synoti logosynoti logo
Sophos Sophos Central

Detection rules for Sophos Central Data sources. Every rule contains its MITRE ATT&CK mapping, an impact rating, and details on what it identifies.

This category lists 19 detection rules.

RuleCategoryTechniqueImpact (C/I/A)
Application Hijacking prevented in Sophos CentralPersistenceT1574 - Hijack Execution FlowC:3 / I:3 / A:3
Credential Theft Attemp detected in Sophos CentralCredential AccessT1003 - OS Credential DumpingC:3 / I:3 / A:3
Endpoint Threat DetectionMalware DetectionT1055 - Process InjectionC:3 / I:3 / A:2
Malware detected in Sophos CentralExecutionT1204 - User ExecutionC:3 / I:3 / A:3
Man in the Middle Attack detected in Sophos CentralCredential AccessT1557 - Adversary-in-the-MiddleC:3 / I:3 / A:3
Managed Threat Response Critical AlertThreat DetectionT1562 - Impair DefensesC:3 / I:3 / A:3
Possible Botnet detected in Sophos CentralImpactT1071 - Application Layer ProtocolC:3 / I:3 / A:3
Possible Brute Force Attack detected in Sophos CentralCredential AccessT1110 - Brute ForceC:3 / I:3 / A:3
Possible Ransomware Attack detected in Sophos CentralImpactT1486 - Data Encrypted for ImpactC:3 / I:3 / A:2
Potential Password Spraying Attack detected in Sophos CentralCredential AccessT1110 - Brute ForceC:1 / I:2 / A:2
Potentially compromised or blocked device detected in Sophos CentralResource DevelopmentT1584C:3 / I:3 / A:3
Probable attempt to exploit vulnerabilities detected in Sophos CentralCredential AccessT1212C:3 / I:3 / A:3
Real Time Protection disabled in Sophos CentralDefense EvasionT1562 - Impair DefensesC:2 / I:2 / A:1
Server Protection AlertsServer SecurityT1505 - Server Software ComponentC:3 / I:3 / A:2
Sophos Central Behavioral Analysis AlertSuspicious BehaviorT1055 - Process InjectionC:3 / I:3 / A:2
Sophos Central Exploit Prevention TriggeredExploit AttemptT1203 - Exploitation for Client ExecutionC:3 / I:3 / A:2
Sophos Central Ransomware DetectionRansomware ActivityT1486 - Data Encrypted for ImpactC:3 / I:3 / A:3
Sophos Central Tamper Protection AlertDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:2 / I:3 / A:2
Unknown Threat detected in Sophos CentralExecutionT1204 - User ExecutionC:3 / I:3 / A:2

Rule Example

Below is an example of a rule definition for Application Hijacking prevented in Sophos Central (view in repository):

# Rule version v1.0.0

dataTypes:
  - "sophos-central"
name: "Application Hijacking prevented in Sophos Central"
impact:
  confidentiality: 3
  integrity: 3
  availability: 3
category: "Persistence"
technique: "T1574 - Hijack Execution Flow"
adversary: origin
references:
  - "https://attack.mitre.org/tactics/TA0003/"
  - "https://attack.mitre.org/techniques/T1574/"
description: "Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. 
              Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. 
              Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution."
where: equals("log.type", "Event::Endpoint::HmpaApplicationHijacking")
groupBy:
  - adversary.host
  - adversary.ip

Rule Details

Application Hijacking prevented in Sophos Central

Attackers can run their own harmful payloads by taking over how operating systems launch programs. Control of execution flow may serve persistence goals, because the hijacked process can recur repeatedly. Such mechanisms may also be leveraged by adversaries to gain higher privileges or bypass safeguards, including application control or other limits on execution.

Credential Theft Attemp detected in Sophos Central

Credential theft for various pages or apps happens because weak passwords are reused across multiple accounts. Such data is frequently exposed through leaks caused by attackers exploiting vulnerabilities in different platforms.

Endpoint Threat Detection

Identifies endpoint threats found by Sophos Central, such as malware, PUAs (Potentially Unwanted Applications), and suspicious behavior. This rule fires when Sophos Central detects threats including process injection, malware execution, or other malicious activity on managed endpoints.

Malware detected in Sophos Central

A computer virus is malicious code inserted before or after existing files on your computer. Their name comes from biological viruses, as they use comparable methods to propagate from one location to another. The term virus is frequently misapplied to any threat. That usage is slowly giving way to the more precise term, malware (malicious software). Computer viruses mainly target executable files and documents. In brief, a computer virus operates this way: once the infected file runs, the malicious code is invoked and executed before the original application starts. A virus can infect any files for which the current user has write permissions. Computer viruses vary in purpose and severity. Some are highly dangerous because they can deliberately delete files from the hard drive. Conversely, some viruses cause no damage and merely annoy the user while showcasing the technical abilities of their creators.

Man in the Middle Attack detected in Sophos Central

Adversaries may seek to place themselves between two or more networked devices through an adversary-in-the-middle technique to enable follow-on actions like Network Sniffing or Transmitted Data Manipulation. By exploiting capabilities of common networking protocols that govern traffic flow (e.g. ARP, DNS, LLMNR, etc.), adversaries can make a device communicate through a system they control, allowing them to gather information or carry out further actions.

Managed Threat Response Critical Alert

Identifies critical alerts from the Sophos Managed Threat Response (MTR) service that signal active threats needing immediate investigation and response, such as advanced persistent threats and sophisticated attack techniques.

Possible Botnet detected in Sophos Central

A bot, or web robot, is an automated malware program that scans ranges of network addresses and infects susceptible computers. This lets hackers seize control of numerous computers at once and convert them into bots (also called zombies). Hackers commonly use bots to infect large numbers of computers, which together form a network or botnet. Once the botnet is on your computer, it can be used for distributed denial of service (DDoS) attacks, as a proxy, and to carry out automated tasks over the Internet without your knowledge (for example, sending spam, viruses, or stealing personal and private information such as bank credentials or credit card numbers).

Possible Brute Force Attack detected in Sophos Central

Adversaries may employ brute force techniques to access accounts when passwords are unknown or when password hashes have been obtained. Lacking knowledge of the password for one account or many, an adversary can systematically guess it through a repetitive or iterative process. Brute forcing passwords may occur by interacting with a service that verifies credential validity or offline against previously obtained credential data, such as password hashes.

Possible Ransomware Attack detected in Sophos Central

Ransomware is a form of malware that blocks users from accessing their system or personal files and demands ransom payment before access can be restored. Detects ransomware attempts.

Potential Password Spraying Attack detected in Sophos Central

Adversaries may employ brute force techniques to access accounts when passwords are unknown or when password hashes have been obtained. Lacking knowledge of the password for one account or many, an adversary can systematically guess it through a repetitive or iterative process. Brute forcing passwords may occur by interacting with a service that verifies credential validity or offline against previously obtained credential data, such as password hashes.

Potentially compromised or blocked device detected in Sophos Central

Adversaries may compromise third-party infrastructure that can be used during targeting

Probable attempt to exploit vulnerabilities detected in Sophos Central

An exploit is a compact program crafted to take advantage of a specific flaw in an operating system or program for various objectives. Based on the vulnerability type, the exploit may serve different goals, such as obtaining administrator permissions on the system or evading security controls to enable a more extensive infection.

Real Time Protection disabled in Sophos Central

Real-time protection has been disabled, which can help malware and attacks go undetected

Server Protection Alerts

Identifies critical security alerts on servers safeguarded by Sophos Central, including unauthorized access attempts, service tampering, and malware aimed at server infrastructure. This rule watches for high-severity threats that specifically target server endpoints.

Sophos Central Behavioral Analysis Alert

Identifies suspicious behavior patterns flagged by the Sophos behavioral analysis engine, such as process injection attempts, privilege escalation, and other anomalous activities suggesting possible compromise.

Sophos Central Exploit Prevention Triggered

Identifies when Sophos exploit prevention is activated, signaling attempts to exploit vulnerable applications. This covers shellcode protection, CTF protocol exploitation attempts, and process hijacking attempts.

Sophos Central Ransomware Detection

Identifies ransomware activity, including CryptoGuard alerts, master boot record attacks, and file system encryption attempts. This is a critical security event that demands immediate response.

Sophos Central Tamper Protection Alert

Identifies when tamper protection is activated, signaling an attempt to disable or alter Sophos security components. This may point to malware or an attacker trying to circumvent security controls.

Unknown Threat detected in Sophos Central

A computer virus is malicious code inserted before or after existing files on your computer. Their name comes from biological viruses, as they use comparable methods to propagate from one location to another. The term virus is frequently misapplied to any threat. That usage is slowly giving way to the more precise term, malware (malicious software). Computer viruses mainly target executable files and documents. In brief, a computer virus operates this way: once the infected file runs, the malicious code is invoked and executed before the original application starts. A virus can infect any files for which the current user has write permissions. Computer viruses vary in purpose and severity. Some are highly dangerous because they can deliberately delete files from the hard drive. Conversely, some viruses cause no damage and merely annoy the user while showcasing the technical abilities of their creators.