarted
•SetFileAttribute
•TruncateFile
•UnloadDriver
•VirtualDiskMounted
•WmiExecution
•WriteFile |
• LiveGrid
ESET LiveGrid is a preventative system that gathers information about threats from users worldwide. The LiveGrid database contains reputation information about potential threats. The reputation of executables helps you to filter rule results.
Property
|
Type
|
Description
|
Example
|
Age
|
Int
|
The number of days since the executable was first seen in LiveGrid. The number is rounded to the equivalent of the week, month, half of the year, year, etc.
|
|
Reputation
|
Int
|
The number on the reputation scale. The higher, the more trusted
|
Possible values are:
•9, 8—Trusted
•7, 6—OK
•5, 4—Risky
•3—PUA, Unknown (not seen by LiveGrid)
•2, 1—Malware |
Popularity
|
Int
|
The number of computers on which LiveGrid has seen an executable. It is rounded to numbers like 10, 100, 1000, 10000, etc. Malware usually does not exceed the popularity of 1000 until it is detected.
|
|
|
|
You cannot rely on LiveGrid values for new executables. Even the most popular and trusted executable (for example, installer of a new version of Google Chrome) has low popularity and an unknown reputation for some time after its release.
|
Supported operations
•CodeInjection
•CreateProcess
•LoadDLL
•ModuleDrop |
• Module
Return the information about the current module.
Property
|
Type
|
Description
|
Example
|
AugurScore
|
Int
|
The score number by ESET machine-learning engine. Possible values are 0 to 99
|
67
|
CompanyName
|
String
|
From version info, name of the company that produced the file
|
"Microsoft Corporation"
|
DaysSinceLastNearMiss
|
Int
|
Number of days since the file was recognized as nearmiss.
Nearmiss—the detection is triggered due to malware, but it may be a false positive (we cannot guarantee it is malware)
|
|
EmulationStatus
|
Int
|
The status of the file emulation (if the file was emulated by advanced heuristics)
|
0—Was not emulated
1—Was emulated
|
FileDescription
|
String
|
From version info, file description shown to users
|
"Microsoft Windows Resource Leak Diagnostic"
|
FileOrigin
|
Symbol
|
File delivered through RDP
|
Possible values are:
0—RDP
|
FileSize
|
Int
|
Filesize in bytes
|
41984
|
FileVersion
|
String
|
From version info, the version number of the file
|
"10.0.14393.0"
|
InternalName
|
String
|
From version info, internal name of the file
|
"RdrLeakDiag.exe"
|
IsDLL
|
Bool
|
The file is a PE DLLs
|
true/false
|
IsElf
|
Bool
|
The file is an ELF file
|
true/false
|
IsExe
|
Bool
|
The file is an executable
|
true/false
|
IsMacho
|
Bool
|
Defines whether a file is a Mach-O (macOS) file or not
|
true/false
|
IsNative
|
Bool
|
The file is a native PE executable
|
true/false
|
isPe
|
Bool
|
The file is a Windows executable
|
true/false
|
MD5
|
Hash
|
md5 hash of the executable
|
|
MachoIsProtected
|
Bool
|
Module is a protected Mach-O executable
|
|
MachoSignatureId
|
String
|
Identifier of a Mach-O file present in the signature
|
"com.apple.ls"
|
MachoSignerCns
|
Set of strings
|
Set of common names from certificates in Mach-O file
|
|
MachoUserId
|
String
|
Unique developer ID assigned by Apple
|
|
OriginalFileName
|
String
|
From version info, original name of the file
|
"RdrLeakDiag.exe"
|
PackerName1
|
String
|
Name of the packer
|
"UPX"
|
ProductName
|
String
|
From version info, name of the product with which the file is distributed
|
"Microsoft Windows Operating System"
|
ProductVersion
|
String
|
From version info, the version number of the product with which the file is distributed
|
"10.0.14393"
|
SFXName
|
String
|
Name of the sfx packer
|
"Zip"
|
Sha1
|
Hash
|
sha1 hash of the executable
|
fa7ebffd41bc44c47ea1b11928ee368c19f6d6a2
|
Sha256
|
Hash
|
sha256 hash of the executable
|
|
SignatureType
|
Symbol
|
Signature type of the executable
|
Possible values are:
•90—Trusted—The signature is trusted by Endpoint
•80—Valid—The signature is trusted by the OS
•75—Adhoc—The certificate is self signed
•70—None—There is no signature in the file
•60—Invalid—The signature is not valid/corrupted/revoked
•50—Present—The signature is present, but the certificate status is unknown
•50—Unknown—Failed to verify certificate |
SignerName
|
String
|
Name of the signer, if any
|
"Microsoft Windows"
|
Tags
|
String
|
Allows a user to filter by a module that has a specified tag attached
|
|
Whitelist
|
Symbol
|
Whitelist type of the executable
|
Possible values are:
•0—None—No whitelisting for this file
•1—Authoritative—The file is whitelisted by Endpoint
•2—LiveGrid—The file is whitelisted from LiveGrid
•3—Certificate—The file certificate is whitelisted |
|
|
1Names of packers may change in the future. Therefore we recommend using isnotempty or isempty value for the condition.
|
Supported operations
•CodeInjection
•CreateProcess
•LoadDLL
•LoadDriver
•ModuleDrop |
• ProcessInfo
Return information about the current process.
Property
|
Type
|
Description
|
Example
|
CaseSensitiveCommandLine
|
String
|
Allows creating rules for command line that is case sensitive
|
|
CommandLine
|
String
|
Process command line
|
file.txt
|
CommandLineLength
|
Int
|
Length of the command line
|
123
|
Compromised
|
Bool
|
The process was marked as compromised by a rule with MarkAsCompromised action
|
true/false or 1/0
|
IntegrityLevel
|
Symbol
|
Integrity level of the process
|
Possible values are:
•0—Untrusted
•4096—Low
•8192—Medium
•12288—High
•16384—System
•20480—Protected process |
LnkPath
|
String
|
Contains a path to a shortcut execution
|
|
ProcessDistance
|
Int
|
The distance of the process from the current process
|
123
|
ProcessLevel
|
Int
|
Depth of the process in process hierarchy
|
123
|
ProcessOwner
|
String
|
The user that created the process
|
|
RiskScore
|
Int
|
Score is tracked for each process on the Endpoint. You can use actions IncreaseParentRiskScore or IncreaseRiskScore to increase the value by set amount. When risk score threshold is reached, KillParentProcess or KillProcess action is triggered. You can specify risk score threshold via Policy > ESET Inspect Connector > Advanced settings. The risk score resets after a certain period of time, by default 6 hours.
|
1000
|
SentBytes
|
Int
|
Total number of bytes sent by the process.
|
|
Supported operations
•CodeInjection
•CreateProcess
•LoadDLL |
• ServiceProcessInfo
Return information about the current service process.
Property
|
Type
|
Description
|
Example
|
CaseSensitiveCommandLine
|
String
|
Allows creating rules for command line that is case sensitive
|
|
CommandLine
|
String
|
Process command line
|
file.txt
|
CommandLineLength
|
Int
|
Length of the command line
|
123
|
Compromised
|
Bool
|
The process was marked as compromised by a rule with MarkAsCompromised action
|
true/false or 1/0
|
IntegrityLevel
|
Symbol
|
Integrity level of the process
|
Possible values are:
•0—Untrusted
•4096—Low
•8192—Medium
•12288—High
•16384—System
•20480—Protected process |
LnkPath
|
String
|
Contains a path to a shortcut execution
|
|
ProcessDistance
|
Int
|
The distance of the process from the current process
|
123
|
ProcessLevel
|
Int
|
Depth of the process in process hierarchy
|
123
|
ProcessOwner
|
String
|
The user that created the process
|
|
RiskScore
|
Int
|
Score is tracked for each process on the Endpoint. You can use actions IncreaseParentRiskScore or IncreaseRiskScore to increase the value by set amount. When risk score threshold is reached, KillParentProcess or KillProcess action is triggered. You can specify risk score threshold via Policy > ESET Inspect Connector > Advanced settings. The risk score resets after a certain period of time, by default 6 hours.
|
1000
|
SentBytes
|
Int
|
Total number of bytes sent by the process.
|
|
Supported operations
•CodeInjection
•CreateProcess
•LoadDLL |
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
LoadDriver
A driver or kernel module was loaded.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• FileItem
Return the information about the current file
Property
|
Type
|
Description
|
Example
|
ADS
|
String
|
The ADS part of the path
|
C:\windows\system32\notepad.exe:example -> example
|
Extension
|
String
|
The file extension
|
C:\windows\system32\notepad.exe -> exe
|
FileName
|
String
|
The filename with the file extension
|
C:\windows\system32\notepad.exe -> notepad.exe
|
FileNameWithoutExtension
|
String
|
Filename without the file extension
|
C:\windows\system32\notepad.exe -> notepad
|
FullPath
|
Path
|
The file path including filename
|
C:\windows\system32\notepad.exe -> C:\windows\system32\notepad.exe
|
NameLength
|
Int
|
The length of the name
|
C:\windows\system32\notepad.exe -> 7
|
Path
|
Path
|
The file path
|
C:\windows\system32\notepad.exe -> C:\windows\system32\
|
isSelf
|
Bool
|
Triggers if the operation is done by the file on itself (common for malware to delete itself)
|
true/false
|
Canary File
Path properties have a special variable for Canary files. The value to specify the path to the Canary file is %CanaryFile%.
<definition>
<operations>
<operation type="WriteFile">
<condition component="FileItem" property="Path" condition="is" value="%CanaryFile%" />
</operation>
</operations>
</definition>
|
Supported operations
•Codeinjection
•CreateNamedPipe
•CreateProcess
•DeleteFile
•LoadDLL
•LoadDriver
•ModuleDrop
•OpenProcess
•ReadFile
•RenameFile
•ScheduledTaskAdded
•ServiceInstalled
•ServiceStarted
•SetFileAttribute
•TruncateFile
•UnloadDriver
•VirtualDiskMounted
•WmiExecution
•WriteFile |
• Module
Return the information about the current module.
Property
|
Type
|
Description
|
Example
|
AugurScore
|
Int
|
The score number by ESET machine-learning engine. Possible values are 0 to 99
|
67
|
CompanyName
|
String
|
From version info, name of the company that produced the file
|
"Microsoft Corporation"
|
DaysSinceLastNearMiss
|
Int
|
Number of days since the file was recognized as nearmiss.
Nearmiss—the detection is triggered due to malware, but it may be a false positive (we cannot guarantee it is malware)
|
|
EmulationStatus
|
Int
|
The status of the file emulation (if the file was emulated by advanced heuristics)
|
0—Was not emulated
1—Was emulated
|
FileDescription
|
String
|
From version info, file description shown to users
|
"Microsoft Windows Resource Leak Diagnostic"
|
FileOrigin
|
Symbol
|
File delivered through RDP
|
Possible values are:
0—RDP
|
FileSize
|
Int
|
Filesize in bytes
|
41984
|
FileVersion
|
String
|
From version info, the version number of the file
|
"10.0.14393.0"
|
InternalName
|
String
|
From version info, internal name of the file
|
"RdrLeakDiag.exe"
|
IsDLL
|
Bool
|
The file is a PE DLLs
|
true/false
|
IsElf
|
Bool
|
The file is an ELF file
|
true/false
|
IsExe
|
Bool
|
The file is an executable
|
true/false
|
IsMacho
|
Bool
|
Defines whether a file is a Mach-O (macOS) file or not
|
true/false
|
IsNative
|
Bool
|
The file is a native PE executable
|
true/false
|
isPe
|
Bool
|
The file is a Windows executable
|
true/false
|
MD5
|
Hash
|
md5 hash of the executable
|
|
MachoIsProtected
|
Bool
|
Module is a protected Mach-O executable
|
|
MachoSignatureId
|
String
|
Identifier of a Mach-O file present in the signature
|
"com.apple.ls"
|
MachoSignerCns
|
Set of strings
|
Set of common names from certificates in Mach-O file
|
|
MachoUserId
|
String
|
Unique developer ID assigned by Apple
|
|
OriginalFileName
|
String
|
From version info, original name of the file
|
"RdrLeakDiag.exe"
|
PackerName1
|
String
|
Name of the packer
|
"UPX"
|
ProductName
|
String
|
From version info, name of the product with which the file is distributed
|
"Microsoft Windows Operating System"
|
ProductVersion
|
String
|
From version info, the version number of the product with which the file is distributed
|
"10.0.14393"
|
SFXName
|
String
|
Name of the sfx packer
|
"Zip"
|
Sha1
|
Hash
|
sha1 hash of the executable
|
fa7ebffd41bc44c47ea1b11928ee368c19f6d6a2
|
Sha256
|
Hash
|
sha256 hash of the executable
|
|
SignatureType
|
Symbol
|
Signature type of the executable
|
Possible values are:
•90—Trusted—The signature is trusted by Endpoint
•80—Valid—The signature is trusted by the OS
•75—Adhoc—The certificate is self signed
•70—None—There is no signature in the file
•60—Invalid—The signature is not valid/corrupted/revoked
•50—Present—The signature is present, but the certificate status is unknown
•50—Unknown—Failed to verify certificate |
SignerName
|
String
|
Name of the signer, if any
|
"Microsoft Windows"
|
Tags
|
String
|
Allows a user to filter by a module that has a specified tag attached
|
|
Whitelist
|
Symbol
|
Whitelist type of the executable
|
Possible values are:
•0—None—No whitelisting for this file
•1—Authoritative—The file is whitelisted by Endpoint
•2—LiveGrid—The file is whitelisted from LiveGrid
•3—Certificate—The file certificate is whitelisted |
|
|
1Names of packers may change in the future. Therefore we recommend using isnotempty or isempty value for the condition.
|
Supported operations
•CodeInjection
•CreateProcess
•LoadDLL
•LoadDriver
•ModuleDrop |
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
ModuleDrop
An executable was dropped.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• Enterprise
Provides a statistic about modules in the monitored network.
Supported operations
•CreateProcess
•LoadDLL
•CodeInjection
•ModuleDrop |
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• FileItem
Return the information about the current file
Property
|
Type
|
Description
|
Example
|
ADS
|
String
|
The ADS part of the path
|
C:\windows\system32\notepad.exe:example -> example
|
Extension
|
String
|
The file extension
|
C:\windows\system32\notepad.exe -> exe
|
FileName
|
String
|
The filename with the file extension
|
C:\windows\system32\notepad.exe -> notepad.exe
|
FileNameWithoutExtension
|
String
|
Filename without the file extension
|
C:\windows\system32\notepad.exe -> notepad
|
FullPath
|
Path
|
The file path including filename
|
C:\windows\system32\notepad.exe -> C:\windows\system32\notepad.exe
|
NameLength
|
Int
|
The length of the name
|
C:\windows\system32\notepad.exe -> 7
|
Path
|
Path
|
The file path
|
C:\windows\system32\notepad.exe -> C:\windows\system32\
|
isSelf
|
Bool
|
Triggers if the operation is done by the file on itself (common for malware to delete itself)
|
true/false
|
Canary File
Path properties have a special variable for Canary files. The value to specify the path to the Canary file is %CanaryFile%.
<definition>
<operations>
<operation type="WriteFile">
<condition component="FileItem" property="Path" condition="is" value="%CanaryFile%" />
</operation>
</operations>
</definition>
|
Supported operations
•Codeinjection
•CreateNamedPipe
•CreateProcess
•DeleteFile
•LoadDLL
•LoadDriver
•ModuleDrop
•OpenProcess
•ReadFile
•RenameFile
•ScheduledTaskAdded
•ServiceInstalled
•ServiceStarted
•SetFileAttribute
•TruncateFile
•UnloadDriver
•VirtualDiskMounted
•WmiExecution
•WriteFile |
• LiveGrid
ESET LiveGrid is a preventative system that gathers information about threats from users worldwide. The LiveGrid database contains reputation information about potential threats. The reputation of executables helps you to filter rule results.
Property
|
Type
|
Description
|
Example
|
Age
|
Int
|
The number of days since the executable was first seen in LiveGrid. The number is rounded to the equivalent of the week, month, half of the year, year, etc.
|
|
Reputation
|
Int
|
The number on the reputation scale. The higher, the more trusted
|
Possible values are:
•9, 8—Trusted
•7, 6—OK
•5, 4—Risky
•3—PUA, Unknown (not seen by LiveGrid)
•2, 1—Malware |
Popularity
|
Int
|
The number of computers on which LiveGrid has seen an executable. It is rounded to numbers like 10, 100, 1000, 10000, etc. Malware usually does not exceed the popularity of 1000 until it is detected.
|
|
|
|
You cannot rely on LiveGrid values for new executables. Even the most popular and trusted executable (for example, installer of a new version of Google Chrome) has low popularity and an unknown reputation for some time after its release.
|
Supported operations
•CodeInjection
•CreateProcess
•LoadDLL
•ModuleDrop |
• Module
Return the information about the current module.
Property
|
Type
|
Description
|
Example
|
AugurScore
|
Int
|
The score number by ESET machine-learning engine. Possible values are 0 to 99
|
67
|
CompanyName
|
String
|
From version info, name of the company that produced the file
|
"Microsoft Corporation"
|
DaysSinceLastNearMiss
|
Int
|
Number of days since the file was recognized as nearmiss.
Nearmiss—the detection is triggered due to malware, but it may be a false positive (we cannot guarantee it is malware)
|
|
EmulationStatus
|
Int
|
The status of the file emulation (if the file was emulated by advanced heuristics)
|
0—Was not emulated
1—Was emulated
|
FileDescription
|
String
|
From version info, file description shown to users
|
"Microsoft Windows Resource Leak Diagnostic"
|
FileOrigin
|
Symbol
|
File delivered through RDP
|
Possible values are:
0—RDP
|
FileSize
|
Int
|
Filesize in bytes
|
41984
|
FileVersion
|
String
|
From version info, the version number of the file
|
"10.0.14393.0"
|
InternalName
|
String
|
From version info, internal name of the file
|
"RdrLeakDiag.exe"
|
IsDLL
|
Bool
|
The file is a PE DLLs
|
true/false
|
IsElf
|
Bool
|
The file is an ELF file
|
true/false
|
IsExe
|
Bool
|
The file is an executable
|
true/false
|
IsMacho
|
Bool
|
Defines whether a file is a Mach-O (macOS) file or not
|
true/false
|
IsNative
|
Bool
|
The file is a native PE executable
|
true/false
|
isPe
|
Bool
|
The file is a Windows executable
|
true/false
|
MD5
|
Hash
|
md5 hash of the executable
|
|
MachoIsProtected
|
Bool
|
Module is a protected Mach-O executable
|
|
MachoSignatureId
|
String
|
Identifier of a Mach-O file present in the signature
|
"com.apple.ls"
|
MachoSignerCns
|
Set of strings
|
Set of common names from certificates in Mach-O file
|
|
MachoUserId
|
String
|
Unique developer ID assigned by Apple
|
|
OriginalFileName
|
String
|
From version info, original name of the file
|
"RdrLeakDiag.exe"
|
PackerName1
|
String
|
Name of the packer
|
"UPX"
|
ProductName
|
String
|
From version info, name of the product with which the file is distributed
|
"Microsoft Windows Operating System"
|
ProductVersion
|
String
|
From version info, the version number of the product with which the file is distributed
|
"10.0.14393"
|
SFXName
|
String
|
Name of the sfx packer
|
"Zip"
|
Sha1
|
Hash
|
sha1 hash of the executable
|
fa7ebffd41bc44c47ea1b11928ee368c19f6d6a2
|
Sha256
|
Hash
|
sha256 hash of the executable
|
|
SignatureType
|
Symbol
|
Signature type of the executable
|
Possible values are:
•90—Trusted—The signature is trusted by Endpoint
•80—Valid—The signature is trusted by the OS
•75—Adhoc—The certificate is self signed
•70—None—There is no signature in the file
•60—Invalid—The signature is not valid/corrupted/revoked
•50—Present—The signature is present, but the certificate status is unknown
•50—Unknown—Failed to verify certificate |
SignerName
|
String
|
Name of the signer, if any
|
"Microsoft Windows"
|
Tags
|
String
|
Allows a user to filter by a module that has a specified tag attached
|
|
Whitelist
|
Symbol
|
Whitelist type of the executable
|
Possible values are:
•0—None—No whitelisting for this file
•1—Authoritative—The file is whitelisted by Endpoint
•2—LiveGrid—The file is whitelisted from LiveGrid
•3—Certificate—The file certificate is whitelisted |
|
|
1Names of packers may change in the future. Therefore we recommend using isnotempty or isempty value for the condition.
|
Supported operations
•CodeInjection
•CreateProcess
•LoadDLL
•LoadDriver
•ModuleDrop |
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
MultipleFilesChanged
Process modified multiple files.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• ProcessBehavior
ProcessBehavior events are reported on Windows. Antivirus tracks which files were accessed and how frequently. If the process accessed more files than are set in the barrier in a certain time period, this event is reported.
Property
|
Type
|
Description
|
Example
|
FileOperations
|
String
|
Operations and their barriers
|
Possbile values are:
•0—Unknown
•1—WrBarrier1
•2—WrBarrier2
•3—RenameBarrier1
•4—RenameBarrier2
•5—MultiextWrBarrier1
•6—MultiextWrBarrier2
•7—MultiextRenameBarrier1
•8—MultiextRenameBarrier2
•9—BlobDetection |
|
|
The FileOperations values are internal and are intended to be used only with default rules.
|
Supported operations
•MultipleFilesChanged |
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
OpenProcess
Added a new rule attribute, which triggers when a process is opened. Only the open process to lsass.exe is monitored.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• FileItem
Return the information about the current file
Property
|
Type
|
Description
|
Example
|
ADS
|
String
|
The ADS part of the path
|
C:\windows\system32\notepad.exe:example -> example
|
Extension
|
String
|
The file extension
|
C:\windows\system32\notepad.exe -> exe
|
FileName
|
String
|
The filename with the file extension
|
C:\windows\system32\notepad.exe -> notepad.exe
|
FileNameWithoutExtension
|
String
|
Filename without the file extension
|
C:\windows\system32\notepad.exe -> notepad
|
FullPath
|
Path
|
The file path including filename
|
C:\windows\system32\notepad.exe -> C:\windows\system32\notepad.exe
|
NameLength
|
Int
|
The length of the name
|
C:\windows\system32\notepad.exe -> 7
|
Path
|
Path
|
The file path
|
C:\windows\system32\notepad.exe -> C:\windows\system32\
|
isSelf
|
Bool
|
Triggers if the operation is done by the file on itself (common for malware to delete itself)
|
true/false
|
Canary File
Path properties have a special variable for Canary files. The value to specify the path to the Canary file is %CanaryFile%.
<definition>
<operations>
<operation type="WriteFile">
<condition component="FileItem" property="Path" condition="is" value="%CanaryFile%" />
</operation>
</operations>
</definition>
|
Supported operations
•Codeinjection
•CreateNamedPipe
•CreateProcess
•DeleteFile
•LoadDLL
•LoadDriver
•ModuleDrop
•OpenProcess
•ReadFile
•RenameFile
•ScheduledTaskAdded
•ServiceInstalled
•ServiceStarted
•SetFileAttribute
•TruncateFile
•UnloadDriver
•VirtualDiskMounted
•WmiExecution
•WriteFile |
• OpenProcess
Added a new rule attribute, which triggers when a process is opened.
HIPS sends OpenProcess events only for lsass.exe and only with PROCESS_VM_WRITE and/or PROCESS_VM_READ process access only when calling OpenProcess or DuplicateHandle (when the already opened process with mentioned accesses)
Property
|
Type
|
Description
|
Example
|
AccessRight
|
Symbol
|
|
Possible values are:
•1—PROCESS_TERMINATE
•2—PROCESS_CREATE_THREAD
•8—PROCESS_VM_OPERATION
•16—PROCESS_VM_READ
•32—PROCESS_VM_WRITE
•64—PROCESS_DUP_HANDLE
•128—PROCESS_CREATE_PROCESS
•256—PROCESS_SET_QUOTA
•512—PROCESS_SET_INFORMATION
•1024—PROCESS_QUERY_INFORMATION
•2048—PROCESS_SUSPEND_RESUME
•4096—PROCESS_QUERY_LIMITED_INFORMATION
•65536—DELETE
•131072—READ_CONTROL
•262144—WRITE_DAC
•524288—WRITE_OWNER
•1048576—SYNCHRONIZE
•2097151—PROCESS_ALL_ACCESS |
Example
<operations>
<operation type="OpenProcess">
<condition component="OpenProcess" property="AccessRight" condition="contains" value="PROCESS_VM_READ" />
</operation>
</operations>
|
Supported operations
•OpenProcess |
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
ReadFile
Triggered when a monitored file was read. Monitored files refer to those which contain either sensitive information or stored credentials, for example, stored browser passwords, stored FTP clients passwords, AD database and so on.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• FileItem
Return the information about the current file
Property
|
Type
|
Description
|
Example
|
ADS
|
String
|
The ADS part of the path
|
C:\windows\system32\notepad.exe:example -> example
|
Extension
|
String
|
The file extension
|
C:\windows\system32\notepad.exe -> exe
|
FileName
|
String
|
The filename with the file extension
|
C:\windows\system32\notepad.exe -> notepad.exe
|
FileNameWithoutExtension
|
String
|
Filename without the file extension
|
C:\windows\system32\notepad.exe -> notepad
|
FullPath
|
Path
|
The file path including filename
|
C:\windows\system32\notepad.exe -> C:\windows\system32\notepad.exe
|
NameLength
|
Int
|
The length of the name
|
C:\windows\system32\notepad.exe -> 7
|
Path
|
Path
|
The file path
|
C:\windows\system32\notepad.exe -> C:\windows\system32\
|
isSelf
|
Bool
|
Triggers if the operation is done by the file on itself (common for malware to delete itself)
|
true/false
|
Canary File
Path properties have a special variable for Canary files. The value to specify the path to the Canary file is %CanaryFile%.
<definition>
<operations>
<operation type="WriteFile">
<condition component="FileItem" property="Path" condition="is" value="%CanaryFile%" />
</operation>
</operations>
</definition>
|
Supported operations
•Codeinjection
•CreateNamedPipe
•CreateProcess
•DeleteFile
•LoadDLL
•LoadDriver
•ModuleDrop
•OpenProcess
•ReadFile
•RenameFile
•ScheduledTaskAdded
•ServiceInstalled
•ServiceStarted
•SetFileAttribute
•TruncateFile
•UnloadDriver
•VirtualDiskMounted
•WmiExecution
•WriteFile |
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
RegDeleteKey
A registry key was deleted.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• RegistryItem
Return the information about registry events.
Property
|
Type
|
Description
|
Example
|
Key
|
Path
|
The path of the key, contains the Value Name of the key
|
HKLM\SOFTWARE\ESET\EnterpriseInspector\EIAgent\CurrentVersion\Info
|
ValueLength
|
Int
|
The length of the key value
|
16
|
StringValue
|
String
|
The value of a string key
|
"ExampleValue"
|
IntValue
|
Int
|
The value of int key
|
32
|
Example
For registry key: "HKLM\SOFTWARE\Classes\CLSID\{12788EFC-0553-4126-A4E1-8AA0F5270615}\InprocServer32\CodeBase"
<operations>
<operation type="RegSetValue">
<operator type="AND">
<condition component="RegistryItem" property="Key" condition="starts" value="HKLM\software\classes\clsid\" />
<condition component="RegistryItem" property="Key" condition="contains" value="\InprocServer32\" />
<condition component="RegistryItem" property="Key" condition="ends" value="\CodeBase" />
<condition component="RegistryItem" property="StringValue" condition="contains" value="http" />
</operator>
</operation>
</operations>
|
Supported operations
•RegDeleteKey
•RegDeleteValue
•RegRenameKey
•RegSetValue |
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
RegDeleteValue
The value of the registry was deleted.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• RegistryItem
Return the information about registry events.
Property
|
Type
|
Description
|
Example
|
Key
|
Path
|
The path of the key, contains the Value Name of the key
|
HKLM\SOFTWARE\ESET\EnterpriseInspector\EIAgent\CurrentVersion\Info
|
ValueLength
|
Int
|
The length of the key value
|
16
|
StringValue
|
String
|
The value of a string key
|
"ExampleValue"
|
IntValue
|
Int
|
The value of int key
|
32
|
Example
For registry key: "HKLM\SOFTWARE\Classes\CLSID\{12788EFC-0553-4126-A4E1-8AA0F5270615}\InprocServer32\CodeBase"
<operations>
<operation type="RegSetValue">
<operator type="AND">
<condition component="RegistryItem" property="Key" condition="starts" value="HKLM\software\classes\clsid\" />
<condition component="RegistryItem" property="Key" condition="contains" value="\InprocServer32\" />
<condition component="RegistryItem" property="Key" condition="ends" value="\CodeBase" />
<condition component="RegistryItem" property="StringValue" condition="contains" value="http" />
</operator>
</operation>
</operations>
|
Supported operations
•RegDeleteKey
•RegDeleteValue
•RegRenameKey
•RegSetValue |
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
RegRenameKey
A registry key was renamed.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• RegistryItem
Return the information about registry events.
Property
|
Type
|
Description
|
Example
|
Key
|
Path
|
The path of the key, contains the Value Name of the key
|
HKLM\SOFTWARE\ESET\EnterpriseInspector\EIAgent\CurrentVersion\Info
|
ValueLength
|
Int
|
The length of the key value
|
16
|
StringValue
|
String
|
The value of a string key
|
"ExampleValue"
|
IntValue
|
Int
|
The value of int key
|
32
|
Example
For registry key: "HKLM\SOFTWARE\Classes\CLSID\{12788EFC-0553-4126-A4E1-8AA0F5270615}\InprocServer32\CodeBase"
<operations>
<operation type="RegSetValue">
<operator type="AND">
<condition component="RegistryItem" property="Key" condition="starts" value="HKLM\software\classes\clsid\" />
<condition component="RegistryItem" property="Key" condition="contains" value="\InprocServer32\" />
<condition component="RegistryItem" property="Key" condition="ends" value="\CodeBase" />
<condition component="RegistryItem" property="StringValue" condition="contains" value="http" />
</operator>
</operation>
</operations>
|
Supported operations
•RegDeleteKey
•RegDeleteValue
•RegRenameKey
•RegSetValue |
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
RegSetValue
A registry key was altered.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• RegistryItem
Return the information about registry events.
Property
|
Type
|
Description
|
Example
|
Key
|
Path
|
The path of the key, contains the Value Name of the key
|
HKLM\SOFTWARE\ESET\EnterpriseInspector\EIAgent\CurrentVersion\Info
|
ValueLength
|
Int
|
The length of the key value
|
16
|
StringValue
|
String
|
The value of a string key
|
"ExampleValue"
|
IntValue
|
Int
|
The value of int key
|
32
|
Example
For registry key: "HKLM\SOFTWARE\Classes\CLSID\{12788EFC-0553-4126-A4E1-8AA0F5270615}\InprocServer32\CodeBase"
<operations>
<operation type="RegSetValue">
<operator type="AND">
<condition component="RegistryItem" property="Key" condition="starts" value="HKLM\software\classes\clsid\" />
<condition component="RegistryItem" property="Key" condition="contains" value="\InprocServer32\" />
<condition component="RegistryItem" property="Key" condition="ends" value="\CodeBase" />
<condition component="RegistryItem" property="StringValue" condition="contains" value="http" />
</operator>
</operation>
</operations>
|
Supported operations
•RegDeleteKey
•RegDeleteValue
•RegRenameKey
•RegSetValue |
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
RenameFile
A file was renamed.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• FileItem
Return the information about the current file
Property
|
Type
|
Description
|
Example
|
ADS
|
String
|
The ADS part of the path
|
C:\windows\system32\notepad.exe:example -> example
|
Extension
|
String
|
The file extension
|
C:\windows\system32\notepad.exe -> exe
|
FileName
|
String
|
The filename with the file extension
|
C:\windows\system32\notepad.exe -> notepad.exe
|
FileNameWithoutExtension
|
String
|
Filename without the file extension
|
C:\windows\system32\notepad.exe -> notepad
|
FullPath
|
Path
|
The file path including filename
|
C:\windows\system32\notepad.exe -> C:\windows\system32\notepad.exe
|
NameLength
|
Int
|
The length of the name
|
C:\windows\system32\notepad.exe -> 7
|
Path
|
Path
|
The file path
|
C:\windows\system32\notepad.exe -> C:\windows\system32\
|
isSelf
|
Bool
|
Triggers if the operation is done by the file on itself (common for malware to delete itself)
|
true/false
|
Canary File
Path properties have a special variable for Canary files. The value to specify the path to the Canary file is %CanaryFile%.
<definition>
<operations>
<operation type="WriteFile">
<condition component="FileItem" property="Path" condition="is" value="%CanaryFile%" />
</operation>
</operations>
</definition>
|
Supported operations
•Codeinjection
•CreateNamedPipe
•CreateProcess
•DeleteFile
•LoadDLL
•LoadDriver
•ModuleDrop
•OpenProcess
•ReadFile
•RenameFile
•ScheduledTaskAdded
•ServiceInstalled
•ServiceStarted
•SetFileAttribute
•TruncateFile
•UnloadDriver
•VirtualDiskMounted
•WmiExecution
•WriteFile |
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
ScheduledTaskAdded
A scheduled task was added.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• FileItem
Return the information about the current file
Property
|
Type
|
Description
|
Example
|
ADS
|
String
|
The ADS part of the path
|
C:\windows\system32\notepad.exe:example -> example
|
Extension
|
String
|
The file extension
|
C:\windows\system32\notepad.exe -> exe
|
FileName
|
String
|
The filename with the file extension
|
C:\windows\system32\notepad.exe -> notepad.exe
|
FileNameWithoutExtension
|
String
|
Filename without the file extension
|
C:\windows\system32\notepad.exe -> notepad
|
FullPath
|
Path
|
The file path including filename
|
C:\windows\system32\notepad.exe -> C:\windows\system32\notepad.exe
|
NameLength
|
Int
|
The length of the name
|
C:\windows\system32\notepad.exe -> 7
|
Path
|
Path
|
The file path
|
C:\windows\system32\notepad.exe -> C:\windows\system32\
|
isSelf
|
Bool
|
Triggers if the operation is done by the file on itself (common for malware to delete itself)
|
true/false
|
Canary File
Path properties have a special variable for Canary files. The value to specify the path to the Canary file is %CanaryFile%.
<definition>
<operations>
<operation type="WriteFile">
<condition component="FileItem" property="Path" condition="is" value="%CanaryFile%" />
</operation>
</operations>
</definition>
|
Supported operations
•Codeinjection
•CreateNamedPipe
•CreateProcess
•DeleteFile
•LoadDLL
•LoadDriver
•ModuleDrop
•OpenProcess
•ReadFile
•RenameFile
•ScheduledTaskAdded
•ServiceInstalled
•ServiceStarted
•SetFileAttribute
•TruncateFile
•UnloadDriver
•VirtualDiskMounted
•WmiExecution
•WriteFile |
• ScheduledTask
Return the information about scheduled task.
Property
|
Type
|
Description
|
Example
|
Boundary
|
Date
|
Timing constraints for the schedule: start/end, timezone, and recurrence window/rules.
|
2025-07-31 16:10:00
|
Enabled
|
Bool
|
Indicates whether the scheduled task is active and will run on its schedule.
|
true/false
|
Location
|
String
|
Path in Microsoft Task Scheduler tree starting from “Task Scheduler Library” node
|
|
Name
|
String
|
Task name
|
|
Type
|
Symbol
|
Type of scheduled task operation
|
Possible values are:
•0—Create
•1—Unknown |
Supported operations
•ScheduledTaskAdded |
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
Scripts
A script exposed by AMSI was executed.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• Scripts
Scripts component allows you to create rules based on properties of executed script exposed by AMSI.
Property
|
Type
|
Description
|
Script
|
String
|
Script received by ESET PROTECT via AMSI integration
|
ScriptLength
|
Int
|
Length of the script (count of characters)
|
ScriptSha1
|
Hash
|
SHA1 hash of the script fragment
|
ScriptSha256
|
Hash
|
SHA256 hash of the script fragment
|
Example
<rule>
<definition>
<operations>
<operation type="Scripts">
<condition component="Scripts" property="ScriptLength" condition="greaterOrEqual" value="15" />
</operation>
</operations>
</definition>
<description>
<name>amsiTriggerScriptLength</name>
<category>TEST</category>
</description>
</rule>
|
Supported operations
•Scripts |
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
ServiceInstalled
A service was installed.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• FileItem
Return the information about the current file
Property
|
Type
|
Description
|
Example
|
ADS
|
String
|
The ADS part of the path
|
C:\windows\system32\notepad.exe:example -> example
|
Extension
|
String
|
The file extension
|
C:\windows\system32\notepad.exe -> exe
|
FileName
|
String
|
The filename with the file extension
|
C:\windows\system32\notepad.exe -> notepad.exe
|
FileNameWithoutExtension
|
String
|
Filename without the file extension
|
C:\windows\system32\notepad.exe -> notepad
|
FullPath
|
Path
|
The file path including filename
|
C:\windows\system32\notepad.exe -> C:\windows\system32\notepad.exe
|
NameLength
|
Int
|
The length of the name
|
C:\windows\system32\notepad.exe -> 7
|
Path
|
Path
|
The file path
|
C:\windows\system32\notepad.exe -> C:\windows\system32\
|
isSelf
|
Bool
|
Triggers if the operation is done by the file on itself (common for malware to delete itself)
|
true/false
|
Canary File
Path properties have a special variable for Canary files. The value to specify the path to the Canary file is %CanaryFile%.
<definition>
<operations>
<operation type="WriteFile">
<condition component="FileItem" property="Path" condition="is" value="%CanaryFile%" />
</operation>
</operations>
</definition>
|
Supported operations
•Codeinjection
•CreateNamedPipe
•CreateProcess
•DeleteFile
•LoadDLL
•LoadDriver
•ModuleDrop
•OpenProcess
•ReadFile
•RenameFile
•ScheduledTaskAdded
•ServiceInstalled
•ServiceStarted
•SetFileAttribute
•TruncateFile
•UnloadDriver
•VirtualDiskMounted
•WmiExecution
•WriteFile |
• Service
Service component allows you to create rules based on properties of Windows services and service-control events exposed by the Service Control Manager (SCM).
Property
|
Type
|
Description
|
Example
|
LoadType
|
Symbol
|
The service start type
|
Possible values are:
•0—BootLoad
•1—SystemLoad
•2—AutoLoad
•3—ManualLoad
•4—DisabledLoad |
Name
|
String
|
The internal service name registered with the SCM
|
|
Type
|
Int
|
Indicates the type of service that was registered with the SCM
|
Possible values are:
•1—DriverType
•2—FileSystemType
•4—AdapterType
•8—RecognizerType
•16—Win32ServiceOwnProcess
•32—Win32ServiceShareProcess
•272—InteractiveOwnProcess
•288—InteractiveShareProcess |
Supported operations
•ServiceInstalled
•ServiceStarted |
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
ServiceStarted
A service was started.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• FileItem
Return the information about the current file
Property
|
Type
|
Description
|
Example
|
ADS
|
String
|
The ADS part of the path
|
C:\windows\system32\notepad.exe:example -> example
|
Extension
|
String
|
The file extension
|
C:\windows\system32\notepad.exe -> exe
|
FileName
|
String
|
The filename with the file extension
|
C:\windows\system32\notepad.exe -> notepad.exe
|
FileNameWithoutExtension
|
String
|
Filename without the file extension
|
C:\windows\system32\notepad.exe -> notepad
|
FullPath
|
Path
|
The file path including filename
|
C:\windows\system32\notepad.exe -> C:\windows\system32\notepad.exe
|
NameLength
|
Int
|
The length of the name
|
C:\windows\system32\notepad.exe -> 7
|
Path
|
Path
|
The file path
|
C:\windows\system32\notepad.exe -> C:\windows\system32\
|
isSelf
|
Bool
|
Triggers if the operation is done by the file on itself (common for malware to delete itself)
|
true/false
|
Canary File
Path properties have a special variable for Canary files. The value to specify the path to the Canary file is %CanaryFile%.
<definition>
<operations>
<operation type="WriteFile">
<condition component="FileItem" property="Path" condition="is" value="%CanaryFile%" />
</operation>
</operations>
</definition>
|
Supported operations
•Codeinjection
•CreateNamedPipe
•CreateProcess
•DeleteFile
•LoadDLL
•LoadDriver
•ModuleDrop
•OpenProcess
•ReadFile
•RenameFile
•ScheduledTaskAdded
•ServiceInstalled
•ServiceStarted
•SetFileAttribute
•TruncateFile
•UnloadDriver
•VirtualDiskMounted
•WmiExecution
•WriteFile |
• Service
Service component allows you to create rules based on properties of Windows services and service-control events exposed by the Service Control Manager (SCM).
Property
|
Type
|
Description
|
Example
|
LoadType
|
Symbol
|
The service start type
|
Possible values are:
•0—BootLoad
•1—SystemLoad
•2—AutoLoad
•3—ManualLoad
•4—DisabledLoad |
Name
|
String
|
The internal service name registered with the SCM
|
|
Type
|
Int
|
Indicates the type of service that was registered with the SCM
|
Possible values are:
•1—DriverType
•2—FileSystemType
•4—AdapterType
•8—RecognizerType
•16—Win32ServiceOwnProcess
•32—Win32ServiceShareProcess
•272—InteractiveOwnProcess
•288—InteractiveShareProcess |
Supported operations
•ServiceInstalled
•ServiceStarted |
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
SetFileAttribute
A file attribute was set.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• FileAttribute
FileAttribute events are currently reported only on Linux. The rule is triggered when an attribute is set, for example, by the chmod command.
Property
|
Type
|
Description
|
Example
|
Attribute
|
Symbol
|
Attribute of a file
|
Possible values are:
•1—SUID
•2—SGID
•4—Sticky
•8—Immutable
•16—AppendOnly
•32—Undeletable
•64—Executable |
Supported operations
•SetFileAttribute |
• FileItem
Return the information about the current file
Property
|
Type
|
Description
|
Example
|
ADS
|
String
|
The ADS part of the path
|
C:\windows\system32\notepad.exe:example -> example
|
Extension
|
String
|
The file extension
|
C:\windows\system32\notepad.exe -> exe
|
FileName
|
String
|
The filename with the file extension
|
C:\windows\system32\notepad.exe -> notepad.exe
|
FileNameWithoutExtension
|
String
|
Filename without the file extension
|
C:\windows\system32\notepad.exe -> notepad
|
FullPath
|
Path
|
The file path including filename
|
C:\windows\system32\notepad.exe -> C:\windows\system32\notepad.exe
|
NameLength
|
Int
|
The length of the name
|
C:\windows\system32\notepad.exe -> 7
|
Path
|
Path
|
The file path
|
C:\windows\system32\notepad.exe -> C:\windows\system32\
|
isSelf
|
Bool
|
Triggers if the operation is done by the file on itself (common for malware to delete itself)
|
true/false
|
Canary File
Path properties have a special variable for Canary files. The value to specify the path to the Canary file is %CanaryFile%.
<definition>
<operations>
<operation type="WriteFile">
<condition component="FileItem" property="Path" condition="is" value="%CanaryFile%" />
</operation>
</operations>
</definition>
|
Supported operations
•Codeinjection
•CreateNamedPipe
•CreateProcess
•DeleteFile
•LoadDLL
•LoadDriver
•ModuleDrop
•OpenProcess
•ReadFile
•RenameFile
•ScheduledTaskAdded
•ServiceInstalled
•ServiceStarted
•SetFileAttribute
•TruncateFile
•UnloadDriver
•VirtualDiskMounted
•WmiExecution
•WriteFile |
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
SystemApiCall
A system function was called.
Supported components:
• ApiCall
Returns information about API calls.
Property
|
Type
|
Description
|
Example
|
ApiName
|
Symbol
|
Name of the API called by the process
|
Supported values are:
•0—SetWinEventHook
•1—SetWindowsHookEx
•2—RegisterRawInputDevices
•3—GetAsyncKeyState
•4—UiLimitWriteClipboard
•5—UiWriteClipboard
•6—CredEnumerate
•7—CredReadDomainCredentials
•8—CredFindBestCredential
•9—CredBackupCredentials
•10—CredRead
•11—CredReadByTokenHandle
•12—VaultEnumerateCredentials
•21845—RawSocketCreated1
•21846—SocketFilterAttached1 |
1 Linux only
Example
<operations>
<operation type="SystemApiCall">
<condition component="ApiCall" property="ApiName" condition="is" value="RegisterRawInputDevices"/>
</operation>
</operations>
|
Supported operations
•SystemApiCall |
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
TcpIpAccept
An incoming TCP/IP connection was accepted.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• Network
Return information about network events
Property
|
Type
|
Description
|
Example
|
DestinationIpAddressV4
|
Ipv4 address
|
The Ipv4 destination address of Firewall detection. Supports masks.
|
192.168.0.1, supports masks - 192.168.0.0/16
|
DestinationIpAddressV6
|
Ipv6 address
|
The Ipv6 destination address of Firewall detection. Supports masks.
|
2001:db8:85a3:8d3:1319:8a2e:370:0, supports masks - 2001:db8:85a3:8d3:1319:8a2e:370:0/112
|
Hostname
|
String
|
The target hostname.
Is supported only with TCP IP events.
|
server2.domain.lan
go.microsoft.com
weathermapdata.blob.core.windows.net
gitlab.com
|
Inbound
|
Bool
|
The connection is inbound
|
true/false
|
IpAddressV4
|
Ipv4 address
|
The Ipv4 address target of the event. Supports masks.
|
192.168.0.1, supports masks - 192.168.0.0/16
|
IpAddressV6
|
Ipv6 address
|
The Ipv6 address target of the event. Supports masks.
|
2001:db8:85a3:8d3:1319:8a2e:370:0, supports masks - 2001:db8:85a3:8d3:1319:8a2e:370:0/112
|
Port
|
Int
|
The TCP/UDP target port
|
8080
|
Protocol
|
String
|
The protocol used by the connection
|
HTTP, HTTPS, etc.
|
SourceIpAddressV4
|
Ipv4 address
|
The Ipv4 source address of Firewall detection. Supports masks.
|
192.168.0.1, supports masks - 192.168.0.0/16
|
SourceIpAddressV6
|
Ipv6 address
|
The Ipv6 source address of Firewall detection. Supports masks.
|
2001:db8:85a3:8d3:1319:8a2e:370:0, supports masks - 2001:db8:85a3:8d3:1319:8a2e:370:0/112
|
Url
|
String
|
If the request involved a URL (for example, HTTP request)
Is supported with HTTP requests and Detections.
|
The target URL
|
Example
<definition>
<operations>
<operation type="TcpIpConnect">
<operator type="or">
<condition component="Network" property="IpAddressV4" condition="is" value="10.0.0.0/8" />
<condition component="Network" property="IpAddressV4" condition="is" value="172.16.0.0/12" />
<condition component="Network" property="IpAddressV4" condition="is" value="192.168.0.0/16" />
<condition component="Network" property="IpAddressV4" condition="is" value="127.0.0.0/8" />
<condition component="Network" property="IpAddressV6" condition="is" value="::1/128" />
<condition component="Network" property="IpAddressV6" condition="is" value="fc00::/7" />
</operator>
</operation>
</operations>
</definition>
|
Supported operations
•Detection
•HttpRequest
•TcpIpAccept
•TcpIpConnect
•TcpIpProtocolIdentified |
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
TcpIpConnect
An outbound TCP/IP connection was made.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• Network
Return information about network events
Property
|
Type
|
Description
|
Example
|
DestinationIpAddressV4
|
Ipv4 address
|
The Ipv4 destination address of Firewall detection. Supports masks.
|
192.168.0.1, supports masks - 192.168.0.0/16
|
DestinationIpAddressV6
|
Ipv6 address
|
The Ipv6 destination address of Firewall detection. Supports masks.
|
2001:db8:85a3:8d3:1319:8a2e:370:0, supports masks - 2001:db8:85a3:8d3:1319:8a2e:370:0/112
|
Hostname
|
String
|
The target hostname.
Is supported only with TCP IP events.
|
server2.domain.lan
go.microsoft.com
weathermapdata.blob.core.windows.net
gitlab.com
|
Inbound
|
Bool
|
The connection is inbound
|
true/false
|
IpAddressV4
|
Ipv4 address
|
The Ipv4 address target of the event. Supports masks.
|
192.168.0.1, supports masks - 192.168.0.0/16
|
IpAddressV6
|
Ipv6 address
|
The Ipv6 address target of the event. Supports masks.
|
2001:db8:85a3:8d3:1319:8a2e:370:0, supports masks - 2001:db8:85a3:8d3:1319:8a2e:370:0/112
|
Port
|
Int
|
The TCP/UDP target port
|
8080
|
Protocol
|
String
|
The protocol used by the connection
|
HTTP, HTTPS, etc.
|
SourceIpAddressV4
|
Ipv4 address
|
The Ipv4 source address of Firewall detection. Supports masks.
|
192.168.0.1, supports masks - 192.168.0.0/16
|
SourceIpAddressV6
|
Ipv6 address
|
The Ipv6 source address of Firewall detection. Supports masks.
|
2001:db8:85a3:8d3:1319:8a2e:370:0, supports masks - 2001:db8:85a3:8d3:1319:8a2e:370:0/112
|
Url
|
String
|
If the request involved a URL (for example, HTTP request)
Is supported with HTTP requests and Detections.
|
The target URL
|
Example
<definition>
<operations>
<operation type="TcpIpConnect">
<operator type="or">
<condition component="Network" property="IpAddressV4" condition="is" value="10.0.0.0/8" />
<condition component="Network" property="IpAddressV4" condition="is" value="172.16.0.0/12" />
<condition component="Network" property="IpAddressV4" condition="is" value="192.168.0.0/16" />
<condition component="Network" property="IpAddressV4" condition="is" value="127.0.0.0/8" />
<condition component="Network" property="IpAddressV6" condition="is" value="::1/128" />
<condition component="Network" property="IpAddressV6" condition="is" value="fc00::/7" />
</operator>
</operation>
</operations>
</definition>
|
Supported operations
•Detection
•HttpRequest
•TcpIpAccept
•TcpIpConnect
•TcpIpProtocolIdentified |
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
TcpIpProtocolIdentified
On top of TCP/IP connection, describes the protocol used.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• Network
Return information about network events
Property
|
Type
|
Description
|
Example
|
DestinationIpAddressV4
|
Ipv4 address
|
The Ipv4 destination address of Firewall detection. Supports masks.
|
192.168.0.1, supports masks - 192.168.0.0/16
|
DestinationIpAddressV6
|
Ipv6 address
|
The Ipv6 destination address of Firewall detection. Supports masks.
|
2001:db8:85a3:8d3:1319:8a2e:370:0, supports masks - 2001:db8:85a3:8d3:1319:8a2e:370:0/112
|
Hostname
|
String
|
The target hostname.
Is supported only with TCP IP events.
|
server2.domain.lan
go.microsoft.com
weathermapdata.blob.core.windows.net
gitlab.com
|
Inbound
|
Bool
|
The connection is inbound
|
true/false
|
IpAddressV4
|
Ipv4 address
|
The Ipv4 address target of the event. Supports masks.
|
192.168.0.1, supports masks - 192.168.0.0/16
|
IpAddressV6
|
Ipv6 address
|
The Ipv6 address target of the event. Supports masks.
|
2001:db8:85a3:8d3:1319:8a2e:370:0, supports masks - 2001:db8:85a3:8d3:1319:8a2e:370:0/112
|
Port
|
Int
|
The TCP/UDP target port
|
8080
|
Protocol
|
String
|
The protocol used by the connection
|
HTTP, HTTPS, etc.
|
SourceIpAddressV4
|
Ipv4 address
|
The Ipv4 source address of Firewall detection. Supports masks.
|
192.168.0.1, supports masks - 192.168.0.0/16
|
SourceIpAddressV6
|
Ipv6 address
|
The Ipv6 source address of Firewall detection. Supports masks.
|
2001:db8:85a3:8d3:1319:8a2e:370:0, supports masks - 2001:db8:85a3:8d3:1319:8a2e:370:0/112
|
Url
|
String
|
If the request involved a URL (for example, HTTP request)
Is supported with HTTP requests and Detections.
|
The target URL
|
Example
<definition>
<operations>
<operation type="TcpIpConnect">
<operator type="or">
<condition component="Network" property="IpAddressV4" condition="is" value="10.0.0.0/8" />
<condition component="Network" property="IpAddressV4" condition="is" value="172.16.0.0/12" />
<condition component="Network" property="IpAddressV4" condition="is" value="192.168.0.0/16" />
<condition component="Network" property="IpAddressV4" condition="is" value="127.0.0.0/8" />
<condition component="Network" property="IpAddressV6" condition="is" value="::1/128" />
<condition component="Network" property="IpAddressV6" condition="is" value="fc00::/7" />
</operator>
</operation>
</operations>
</definition>
|
Supported operations
•Detection
•HttpRequest
•TcpIpAccept
•TcpIpConnect
•TcpIpProtocolIdentified |
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
TruncateFile
A file was truncated.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• FileItem
Return the information about the current file
Property
|
Type
|
Description
|
Example
|
ADS
|
String
|
The ADS part of the path
|
C:\windows\system32\notepad.exe:example -> example
|
Extension
|
String
|
The file extension
|
C:\windows\system32\notepad.exe -> exe
|
FileName
|
String
|
The filename with the file extension
|
C:\windows\system32\notepad.exe -> notepad.exe
|
FileNameWithoutExtension
|
String
|
Filename without the file extension
|
C:\windows\system32\notepad.exe -> notepad
|
FullPath
|
Path
|
The file path including filename
|
C:\windows\system32\notepad.exe -> C:\windows\system32\notepad.exe
|
NameLength
|
Int
|
The length of the name
|
C:\windows\system32\notepad.exe -> 7
|
Path
|
Path
|
The file path
|
C:\windows\system32\notepad.exe -> C:\windows\system32\
|
isSelf
|
Bool
|
Triggers if the operation is done by the file on itself (common for malware to delete itself)
|
true/false
|
Canary File
Path properties have a special variable for Canary files. The value to specify the path to the Canary file is %CanaryFile%.
<definition>
<operations>
<operation type="WriteFile">
<condition component="FileItem" property="Path" condition="is" value="%CanaryFile%" />
</operation>
</operations>
</definition>
|
Supported operations
•Codeinjection
•CreateNamedPipe
•CreateProcess
•DeleteFile
•LoadDLL
•LoadDriver
•ModuleDrop
•OpenProcess
•ReadFile
•RenameFile
•ScheduledTaskAdded
•ServiceInstalled
•ServiceStarted
•SetFileAttribute
•TruncateFile
•UnloadDriver
•VirtualDiskMounted
•WmiExecution
•WriteFile |
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
UnloadDriver
A driver or kernel module was unloaded.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• FileItem
Return the information about the current file
Property
|
Type
|
Description
|
Example
|
ADS
|
String
|
The ADS part of the path
|
C:\windows\system32\notepad.exe:example -> example
|
Extension
|
String
|
The file extension
|
C:\windows\system32\notepad.exe -> exe
|
FileName
|
String
|
The filename with the file extension
|
C:\windows\system32\notepad.exe -> notepad.exe
|
FileNameWithoutExtension
|
String
|
Filename without the file extension
|
C:\windows\system32\notepad.exe -> notepad
|
FullPath
|
Path
|
The file path including filename
|
C:\windows\system32\notepad.exe -> C:\windows\system32\notepad.exe
|
NameLength
|
Int
|
The length of the name
|
C:\windows\system32\notepad.exe -> 7
|
Path
|
Path
|
The file path
|
C:\windows\system32\notepad.exe -> C:\windows\system32\
|
isSelf
|
Bool
|
Triggers if the operation is done by the file on itself (common for malware to delete itself)
|
true/false
|
Canary File
Path properties have a special variable for Canary files. The value to specify the path to the Canary file is %CanaryFile%.
<definition>
<operations>
<operation type="WriteFile">
<condition component="FileItem" property="Path" condition="is" value="%CanaryFile%" />
</operation>
</operations>
</definition>
|
Supported operations
•Codeinjection
•CreateNamedPipe
•CreateProcess
•DeleteFile
•LoadDLL
•LoadDriver
•ModuleDrop
•OpenProcess
•ReadFile
•RenameFile
•ScheduledTaskAdded
•ServiceInstalled
•ServiceStarted
•SetFileAttribute
•TruncateFile
•UnloadDriver
•VirtualDiskMounted
•WmiExecution
•WriteFile |
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
UserActivate
The user was activated.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• DoneByUser
The user that was targeted.
Property
|
Type
|
Description
|
Example
|
Sid
|
String
|
Which user (account SID) is behind the given event
|
|
SidNameUse
|
Symbol
|
Which group (its SID type) is behind the given event
|
Groups are:
•1—User
•2—Group
•3—Domain
•4—Alias
•5—WellKnownGroup
•6—DeletedAccount
•7—Invalid
•8—Unknown
•9—Computer
•10—Label
•11—LogonSession |
UserName
|
String
|
Which user (account name) is behind the given event
|
|
Supported operations
•UserActivate
•UserAddToGroup
•UserCreate
•UserDisable
•UserLogin
•UserLogout
•UserRemove
•UserRemoveFromGroup |
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
• TargetUser
The user that was targeted.
Property
|
Type
|
Description
|
Example
|
Sid
|
String
|
Which user (account SID) is behind the given event
|
|
SidNameUse
|
Symbol
|
Which group (its SID type) is behind the given event
|
Groups are:
•1—User
•2—Group
•3—Domain
•4—Alias
•5—WellKnownGroup
•6—DeletedAccount
•7—Invalid
•8—Unknown
•9—Computer
•10—Label
•11—LogonSession |
UserName
|
String
|
Which user (account name) is behind the given event
|
|
Supported operations
•UserActivate
•UserAddToGroup
•UserCreate
•UserDisable
•UserLogin
•UserLogout
•UserRemove
•UserRemoveFromGroup |
UserAddToGroup
The user was added to the group.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• DoneByUser
The user that was targeted.
Property
|
Type
|
Description
|
Example
|
Sid
|
String
|
Which user (account SID) is behind the given event
|
|
SidNameUse
|
Symbol
|
Which group (its SID type) is behind the given event
|
Groups are:
•1—User
•2—Group
•3—Domain
•4—Alias
•5—WellKnownGroup
•6—DeletedAccount
•7—Invalid
•8—Unknown
•9—Computer
•10—Label
•11—LogonSession |
UserName
|
String
|
Which user (account name) is behind the given event
|
|
Supported operations
•UserActivate
•UserAddToGroup
•UserCreate
•UserDisable
•UserLogin
•UserLogout
•UserRemove
•UserRemoveFromGroup |
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
• TargetUser
The user that was targeted.
Property
|
Type
|
Description
|
Example
|
Sid
|
String
|
Which user (account SID) is behind the given event
|
|
SidNameUse
|
Symbol
|
Which group (its SID type) is behind the given event
|
Groups are:
•1—User
•2—Group
•3—Domain
•4—Alias
•5—WellKnownGroup
•6—DeletedAccount
•7—Invalid
•8—Unknown
•9—Computer
•10—Label
•11—LogonSession |
UserName
|
String
|
Which user (account name) is behind the given event
|
|
Supported operations
•UserActivate
•UserAddToGroup
•UserCreate
•UserDisable
•UserLogin
•UserLogout
•UserRemove
•UserRemoveFromGroup |
• UserGroupData
Same as UserLogonData but with properties to data about groups.
Property
|
Type
|
Description
|
Example
|
Sid
|
String
|
Which user (account SID) is behind the given event
|
|
SidNameUse
|
Symbol
|
Which group (its SID type) is behind the given event
|
Groups are:
•1—User
•2—Group
•3—Domain
•4—Alias
•5—WellKnownGroup
•6—DeletedAccount
•7—Invalid
•8—Unknown
•9—Computer
•10—Label
•11—LogonSession |
UserName
|
String
|
Which user (account name) is behind the given event
|
|
Supported operations
•UserAddToGroup
•UserRemoveFromGroup |
UserCreate
A new user was created.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• DoneByUser
The user that was targeted.
Property
|
Type
|
Description
|
Example
|
Sid
|
String
|
Which user (account SID) is behind the given event
|
|
SidNameUse
|
Symbol
|
Which group (its SID type) is behind the given event
|
Groups are:
•1—User
•2—Group
•3—Domain
•4—Alias
•5—WellKnownGroup
•6—DeletedAccount
•7—Invalid
•8—Unknown
•9—Computer
•10—Label
•11—LogonSession |
UserName
|
String
|
Which user (account name) is behind the given event
|
|
Supported operations
•UserActivate
•UserAddToGroup
•UserCreate
•UserDisable
•UserLogin
•UserLogout
•UserRemove
•UserRemoveFromGroup |
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
• TargetUser
The user that was targeted.
Property
|
Type
|
Description
|
Example
|
Sid
|
String
|
Which user (account SID) is behind the given event
|
|
SidNameUse
|
Symbol
|
Which group (its SID type) is behind the given event
|
Groups are:
•1—User
•2—Group
•3—Domain
•4—Alias
•5—WellKnownGroup
•6—DeletedAccount
•7—Invalid
•8—Unknown
•9—Computer
•10—Label
•11—LogonSession |
UserName
|
String
|
Which user (account name) is behind the given event
|
|
Supported operations
•UserActivate
•UserAddToGroup
•UserCreate
•UserDisable
•UserLogin
•UserLogout
•UserRemove
•UserRemoveFromGroup |
UserDisable
The user was disabled.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• DoneByUser
The user that was targeted.
Property
|
Type
|
Description
|
Example
|
Sid
|
String
|
Which user (account SID) is behind the given event
|
|
SidNameUse
|
Symbol
|
Which group (its SID type) is behind the given event
|
Groups are:
•1—User
•2—Group
•3—Domain
•4—Alias
•5—WellKnownGroup
•6—DeletedAccount
•7—Invalid
•8—Unknown
•9—Computer
•10—Label
•11—LogonSession |
UserName
|
String
|
Which user (account name) is behind the given event
|
|
Supported operations
•UserActivate
•UserAddToGroup
•UserCreate
•UserDisable
•UserLogin
•UserLogout
•UserRemove
•UserRemoveFromGroup |
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
• TargetUser
The user that was targeted.
Property
|
Type
|
Description
|
Example
|
Sid
|
String
|
Which user (account SID) is behind the given event
|
|
SidNameUse
|
Symbol
|
Which group (its SID type) is behind the given event
|
Groups are:
•1—User
•2—Group
•3—Domain
•4—Alias
•5—WellKnownGroup
•6—DeletedAccount
•7—Invalid
•8—Unknown
•9—Computer
•10—Label
•11—LogonSession |
UserName
|
String
|
Which user (account name) is behind the given event
|
|
Supported operations
•UserActivate
•UserAddToGroup
•UserCreate
•UserDisable
•UserLogin
•UserLogout
•UserRemove
•UserRemoveFromGroup |
UserLogin
The user logged in.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• DoneByUser
The user that was targeted.
Property
|
Type
|
Description
|
Example
|
Sid
|
String
|
Which user (account SID) is behind the given event
|
|
SidNameUse
|
Symbol
|
Which group (its SID type) is behind the given event
|
Groups are:
•1—User
•2—Group
•3—Domain
•4—Alias
•5—WellKnownGroup
•6—DeletedAccount
•7—Invalid
•8—Unknown
•9—Computer
•10—Label
•11—LogonSession |
UserName
|
String
|
Which user (account name) is behind the given event
|
|
Supported operations
•UserActivate
•UserAddToGroup
•UserCreate
•UserDisable
•UserLogin
•UserLogout
•UserRemove
•UserRemoveFromGroup |
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
• TargetUser
The user that was targeted.
Property
|
Type
|
Description
|
Example
|
Sid
|
String
|
Which user (account SID) is behind the given event
|
|
SidNameUse
|
Symbol
|
Which group (its SID type) is behind the given event
|
Groups are:
•1—User
•2—Group
•3—Domain
•4—Alias
•5—WellKnownGroup
•6—DeletedAccount
•7—Invalid
•8—Unknown
•9—Computer
•10—Label
•11—LogonSession |
UserName
|
String
|
Which user (account name) is behind the given event
|
|
Supported operations
•UserActivate
•UserAddToGroup
•UserCreate
•UserDisable
•UserLogin
•UserLogout
•UserRemove
•UserRemoveFromGroup |
• UserLogonData
Events related to the User activities (created user, logged in, ...), information about those events.
Property
|
Type
|
Description
|
Example
|
Hostname
|
String
|
Machine name from which a logon attempt was performed
|
|
IpAddressV4
|
Ipv4 address
|
IPv4 address of machine from which logon attempt was performed
|
|
IpAddressV6
|
Ipv6 address
|
IPv6 address of machine from which logon attempt was performed
|
|
LogonType
|
Symbol
|
Type of login
|
Possible values are:
•0—Unknown
•2—Interactive
•3—Network
•4—Batch
•5—Service
•7—Unlock
•8—NetworkCleartext
•9—NewCredentials
•10—RemoteInteractive
•11—CachedInteractive
•12—CachedRemoteInteractive |
Port
|
Int
|
The source port that was used for logon attempt from remote machine
|
|
Supported operations
•UserLogin
•UserLogout |
UserLogout
The user logged out.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• DoneByUser
The user that was targeted.
Property
|
Type
|
Description
|
Example
|
Sid
|
String
|
Which user (account SID) is behind the given event
|
|
SidNameUse
|
Symbol
|
Which group (its SID type) is behind the given event
|
Groups are:
•1—User
•2—Group
•3—Domain
•4—Alias
•5—WellKnownGroup
•6—DeletedAccount
•7—Invalid
•8—Unknown
•9—Computer
•10—Label
•11—LogonSession |
UserName
|
String
|
Which user (account name) is behind the given event
|
|
Supported operations
•UserActivate
•UserAddToGroup
•UserCreate
•UserDisable
•UserLogin
•UserLogout
•UserRemove
•UserRemoveFromGroup |
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
• TargetUser
The user that was targeted.
Property
|
Type
|
Description
|
Example
|
Sid
|
String
|
Which user (account SID) is behind the given event
|
|
SidNameUse
|
Symbol
|
Which group (its SID type) is behind the given event
|
Groups are:
•1—User
•2—Group
•3—Domain
•4—Alias
•5—WellKnownGroup
•6—DeletedAccount
•7—Invalid
•8—Unknown
•9—Computer
•10—Label
•11—LogonSession |
UserName
|
String
|
Which user (account name) is behind the given event
|
|
Supported operations
•UserActivate
•UserAddToGroup
•UserCreate
•UserDisable
•UserLogin
•UserLogout
•UserRemove
•UserRemoveFromGroup |
• UserLogonData
Events related to the User activities (created user, logged in, ...), information about those events.
Property
|
Type
|
Description
|
Example
|
Hostname
|
String
|
Machine name from which a logon attempt was performed
|
|
IpAddressV4
|
Ipv4 address
|
IPv4 address of machine from which logon attempt was performed
|
|
IpAddressV6
|
Ipv6 address
|
IPv6 address of machine from which logon attempt was performed
|
|
LogonType
|
Symbol
|
Type of login
|
Possible values are:
•0—Unknown
•2—Interactive
•3—Network
•4—Batch
•5—Service
•7—Unlock
•8—NetworkCleartext
•9—NewCredentials
•10—RemoteInteractive
•11—CachedInteractive
•12—CachedRemoteInteractive |
Port
|
Int
|
The source port that was used for logon attempt from remote machine
|
|
Supported operations
•UserLogin
•UserLogout |
UserRemove
The user was removed.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• DoneByUser
The user that was targeted.
Property
|
Type
|
Description
|
Example
|
Sid
|
String
|
Which user (account SID) is behind the given event
|
|
SidNameUse
|
Symbol
|
Which group (its SID type) is behind the given event
|
Groups are:
•1—User
•2—Group
•3—Domain
•4—Alias
•5—WellKnownGroup
•6—DeletedAccount
•7—Invalid
•8—Unknown
•9—Computer
•10—Label
•11—LogonSession |
UserName
|
String
|
Which user (account name) is behind the given event
|
|
Supported operations
•UserActivate
•UserAddToGroup
•UserCreate
•UserDisable
•UserLogin
•UserLogout
•UserRemove
•UserRemoveFromGroup |
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
• TargetUser
The user that was targeted.
Property
|
Type
|
Description
|
Example
|
Sid
|
String
|
Which user (account SID) is behind the given event
|
|
SidNameUse
|
Symbol
|
Which group (its SID type) is behind the given event
|
Groups are:
•1—User
•2—Group
•3—Domain
•4—Alias
•5—WellKnownGroup
•6—DeletedAccount
•7—Invalid
•8—Unknown
•9—Computer
•10—Label
•11—LogonSession |
UserName
|
String
|
Which user (account name) is behind the given event
|
|
Supported operations
•UserActivate
•UserAddToGroup
•UserCreate
•UserDisable
•UserLogin
•UserLogout
•UserRemove
•UserRemoveFromGroup |
UserRemoveFromGroup
The user was removed from the group.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• DoneByUser
The user that was targeted.
Property
|
Type
|
Description
|
Example
|
Sid
|
String
|
Which user (account SID) is behind the given event
|
|
SidNameUse
|
Symbol
|
Which group (its SID type) is behind the given event
|
Groups are:
•1—User
•2—Group
•3—Domain
•4—Alias
•5—WellKnownGroup
•6—DeletedAccount
•7—Invalid
•8—Unknown
•9—Computer
•10—Label
•11—LogonSession |
UserName
|
String
|
Which user (account name) is behind the given event
|
|
Supported operations
•UserActivate
•UserAddToGroup
•UserCreate
•UserDisable
•UserLogin
•UserLogout
•UserRemove
•UserRemoveFromGroup |
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
• TargetUser
The user that was targeted.
Property
|
Type
|
Description
|
Example
|
Sid
|
String
|
Which user (account SID) is behind the given event
|
|
SidNameUse
|
Symbol
|
Which group (its SID type) is behind the given event
|
Groups are:
•1—User
•2—Group
•3—Domain
•4—Alias
•5—WellKnownGroup
•6—DeletedAccount
•7—Invalid
•8—Unknown
•9—Computer
•10—Label
•11—LogonSession |
UserName
|
String
|
Which user (account name) is behind the given event
|
|
Supported operations
•UserActivate
•UserAddToGroup
•UserCreate
•UserDisable
•UserLogin
•UserLogout
•UserRemove
•UserRemoveFromGroup |
• UserGroupData
Same as UserLogonData but with properties to data about groups.
Property
|
Type
|
Description
|
Example
|
Sid
|
String
|
Which user (account SID) is behind the given event
|
|
SidNameUse
|
Symbol
|
Which group (its SID type) is behind the given event
|
Groups are:
•1—User
•2—Group
•3—Domain
•4—Alias
•5—WellKnownGroup
•6—DeletedAccount
•7—Invalid
•8—Unknown
•9—Computer
•10—Label
•11—LogonSession |
UserName
|
String
|
Which user (account name) is behind the given event
|
|
Supported operations
•UserAddToGroup
•UserRemoveFromGroup |
VirtualDiskMounted
An event from VirtualDiskMount was executed.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• FileItem
Return the information about the current file
Property
|
Type
|
Description
|
Example
|
ADS
|
String
|
The ADS part of the path
|
C:\windows\system32\notepad.exe:example -> example
|
Extension
|
String
|
The file extension
|
C:\windows\system32\notepad.exe -> exe
|
FileName
|
String
|
The filename with the file extension
|
C:\windows\system32\notepad.exe -> notepad.exe
|
FileNameWithoutExtension
|
String
|
Filename without the file extension
|
C:\windows\system32\notepad.exe -> notepad
|
FullPath
|
Path
|
The file path including filename
|
C:\windows\system32\notepad.exe -> C:\windows\system32\notepad.exe
|
NameLength
|
Int
|
The length of the name
|
C:\windows\system32\notepad.exe -> 7
|
Path
|
Path
|
The file path
|
C:\windows\system32\notepad.exe -> C:\windows\system32\
|
isSelf
|
Bool
|
Triggers if the operation is done by the file on itself (common for malware to delete itself)
|
true/false
|
Canary File
Path properties have a special variable for Canary files. The value to specify the path to the Canary file is %CanaryFile%.
<definition>
<operations>
<operation type="WriteFile">
<condition component="FileItem" property="Path" condition="is" value="%CanaryFile%" />
</operation>
</operations>
</definition>
|
Supported operations
•Codeinjection
•CreateNamedPipe
•CreateProcess
•DeleteFile
•LoadDLL
•LoadDriver
•ModuleDrop
•OpenProcess
•ReadFile
•RenameFile
•ScheduledTaskAdded
•ServiceInstalled
•ServiceStarted
•SetFileAttribute
•TruncateFile
•UnloadDriver
•VirtualDiskMounted
•WmiExecution
•WriteFile |
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
WmiExecution
WMI execution event was triggered.
Supported components:
• ClientEnterprise
ClientEnterprise is available only in combination with the WmiExecution and WmiQuery operations, which have a client process. A client process is a process that actually executed a WMI method.
Supported operations
•WmiExecution
•WmiQuery |
• ClientFileItem
ClientFileItem is available only in combination with the WmiExecution and WmiQuery operations, which have a client process. A client process is a process that actually executed a WMI method.
Property
|
Type
|
Description
|
Example
|
ADS
|
String
|
The ADS part of the path
|
C:\windows\system32\notepad.exe:example -> example
|
Extension
|
String
|
The file extension
|
C:\windows\system32\notepad.exe -> exe
|
FileName
|
String
|
The filename with the file extension
|
C:\windows\system32\notepad.exe -> notepad.exe
|
FileNameWithoutExtension
|
String
|
Filename without the file extension
|
C:\windows\system32\notepad.exe -> notepad
|
FullPath
|
Path
|
The file path including filename
|
C:\windows\system32\notepad.exe -> C:\windows\system32\notepad.exe
|
NameLength
|
Int
|
The length of the name
|
C:\windows\system32\notepad.exe -> 7
|
Path
|
Path
|
The file path
|
C:\windows\system32\notepad.exe -> C:\windows\system32\
|
isSelf
|
Bool
|
Triggers if the operation is done by the file on itself (common for malware to delete itself)
|
true/false
|
Supported operations
•WmiExecution
•WmiQuery |
• ClientLiveGrid
ClientLiveGrid is available only in combination with the WmiExecution and WmiQuery operations, which have a client process. A client process is a process that actually executed a WMI method.
Property
|
Type
|
Description
|
Example
|
Age
|
Int
|
The number of days since the executable was first seen in LiveGrid. The number is rounded to the equivalent of the week, month, half of the year, year, etc.
|
|
Reputation
|
Int
|
The number on the reputation scale. The higher, the more trusted
|
Possible values are:
•9, 8—Trusted
•7, 6—OK
•5, 4—Risky
•3—PUA, Unknown (not seen by LiveGrid)
•2, 1—Malware |
Popularity
|
Int
|
The number of computers on which LiveGrid has seen an executable. It is rounded to numbers like 10, 100, 1000, 10000, etc. Malware usually does not exceed the popularity of 1000 until it is detected.
|
|
Supported operations
•WmiExecution
•WmiQuery |
• ClientModule
ClientModule is available only in combination with the WmiExecution and WmiQuery operations, which have a client process. A client process is a process that actually executed a WMI method.
Property
|
Type
|
Description
|
Example
|
AugurScore
|
Int
|
The score number by ESET machine-learning engine. Possible values are 0 to 99
|
67
|
CompanyName
|
String
|
From version info, name of the company that produced the file
|
"Microsoft Corporation"
|
DaysSinceLastNearMiss
|
Int
|
Number of days since the file was recognized as nearmiss.
Nearmiss—the detection is triggered due to malware, but it may be a false positive (we cannot guarantee it is malware)
|
|
EmulationStatus
|
Int
|
The status of the file emulation (if the file was emulated by advanced heuristics)
|
0—Was not emulated
1—Was emulated
|
FileDescription
|
String
|
From version info, file description shown to users
|
"Microsoft Windows Resource Leak Diagnostic"
|
FileOrigin
|
Symbol
|
File delivered through RDP
|
Possible values are:
0—RDP
|
FileSize
|
Int
|
Filesize in bytes
|
41984
|
FileVersion
|
String
|
From version info, the version number of the file
|
"10.0.14393.0"
|
InternalName
|
String
|
From version info, internal name of the file
|
"RdrLeakDiag.exe"
|
IsDLL
|
Bool
|
The file is a PE DLLs
|
true/false
|
IsElf
|
Bool
|
The file is an ELF file
|
true/false
|
IsExe
|
Bool
|
The file is an executable
|
true/false
|
IsMacho
|
Bool
|
Defines whether a file is a Mach-O (macOS) file or not
|
true/false
|
IsNative
|
Bool
|
The file is a native PE executable
|
true/false
|
isPe
|
Bool
|
The file is a Windows executable
|
true/false
|
MD5
|
Hash
|
md5 hash of the executable
|
|
MachoIsProtected
|
Bool
|
Module is a protected Mach-O executable
|
|
MachoSignatureId
|
String
|
Identifier of a Mach-O file present in the signature
|
"com.apple.ls"
|
MachoSignerCns
|
Set of strings
|
Set of common names from certificates in Mach-O file
|
|
MachoUserId
|
String
|
Unique developer ID assigned by Apple
|
|
OriginalFileName
|
String
|
From version info, original name of the file
|
"RdrLeakDiag.exe"
|
PackerName1
|
String
|
Name of the packer
|
"UPX"
|
ProductName
|
String
|
From version info, name of the product with which the file is distributed
|
"Microsoft Windows Operating System"
|
ProductVersion
|
String
|
From version info, the version number of the product with which the file is distributed
|
"10.0.14393"
|
SFXName
|
String
|
Name of the sfx packer
|
"Zip"
|
Sha1
|
Hash
|
sha1 hash of the executable
|
fa7ebffd41bc44c47ea1b11928ee368c19f6d6a2
|
Sha256
|
Hash
|
sha256 hash of the executable
|
|
SignatureType
|
Symbol
|
Signature type of the executable
|
Possible values are:
•90—Trusted—The signature is trusted by Endpoint
•80—Valid—The signature is trusted by the OS
•75—Adhoc—The certificate is self signed
•70—None—There is no signature in the file
•60—Invalid—The signature is not valid/corrupted/revoked
•50—Present—The signature is present, but the certificate status is unknown
•50—Unknown—Failed to verify certificate |
SignerName
|
String
|
Name of the signer, if any
|
"Microsoft Windows"
|
Tags
|
String
|
Allows a user to filter by a module that has a specified tag attached
|
|
Whitelist
|
Symbol
|
Whitelist type of the executable
|
Possible values are:
•0—None—No whitelisting for this file
•1—Authoritative—The file is whitelisted by Endpoint
•2—LiveGrid—The file is whitelisted from LiveGrid
•3—Certificate—The file certificate is whitelisted |
|
|
1Names of packers may change in the future. Therefore we recommend using isnotempty or isempty value for the condition.
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
•WmiExecution
•WmiQuery |
• ClientProcessInfo
ClientProcessInfo is available only in combination with the WmiExecution, WmiQuery and CodeInjection operations, which have a client process. A client process is a process that actually executed a WMI method.
Property
|
Type
|
Description
|
Example
|
CaseSensitiveCommandLine
|
String
|
Allows creating rules for command line that is case sensitive
|
|
CommandLine
|
String
|
Process command line
|
file.txt
|
CommandLineLength
|
Int
|
Length of the command line
|
123
|
Compromised
|
Bool
|
The process was marked as compromised by a rule with MarkAsCompromised action
|
true/false or 1/0
|
IntegrityLevel
|
Symbol
|
Integrity level of the process
|
Possible values are:
•0—Untrusted
•4096—Low
•8192—Medium
•12288—High
•16384—System
•20480—Protected process |
LnkPath
|
String
|
Contains a path to a shortcut execution
|
|
ProcessDistance
|
Int
|
The distance of the process from the current process
|
123
|
ProcessLevel
|
Int
|
Depth of the process in process hierarchy
|
123
|
ProcessOwner
|
String
|
The user that created the process
|
|
RiskScore
|
Int
|
Score is tracked for each process on the Endpoint. You can use actions IncreaseParentRiskScore or IncreaseRiskScore to increase the value by set amount. When risk score threshold is reached, KillParentProcess or KillProcess action is triggered. You can specify risk score threshold via Policy > ESET Inspect Connector > Advanced settings. The risk score resets after a certain period of time, by default 6 hours.
|
1000
|
Supported operations
•Codeinjection
•WmiExecution
•WmiQuery |
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• FileItem
Return the information about the current file
Property
|
Type
|
Description
|
Example
|
ADS
|
String
|
The ADS part of the path
|
C:\windows\system32\notepad.exe:example -> example
|
Extension
|
String
|
The file extension
|
C:\windows\system32\notepad.exe -> exe
|
FileName
|
String
|
The filename with the file extension
|
C:\windows\system32\notepad.exe -> notepad.exe
|
FileNameWithoutExtension
|
String
|
Filename without the file extension
|
C:\windows\system32\notepad.exe -> notepad
|
FullPath
|
Path
|
The file path including filename
|
C:\windows\system32\notepad.exe -> C:\windows\system32\notepad.exe
|
NameLength
|
Int
|
The length of the name
|
C:\windows\system32\notepad.exe -> 7
|
Path
|
Path
|
The file path
|
C:\windows\system32\notepad.exe -> C:\windows\system32\
|
isSelf
|
Bool
|
Triggers if the operation is done by the file on itself (common for malware to delete itself)
|
true/false
|
Canary File
Path properties have a special variable for Canary files. The value to specify the path to the Canary file is %CanaryFile%.
<definition>
<operations>
<operation type="WriteFile">
<condition component="FileItem" property="Path" condition="is" value="%CanaryFile%" />
</operation>
</operations>
</definition>
|
Supported operations
•Codeinjection
•CreateNamedPipe
•CreateProcess
•DeleteFile
•LoadDLL
•LoadDriver
•ModuleDrop
•OpenProcess
•ReadFile
•RenameFile
•ScheduledTaskAdded
•ServiceInstalled
•ServiceStarted
•SetFileAttribute
•TruncateFile
•UnloadDriver
•VirtualDiskMounted
•WmiExecution
•WriteFile |
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
• WmiExecutionInfo
WMI execution event occurs only when the WMI method, Win32_process.create() is called.
Property
|
Type
|
Description
|
ClassName
|
String
|
A class containing a triggered method
|
ClientMachineFQDN
|
String
|
Fully qualified domain name of the client machine
|
CommandLine
|
String
|
A command line sent to a method as a list of arguments
|
IsLocal
|
Bool
|
Determines if a method was called locally or remotely
|
MethodName
|
String
|
A method that was triggered
|
Example
<rule>
<definition>
<operations>
<operation type="WmiExecution" >
<condition component="WmiExecutionInfo" property="CommandLine" condition="is" value="notepad.exe"/>
</operation>
</operations>
</definition>
<description>
<name>WMI Execution event where argument is notepad.exe</name>
<category>Default</category>
</description>
</rule>
|
Supported operations
•WmiExecution |
WmiPersistence
The event is generated when consumer binds to a filter.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
• WmiPersistenceInfo
The event is generated when consumer binds to a filter.
Property
|
Type
|
Description
|
EventConsumerName
|
String
|
A name of a consumer which triggers an action when a specific event arrives
|
EventFilterName
|
String
|
Name of the used EventFilter
|
Handler
|
String
|
Command line executed by an event consumer
|
Query
|
String
|
A query in an event filter that captures events that should execute an action
|
TriggeringUserName
|
String
|
A name of a user who triggered an event matched by a filter
|
TriggeringUserSid
|
String
|
Triggering the user's security ID
|
TriggeringUserSidNameUse
|
Int
|
Triggering the user's SID type
|
Example
<rule>
<definition>
<operations>
<operation type="WmiPersistence" >
<condition component="WmiPersistenceInfo" property="TriggeringUserName" condition="is" value="domain\user.name"/>
</operation>
</operations>
</definition>
<description>
<name>WMI Persistence event triggered by user.name</name>
<category>Default</category>
</description>
</rule>
|
Supported operations
•WmiPersistence |
WmiQuery
WMI query was executed on a computer.
Supported components:
• ClientEnterprise
ClientEnterprise is available only in combination with the WmiExecution and WmiQuery operations, which have a client process. A client process is a process that actually executed a WMI method.
Supported operations
•WmiExecution
•WmiQuery |
• ClientFileItem
ClientFileItem is available only in combination with the WmiExecution and WmiQuery operations, which have a client process. A client process is a process that actually executed a WMI method.
Property
|
Type
|
Description
|
Example
|
ADS
|
String
|
The ADS part of the path
|
C:\windows\system32\notepad.exe:example -> example
|
Extension
|
String
|
The file extension
|
C:\windows\system32\notepad.exe -> exe
|
FileName
|
String
|
The filename with the file extension
|
C:\windows\system32\notepad.exe -> notepad.exe
|
FileNameWithoutExtension
|
String
|
Filename without the file extension
|
C:\windows\system32\notepad.exe -> notepad
|
FullPath
|
Path
|
The file path including filename
|
C:\windows\system32\notepad.exe -> C:\windows\system32\notepad.exe
|
NameLength
|
Int
|
The length of the name
|
C:\windows\system32\notepad.exe -> 7
|
Path
|
Path
|
The file path
|
C:\windows\system32\notepad.exe -> C:\windows\system32\
|
isSelf
|
Bool
|
Triggers if the operation is done by the file on itself (common for malware to delete itself)
|
true/false
|
Supported operations
•WmiExecution
•WmiQuery |
• ClientLiveGrid
ClientLiveGrid is available only in combination with the WmiExecution and WmiQuery operations, which have a client process. A client process is a process that actually executed a WMI method.
Property
|
Type
|
Description
|
Example
|
Age
|
Int
|
The number of days since the executable was first seen in LiveGrid. The number is rounded to the equivalent of the week, month, half of the year, year, etc.
|
|
Reputation
|
Int
|
The number on the reputation scale. The higher, the more trusted
|
Possible values are:
•9, 8—Trusted
•7, 6—OK
•5, 4—Risky
•3—PUA, Unknown (not seen by LiveGrid)
•2, 1—Malware |
Popularity
|
Int
|
The number of computers on which LiveGrid has seen an executable. It is rounded to numbers like 10, 100, 1000, 10000, etc. Malware usually does not exceed the popularity of 1000 until it is detected.
|
|
Supported operations
•WmiExecution
•WmiQuery |
• ClientModule
ClientModule is available only in combination with the WmiExecution and WmiQuery operations, which have a client process. A client process is a process that actually executed a WMI method.
Property
|
Type
|
Description
|
Example
|
AugurScore
|
Int
|
The score number by ESET machine-learning engine. Possible values are 0 to 99
|
67
|
CompanyName
|
String
|
From version info, name of the company that produced the file
|
"Microsoft Corporation"
|
DaysSinceLastNearMiss
|
Int
|
Number of days since the file was recognized as nearmiss.
Nearmiss—the detection is triggered due to malware, but it may be a false positive (we cannot guarantee it is malware)
|
|
EmulationStatus
|
Int
|
The status of the file emulation (if the file was emulated by advanced heuristics)
|
0—Was not emulated
1—Was emulated
|
FileDescription
|
String
|
From version info, file description shown to users
|
"Microsoft Windows Resource Leak Diagnostic"
|
FileOrigin
|
Symbol
|
File delivered through RDP
|
Possible values are:
0—RDP
|
FileSize
|
Int
|
Filesize in bytes
|
41984
|
FileVersion
|
String
|
From version info, the version number of the file
|
"10.0.14393.0"
|
InternalName
|
String
|
From version info, internal name of the file
|
"RdrLeakDiag.exe"
|
IsDLL
|
Bool
|
The file is a PE DLLs
|
true/false
|
IsElf
|
Bool
|
The file is an ELF file
|
true/false
|
IsExe
|
Bool
|
The file is an executable
|
true/false
|
IsMacho
|
Bool
|
Defines whether a file is a Mach-O (macOS) file or not
|
true/false
|
IsNative
|
Bool
|
The file is a native PE executable
|
true/false
|
isPe
|
Bool
|
The file is a Windows executable
|
true/false
|
MD5
|
Hash
|
md5 hash of the executable
|
|
MachoIsProtected
|
Bool
|
Module is a protected Mach-O executable
|
|
MachoSignatureId
|
String
|
Identifier of a Mach-O file present in the signature
|
"com.apple.ls"
|
MachoSignerCns
|
Set of strings
|
Set of common names from certificates in Mach-O file
|
|
MachoUserId
|
String
|
Unique developer ID assigned by Apple
|
|
OriginalFileName
|
String
|
From version info, original name of the file
|
"RdrLeakDiag.exe"
|
PackerName1
|
String
|
Name of the packer
|
"UPX"
|
ProductName
|
String
|
From version info, name of the product with which the file is distributed
|
"Microsoft Windows Operating System"
|
ProductVersion
|
String
|
From version info, the version number of the product with which the file is distributed
|
"10.0.14393"
|
SFXName
|
String
|
Name of the sfx packer
|
"Zip"
|
Sha1
|
Hash
|
sha1 hash of the executable
|
fa7ebffd41bc44c47ea1b11928ee368c19f6d6a2
|
Sha256
|
Hash
|
sha256 hash of the executable
|
|
SignatureType
|
Symbol
|
Signature type of the executable
|
Possible values are:
•90—Trusted—The signature is trusted by Endpoint
•80—Valid—The signature is trusted by the OS
•75—Adhoc—The certificate is self signed
•70—None—There is no signature in the file
•60—Invalid—The signature is not valid/corrupted/revoked
•50—Present—The signature is present, but the certificate status is unknown
•50—Unknown—Failed to verify certificate |
SignerName
|
String
|
Name of the signer, if any
|
"Microsoft Windows"
|
Tags
|
String
|
Allows a user to filter by a module that has a specified tag attached
|
|
Whitelist
|
Symbol
|
Whitelist type of the executable
|
Possible values are:
•0—None—No whitelisting for this file
•1—Authoritative—The file is whitelisted by Endpoint
•2—LiveGrid—The file is whitelisted from LiveGrid
•3—Certificate—The file certificate is whitelisted |
|
|
1Names of packers may change in the future. Therefore we recommend using isnotempty or isempty value for the condition.
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
•WmiExecution
•WmiQuery |
• ClientProcessInfo
ClientProcessInfo is available only in combination with the WmiExecution, WmiQuery and CodeInjection operations, which have a client process. A client process is a process that actually executed a WMI method.
Property
|
Type
|
Description
|
Example
|
CaseSensitiveCommandLine
|
String
|
Allows creating rules for command line that is case sensitive
|
|
CommandLine
|
String
|
Process command line
|
file.txt
|
CommandLineLength
|
Int
|
Length of the command line
|
123
|
Compromised
|
Bool
|
The process was marked as compromised by a rule with MarkAsCompromised action
|
true/false or 1/0
|
IntegrityLevel
|
Symbol
|
Integrity level of the process
|
Possible values are:
•0—Untrusted
•4096—Low
•8192—Medium
•12288—High
•16384—System
•20480—Protected process |
LnkPath
|
String
|
Contains a path to a shortcut execution
|
|
ProcessDistance
|
Int
|
The distance of the process from the current process
|
123
|
ProcessLevel
|
Int
|
Depth of the process in process hierarchy
|
123
|
ProcessOwner
|
String
|
The user that created the process
|
|
RiskScore
|
Int
|
Score is tracked for each process on the Endpoint. You can use actions IncreaseParentRiskScore or IncreaseRiskScore to increase the value by set amount. When risk score threshold is reached, KillParentProcess or KillProcess action is triggered. You can specify risk score threshold via Policy > ESET Inspect Connector > Advanced settings. The risk score resets after a certain period of time, by default 6 hours.
|
1000
|
Supported operations
•Codeinjection
•WmiExecution
•WmiQuery |
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
• WmiQueryInfo
WMI query events occur when a user or a service trigger a query on a system.
Property
|
Type
|
Description
|
ClientMachineFQDN
|
String
|
Fully qualified domain name of the client machine
|
IsLocal
|
Bool
|
If false, a query was called from a remote machine (for example, using WbemTest)
|
Query
|
String
|
A query was triggered in a system
|
Example
<?xml version="1.0" encoding="utf-8"?>
<rule>
<definition>
<operations>
<operation type="WmiQuery">
<condition component="WmiQueryInfo" property="Query" condition="contains" value="win32_service" />
</operation>
</operations>
</definition>
<description>
<name>Example WMI query event</name>
<explanation>
This tag supports markdown and html syntax.
It is also true for maliciousCauses, benignCauses and recommendedActions tags.
</explanation>
<maliciousCauses>
Content of tags with HTML text must be surrounded with CDATA xml tag.
</maliciousCauses>
<category>
Default
</category>
</description>
</rule>
|
Supported operations
•WmiQuery |
WriteFile
A file was written to.
Supported components:
• DateTime
Allows you to write rules that are triggered only at a specified time.
Property
|
Type
|
Description
|
Example
|
DayOfWeek
|
Int
|
Trigger the rule only on certain days of the week
|
Possible values are:
•0—Sunday
•1—Monday
•2—Tuesday
•3—Wednesday
•4—Thursday
•5—Friday
•6—Saturday |
Hour
|
Int
|
Trigger the rule only in certain parts of the day. Possible values are 0 to 23
|
12
|
Minute
|
Int
|
Trigger the rule only in certain parts of the day.
Possible values are 0 to 59
|
30
|
Example
This rule is triggered every time the Notepad is opened from Monday to Friday between 9 a.m. to 5 p.m.
<definition>
<process>
<operator type="and">
<condition component="FileItem" property="FileNameWithoutExtension" condition="is" value="Notepad" />
<condition component="DateTime" property="Hour" condition="greaterOrEqual" value="9" />
<condition component="DateTime" property="Hour" condition="lessOrEqual" value="17" />
<condition component="DateTime" property="DayOfWeek" condition="greaterOrEqual" value="1" />
<condition component="DateTime" property="DayOfWeek" condition="lessOrEqual" value="5" />
</operator>
</process>
</definition>
|
Supported operations
DateTime component is supported by all operations.
|
• EnterpriseInspector
Provides information about Connector.
Property
|
Type
|
Description
|
Example
|
VersionString
|
String
|
Version string of Connector.
|
1.9.2385
|
VersionMajor
|
Int
|
Major version of Connector.
|
1
|
VersionMinor
|
Int
|
Minor version of Connector.
|
9
|
BuildNumber
|
Int
|
Build number of Connector.
|
2385
|
Supported operations
EnterpriseInspector component is supported by all operations.
|
• FileItem
Return the information about the current file
Property
|
Type
|
Description
|
Example
|
ADS
|
String
|
The ADS part of the path
|
C:\windows\system32\notepad.exe:example -> example
|
Extension
|
String
|
The file extension
|
C:\windows\system32\notepad.exe -> exe
|
FileName
|
String
|
The filename with the file extension
|
C:\windows\system32\notepad.exe -> notepad.exe
|
FileNameWithoutExtension
|
String
|
Filename without the file extension
|
C:\windows\system32\notepad.exe -> notepad
|
FullPath
|
Path
|
The file path including filename
|
C:\windows\system32\notepad.exe -> C:\windows\system32\notepad.exe
|
NameLength
|
Int
|
The length of the name
|
C:\windows\system32\notepad.exe -> 7
|
Path
|
Path
|
The file path
|
C:\windows\system32\notepad.exe -> C:\windows\system32\
|
isSelf
|
Bool
|
Triggers if the operation is done by the file on itself (common for malware to delete itself)
|
true/false
|
Canary File
Path properties have a special variable for Canary files. The value to specify the path to the Canary file is %CanaryFile%.
<definition>
<operations>
<operation type="WriteFile">
<condition component="FileItem" property="Path" condition="is" value="%CanaryFile%" />
</operation>
</operations>
</definition>
|
Supported operations
•Codeinjection
•CreateNamedPipe
•CreateProcess
•DeleteFile
•LoadDLL
•LoadDriver
•ModuleDrop
•OpenProcess
•ReadFile
•RenameFile
•ScheduledTaskAdded
•ServiceInstalled
•ServiceStarted
•SetFileAttribute
•TruncateFile
•UnloadDriver
•VirtualDiskMounted
•WmiExecution
•WriteFile |
• SystemInfo
Info about the system the events are coming from.
Property
|
Type
|
Description
|
Example
|
isServer
|
Bool
|
Indicates whether the system is a server
|
False—Not a server
True—Server
|
SystemArchitecture
|
Symbol
|
The type of system architecture
|
To match 32-bit architecture use one of following:
•32
•32bit
•x86
•0
To match 64-bit architecture use one of the following:
•64
•x64
•64bit
•amd64
•x86-64
•1 |
SystemType
|
Symbol
|
What type of operating system triggered the event
|
To match Windows system use one of the following:
•Windows
•Win
•0
To match MacOS system use one of the following:
•macOs
•macOsx
•Osx
•1
To match Linux system use the following:
•2 |
SystemVersion
|
String
|
The whole system version with major and minor numbers
|
|
Tags
|
Set of strings
|
Tags assigned to that specific system
|
|
Conditions supported for set types (Set of IPv4 addresses, Set of IPv6 addresses, Set of strings, Set of symbols) are listed in the Property types & Relations table under set of values.
Supported operations
SystemInfo component is supported by all operations.
|
|
|
Earlier versions of Windows do not produce WMI events. This functionality has been available since Windows 10 version 1803.
Some of the events provide only partial information:
•File write events—only the first file change is recorded (This is per process. If two processes change the same file, both changes are recorded)
•Registry related events—only the first registry key change is recorded (first time by a process)
•DLLLoad—only DLLs that are not whitelisted by AV are recorded
•TcpIp events—only the first connection is recorded (first time by a process)
•Http events—only the first request is recorded (first time by a process)
•ModuleDrop (a.k.a PEDrop)—it is reported only for the first drop of a given module (first time on a computer)
•AmsiTriggerEvent—only the first execution is recorded (first time on a computer) |
