SIEM

Kaspersky SIEM: early threat detection and other improvements

Rules for detecting atypical behavior in container infrastructure at the data collection stage, and other updates to our SIEM system.

Alexander Marmalidi
November 2, 2024

Clearly, the sooner malicious actions come to the attention of security solutions and experts, the more effectively they’re able to minimize, or even prevent damage. Therefore, while working on new detection rules for our SIEM system named the Kaspersky Unified Monitoring and Analysis Platform, we pay special attention to identifying attackers’ activity at the very initial stage of an attack, when they try to collect information about infrastructure. We’re talking about activity related to the discovery tactics according to the Enterprise Matrix MITRE ATT&CK Knowledge Base classification.

Modern attackers are increasingly paying attention to containerization infrastructure, which is where rather dangerous vulnerabilities are sometimes found. For example, our May report on exploits and vulnerabilities describes the CVE-2024-21626 vulnerability, which allows for a container escape. That’s why in our Q3 2024 SIEM system update, among the rules for identifying atypical behavior that may indicate attacker activity at the initial data collection stage, we’ve added detection rules that catch (i) attempts to collect data on the containerization infrastructure, and (ii) traces of various attempts to manipulate the containerization system itself.

This was done by adding detection rules R231, R433, and R434, which are already available to Kaspersky Unified Monitoring and Analysis Platform users through the rule update system. In particular, they’re used to detect and correlate the following events:

access to credentials inside a container;
launching a container on a non-container system;
launching a container with excessive privileges;
launching a container with access to host resources;
collecting information about containers using standard tools;
searching for weak spots in containers using standard tools;
searching for security vulnerabilities in containers using special utilities.

Considering the above-described update, there are now more than 659 rules available on the platform, including 525 rules with direct detection logic.

We continue to align our detection rules with the Enterprise Matrix MITRE ATT&CK Knowledge Base, which today describes 201 techniques, 424 sub-techniques, and thousands of procedures. As of today our solution covers 344 MITRE ATT&CK techniques and sub-techniques.

In addition, we’ve improved many old rules by correcting or adjusting conditions – for example, to reduce the number of false positives.

New and improved normalizers

In the latest update, we’ve also added to our SIEM system normalizers that allow you to work with the following event sources:

[OOTB] OpenLDAP
[OOTB] Avaya Aura Communication Manager syslog
[OOTB] Orion soft Termit syslog
[OOTB] Postfix
[OOTB] Barracuda Web Security Gateway syslog
[OOTB] Parsec ParsecNET
[OOTB] NetApp SnapCenter file
[OOTB] CommuniGate Pro
[OOTB] Kaspersky Industrial CyberSecurity for Networks 4.2 syslog
[OOTB] Yandex Cloud
[OOTB] Barracuda Cloud Email Security Gateway syslog

Our experts have also improved normalizers for these sources:

[OOTB] Yandex Browser
[OOTB] Citrix NetScaler syslog
[OOTB] KSC from SQL
[OOTB] Microsoft Products for KUMA 3
[OOTB] Gardatech Perimeter syslog
[OOTB] KSC PostgreSQL
[OOTB] Linux auditd syslog for KUMA 3.2
[OOTB] Microsoft Products via KES WIN
[OOTB] PostgreSQL pgAudit syslog
[OOTB] ViPNet TIAS syslog

You can find the full list of supported event sources in the Kaspersky Unified Monitoring and Analysis Platform version 3.2 in the technical support section of our web site, where you can also get more information about correlation rules. We’ll continue to write about improvements to our SIEM system in future posts that can be found via the SIEM tag.