SIEM Sample Use Cases — Rules & Models

“Every Journey starts with a single step”

A SIEM Security Use Case is this first single step in the, increasingly more important, task of identifying threats in our corporate environment. Sampel Use Cases

• A process start and the files accessed by this process within 15 minutes on the same machine is a process-file access pattern. And if this pattern is seen more than 2 machines within 20 minutes, then notify.
• A corporate user downloaded a suspicious file at home and got infected. Now the attacker has gained access to her machine.Days later at work, suspicious C&C activity is detected originating from the same user machine. A week later, the attacker uses the same user’s credentials to escalate her privileges. A few days after that, the attacker uses her improved privileges and credentials to download a treasure trove of sensitive information. A few days after that the attacker manages to exfiltrate the data to a server in one of Suspicious Countries.
• Check If a request was blocked via waf from an IP address. Then check WEB Server (IIS, etc..) logs if there is a block action to a request from the same IP address was seen within 2 minutes.
• Check if there is Powershell User-Agent (WindowsPowerShell) in proxy logs.
• A user switches from their normal account to a privileged one then performs an abnormal data transfer to suspicious countries.
• A user VPNs to the network from a new location for the first time, then accesses a shared file system.
• A user logs in remotely at 3 midnight, then makes repeated attempts to connect to a production database as an administrator.

Originally published at https://www.peerlyst.com on December 25, 2019.