Delinea Privilege Manager unusual spike in bad-rated application action events from a single computer

This rule is part of a beta feature. To learn more, contact Support.
delinea-privilege-manager

Classification:

attack

Tactic:

TA0002-execution

Technique:

T1204-user-execution

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Goal

Detects an unusual spike in bad-rated application events from a single computer.

Strategy

This rule monitors the Delinea Privilege Manager events to detect an unusual spike in bad-rated application events from a single computer.

Triage and Response

  1. Review the logs of bad-rated application events from a computer name: {{@ComputerName}}({{@_ComputerId}}).
  2. Analyze the list of installed and executed applications.
  3. Quarantine or isolate affected systems to mitigate potential risks.
  4. Update application control policies to block the identified applications with bad security ratings.