Skip to content
Last update: 2022-05-25

Core Detection Coverage

Core coverage maximizes usability and performance, offering a range of detections that work independent of environment characteristics and incur a minimal performance impact regardless of workload.

With the Core set, the goal is for users to receive immediate protection against a broad spectrum of unwanted behavior. Core detections are optimized for working across different environments without user configuration or tuning but still offer a substantial breadth of coverage. Coverage includes system exploitation (including zero-day exploits), remote system access, attacker persistence, container escapes, attackers searching around the system for valuable data, and other activity indicative of an incident.

This document includes information regarding Core detections provided by Sophos. These include the following categories:

  • Detection Analytics: Core coverage that detects malicious behavior
  • Smart Policy: Provides additional context to incidents without generating false positive alerts for benign behavior

For more information, see Categories of Detections.

Detection Analytics


Application Exploitation


Repeated Program Crashes

Severity: Medium

Description

Repeated program crashes could indicate that an attacker is attempting to exploit a memory corruption vulnerability, or that there is a stability issue in the affected application. Alerts when more than 5 instances of an individual program crash via segmentation fault.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1203

T1499.004

T1190


Userfaultfd Usage

Severity: High

Description

Certain Linux functionality is almost exclusively used when exploiting kernel vulnerabilities, usually with the goal of privilege escalation. Alerts when a binary executes the userfaultfd system call.

Deployment considerations

  • This detection will only alert for kernels that support userfaultfd (kernels 4.3+).

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1203

T1106

T1068


Unusual application behavior

Suspicious Interactive Shell

Severity: High

Description

Interactive shells are rare occurrences on modern production infrastructure. Alerts when an interactive shell is started with arguments commonly used for reverse shells.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1059.004



Persistence

Kernel backdoors

BPF Program Executed

Severity: Medium

Description

The loading of a new BPF program could indicate that an attacker is loading a BPF-based rootkit to gain persistence and avoid detection. Alerts when a process loads a new privileged BPF program, if the process that is already part of an ongoing incident.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1014

T1562.006

T1547.006


Kernel Module Loaded

Severity: High

Description

Attackers commonly load malicious kernel modules (rootkits) to evade detection and maintain persistence on a compromised node. Alerts when a kernel module is loaded, if the program is already part of an ongoing incident.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1014

T1547.006

Resource hijacking

Cryptocurrency Miner Detected

Severity: Medium

Description

Opportunistic attackers often start cryptocurrency miners after compromising a node or container, usually indicating that the primary motive of the attacker is to hijack processor power. Alerts when a program with a name or arguments commonly associated with cryptocurrency miners is executed.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1496


Userland backdoors

Suspicious Program Name Executed-Space After File

Severity: Medium

Description

Attackers may create or rename malicious binaries to include a space at the end of the name in an effort to impersonate a legitimate system program or service. Alerts when a program is executed with a space after the program name.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1036.006

T1036.005

T1036.004


System Exploitation

Tampering of security mechanisms

AppArmor Disabled In Kernel

Severity: High

Description

Modification of certain AppArmor attributes can only occur in-kernel, indicating that AppArmor has been disabled by a kernel exploit or rootkit. Alerts when the AppArmor state is changed from the AppArmor configuration detected when the sensor starts.

Deployment considerations

  • If the kernel in use doesn't use AppArmor, an error may be logged for this detection when the sensor starts.

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1562.001


AppArmor Profile Modified

Severity: Medium

Description

Attackers may attempt to disable enforcement of AppArmor profiles as part of evading detection. Alerts when a command for modifying an AppArmor profile is executed, if it was not executed by a user in an SSH session.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1562.001


SELinux Disabled In Kernel

Severity: High

Description

Modification of certain SELinux attributes can only occur in-kernel, indicating that SELinux has been disabled by a kernel exploit or rootkit. Alerts when the SELinux state in the kernel has been changed from the SELinux configuration detected when the sensor starts.

Deployment considerations

  • If the kernel in use doesn't use SELinux, an error may be logged for this detection when the sensor starts.

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1562.001


SELinux Enforcement Mode Disabled From Userland

Severity: High

Description

Attackers may disable enforcement mode as a precursor to making significant system changes. Alerts when SELinux enforcement mode is disabled.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1562.001


Container escapes

Container Escape via Kernel Exploitation

Severity: High

Description

Alerts when a program uses kernel functions commonly used in container escape exploits, indicating that an attacker is escalating privileges from container-access to node-access.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1611

T1068


Userland Container Escape

Severity: High

Description

Many container escapes coerce the host to execute an in-container binary, resulting in the attacker gaining full control of the affected node. Alerts when a container-created file is executed from outside a container.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1068

T1611


Common kernel exploitation methods


Kernel Exploit

Severity: High

Description

Internal kernel functions are not accessible to regular programs, and if called, are a strong indicator that a kernel exploit has executed and that the attacker has full control of the node. Alerts when a kernel function unexpectedly returns to userland.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1212

T1211

T1068


Processor-Level Protections Disabled

Severity: High

Description

SMEP and SMAP are processor-level protections that increase difficulty for kernel exploits to succeed, and disabling these restrictions is a common early step in kernel exploits. Alerts when a program tampers with the kernel SMEP/SMAP configuration.

Deployment considerations

  • This detection is not functional for kernels between v4.19 and v5.2 (inclusive) as kernel code changes removed visibility of attempts to modify SMEP/SMAP configuration.

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1562.001



Smart Policy


File Activity


Setuid/Setgid Bit Set On File

Severity: Medium

Description

Setting setuid/setgid bits can be used to provide a persistent method for privilege escalation on a node. Alerts when the setuid or setgid bit's set on a file with the chmod family of system calls.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1548.001



Network Activity

Lateral movement

Network Service Scanner Executed

Severity: Medium

Description

An attacker or rogue user may use or install these programs to survey connected networks for additional nodes to compromise. Alerts when common network scanning program tools are executed.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1046

T1018


Network sniffing

Network Sniffing Program Executed

Severity: Medium

Description

An attacker or rogue user may execute network sniffing commands to capture credentials, PII, or other sensitive information. Alerts when a program is executed that allows network capture.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1040


Discovery


Cloud Metadata API Accessed

Severity: Medium

Description

Attackers commonly enumerate cloud environment details and gain access to instance credentials by accessing the cloud provider's metadata API. Alerts when a program accesses the cloud metadata API, if the program is already part of an ongoing incident.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1552.005


Network Connection Enumeration Via Program

Severity: Low

Description

A common post-exploitation activity for attackers involves discovering adjacent hosts and networks prior to lateral movement. Alerts when a program associated with network connection enumeration is executed, if the program is already part of an ongoing incident.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1049

T1018


Outbound connections

Remote File Copy Detected

Severity: Medium

Description

Use of file transfer tools could indicate that an attacker is attempting to move toolsets to additional hosts or exfiltrate data to a remote system. Alerts when a program associated with remote file copying is executed, if the program is already part of an ongoing incident.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1570

T1048.002



Process Activity

Debugging

Process Injection

Severity: Medium

Description

Use of process injection techniques commonly indicates that a user is debugging a program, but may also indicate that an attacker is reading secrets from or injecting code into other processes. Alerts when a program uses ptrace (debugging) mechanisms to interact with another process.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1055.008


Scheduled task changes

Scheduled Tasks Modified Via Program

Severity: Medium

Description

Modifying scheduled tasks is a common method for establishing persistence on a compromised node. Alerts when the "crontab", "at", or "batch" commands are used to modify scheduled task configurations.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1053.003

T1053.001


System configuration changes

Systemctl Usage Detected

Severity: Medium

Description

Changes to systemd units could result in security controls being relaxed or disabled, or the installation of a malicious service. Alerts when the systemctl command is used to modify systemd units.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1562.001

T1543.002

T1489


Discovery

Account Enumeration Via Program

Severity: Low

Description

Attackers will often use account enumeration programs to determine their level of access and to see if other users are currently logged in to the node. Alerts when a program associated with account enumeration is executed, if the program is already part of an ongoing incident.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1087.001

T1087.002

T1069.001

T1069.002

T1069

T1033


File and Directory Discovery Via Program

Severity: Low

Description

Exploring file systems is common post-exploitation behavior for an attacker looking for credentials and data of interest. Alerts when a program associated with file and directory enumeration is executed, if the program is already part of an ongoing incident.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1083


Network Configuration Enumeration Via Program

Severity: Low

Description

Attackers can interrogate local network and route information to identify adjacent hosts and networks ahead of lateral movement. Alerts when a program associated with network configuration enumeration is executed, if the program is already part of an ongoing incident.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1016

T1018


Process Enumeration Via Program

Severity: Low

Description

Attackers often list running programs in order to identify the purpose of a node and whether any security or monitoring tools are in place. Alerts when a program associated with process enumeration is executed, if the program is already part of an ongoing incident.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1057


System Information Enumeration Via Program

Severity: Low

Description

Attackers will commonly execute system enumeration commands to determine Linux kernel and distribution versions and features, often to identify if the node is affected by specific vulnerabilities. Alerts when a program associated with system information enumeration is executed, if the program is already part of an ongoing incident.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1082


Data collection


Data Archived Via Program

Severity: Low

Description

After gaining access to a system, an attacker may create a compressed archive of files to reduce the size of data for exfiltration. Alerts when a data compression program is executed, if the program is already part of an ongoing incident.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1560.001


Data destruction

Data Destruction Via Program

Severity: Medium

Description

Data destruction performed by a non-trusted process may indicate that an attacker is trying to remove indicators of compromise or disrupt a node. Alerts when common tools for destroying data are used, if the process is already part of an ongoing incident.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1485

T1561.001

T1561.002

T1070.004


Log daemon tampering

Log Daemon Tampering

Severity: Medium

Description

Attempts to tamper with log daemons may indicate that an attacker is trying to remove indicators of compromise and hide their trails. Alerts when daemon control programs are invoked with specific arguments, if the process is already part of an ongoing incident.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1070



User Activity

User account changes

User Account Created Via CLI

Severity: High

Description

Adding a new user is a common step for attackers when establishing persistence on a compromised node. Alerts when an identity management program is executed by a program other than a package manager.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1136.001

Risky developer activity

User Login Via SSH

Severity: Low

Description

Alerts when an interactive shell process is started by a valid system user via SSH.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1078.002

T1078.003

T1059.004

T1133


Privileged command usage


User Execution Of su Command

Severity: Medium

Description

Explicit escalation to the root user decreases the ability to correlate privileged activity to a specific user. Alerts when the 'su' command is executed.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1548.003


User Execution Of sudo Command

Severity: Medium

Description

Alerts when the 'sudo' command is executed.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1548.003


User execution of unwanted sudo command

Severity: Medium

Description

Some commands run with sudo privileges are rarely used legitimately by system administrators and could indicate an account has been compromised. Alerts when 'sudo' is used to execute privileged commands common to post-exploitation activities.

Deployment considerations

  • None

Attributes

ProductsProtect, Protect+, Complete
Default stateEnabled
Content versions4.9.0+
Minimum sensor version5.0.0
Supports aarch64Yes
ATT&CK Techniques

T1548.003


Back to top