synoti logosynoti logo
SonicWall

Detection rules for SonicWall Data sources. Every rule contains its MITRE ATT&CK mapping, an impact rating, and details on what it identifies.

This category lists 10 detection rules.

RuleCategoryTechniqueImpact (C/I/A)
SonicWall Anti-Spyware DetectionDiscoveryT1082 - System Information DiscoveryC:3 / I:2 / A:1
SonicWall Botnet Activity DetectedCommand and ControlT1071 - Application Layer ProtocolC:3 / I:3 / A:2
SonicWall Capture ATP Malicious VerdictExecutionT1204 - User ExecutionC:3 / I:3 / A:2
SonicWall Capture Client Threat DetectionDefense Evasion, Privilege EscalationT1055 - Process InjectionC:3 / I:3 / A:2
SonicWall Encrypted Threats DetectionCommand and ControlT1573 - Encrypted ChannelC:3 / I:3 / A:2
SonicWall Gateway Anti-Virus DetectionCommand and ControlT1105 - Ingress Tool TransferC:3 / I:3 / A:2
SonicWall Intrusion Prevention System AlertInitial AccessT1190 - Exploit Public-Facing ApplicationC:3 / I:3 / A:3
SonicWall Management Interface Authentication FailuresCredential AccessT1110 - Brute ForceC:3 / I:2 / A:1
SonicWall SSL VPN Authentication FailuresCredential AccessT1133 - External Remote ServicesC:3 / I:2 / A:1
SonicWall Zero-Day Threat DetectionInitial AccessT1190 - Exploit Public-Facing ApplicationC:3 / I:3 / A:3

Rule Example

Below is an example of a rule definition for SonicWall Anti-Spyware Detection (view in repository):

# Rule version v1.0.0

dataTypes:
  - firewall-sonicwall
name: SonicWall Anti-Spyware Detection
impact:
  confidentiality: 3
  integrity: 2
  availability: 1
category: Discovery
technique: "T1082 - System Information Discovery"
adversary: origin
references:
  - https://www.sonicwall.com/techdocs/pdf/sonicos-6-5-4-log-events-reference-guide.pdf
  - https://attack.mitre.org/techniques/T1082/
description: |
  Detects when SonicWall Anti-Spyware service identifies and blocks spyware, adware, or other potentially unwanted programs (PUPs) that may be attempting to collect sensitive information or establish persistence on the network.

  Next Steps:
  - Review the detected spyware category and priority level
  - Investigate the source IP address for other malicious activities
  - Check if the blocked spyware represents a targeted attack or widespread infection
  - Verify that Anti-Spyware policies are properly configured and up-to-date
  - Consider quarantining the affected host if multiple spyware detections occur
  - Review network traffic patterns from the source to identify potential data exfiltration
where: |
  (exists("log.spycat") || 
   contains("log.message", "spyware") ||
   contains("log.message", "Anti-Spyware") ||
   contains("log.eventName", "Anti-Spyware") ||
   contains("log.category", "Anti-Spyware") ||
   (exists("log.spypri") && !equals("log.spypri", "0"))) &&
  (equals("action", "blocked") || equals("log.fw_action", "drop"))
afterEvents:
  - indexPattern: v1-7-22-log-firewall-sonicwall-*
    with:
      - field: origin.ip
        operator: filter_term
        value: '{{.origin.ip}}'
    within: now-1h
    count: 3
deduplicateBy:
  - adversary.ip
  - target.host

Rule Details

SonicWall Anti-Spyware Detection

Identifies instances where the SonicWall Anti-Spyware service recognizes and prevents spyware, adware, or other potentially unwanted programs (PUPs) that could be trying to gather sensitive data or maintain a foothold on the network.

SonicWall Botnet Activity Detected

Identifies possible botnet command and control (C2) traffic or activity from an infected host as flagged by SonicWall's botnet filter. This covers suspicious outbound connections, HTML infection chains, or recognized botnet signatures.

SonicWall Capture ATP Malicious Verdict

Detects when SonicWall Capture ATP (Advanced Threat Protection) determines that a file is malicious following sandbox analysis. This points to an attempted malware delivery or execution that the ATP service stopped.

SonicWall Capture Client Threat Detection

Identifies threats detected by SonicWall Capture Client, such as advanced malware, zero-day exploits, and sophisticated attack methods. Capture Client delivers advanced threat protection using sandboxing and behavioral analysis.

SonicWall Encrypted Threats Detection

Detects threats concealed in encrypted traffic that SonicWall DPI-SSL (Deep Packet Inspection of SSL/TLS) identifies, including malware, exploits, and attempts to exfiltrate data over encrypted channels. This rule flags when SonicWall's advanced threat protection has found malicious activity inside encrypted communications.

SonicWall Gateway Anti-Virus Detection

Identifies when SonicWall Gateway Anti-Virus (GAV) detects and blocks malicious content. This suggests possible malware trying to enter the network via web traffic, email attachments, or file downloads. The Gateway Anti-Virus service inspects HTTP, HTTPS, FTP, and SMTP traffic in real time to find and stop malware from crossing the network perimeter.

SonicWall Intrusion Prevention System Alert

Detects when SonicWall IPS recognizes and blocks intrusion attempts, such as buffer overflows, SQL injection, cross-site scripting, and other network-based attacks that target vulnerabilities. This rule fires when the SonicWall firewall's Intrusion Prevention System finds malicious traffic patterns or known attack signatures.

SonicWall Management Interface Authentication Failures

Identifies repeated failed authentication attempts against the SonicWall management interface, which may indicate brute force attacks on administrative credentials.

SonicWall SSL VPN Authentication Failures

Detects repeated SSL VPN authentication failures originating from the same source IP on SonicWall firewalls, suggesting brute force or credential stuffing attacks against remote access services.

SonicWall Zero-Day Threat Detection

Detects zero-day threats and unknown malware that the SonicWall Capture ATP service identifies, including sandbox detonations and RTDMI (Real-Time Deep Memory Inspection) alerts. This rule triggers when the SonicWall firewall finds previously unknown threats via advanced analysis techniques.