synoti logosynoti logo
Sophos XG Firewall

Detection rules for XG Firewall Data sources. Every rule contains its MITRE ATT&CK mapping, an impact rating, and details on what it identifies.

This category lists 9 detection rules.

RuleCategoryTechniqueImpact (C/I/A)
Probable Sophos denial of service (DoS) attackImpactT1499 - Endpoint Denial of ServiceC:3 / I:3 / A:3
Probable Sophos initial access vulnerabilityInitial AccessT1078.001 - Valid AccountsC:2 / I:2 / A:1
Probable Sophos ip spoofing attackImpactT1499 - Endpoint Denial of ServiceC:3 / I:3 / A:3
Probable malware detected by sophos firewallExecutionT1204 - User ExecutionC:3 / I:3 / A:3
Probable password guessing in Sophos Administrator accountCredential AccessT1110.001 - Brute ForceC:3 / I:3 / A:2
Sophos XG Advanced Threat Protection AlertMalwareT1204 - User ExecutionC:3 / I:3 / A:2
Sophos XG IPS Alert DetectionIntrusion DetectionT1190 - Exploit Public-Facing ApplicationC:3 / I:3 / A:2
Sophos XG VPN Authentication FailuresCredential AccessT1110 - Brute ForceC:3 / I:2 / A:1
Sophos detected high priority alertsInitial AccessT1190 - Exploit Public-Facing ApplicationC:3 / I:3 / A:3

Rule Example

Below is an example of a rule definition for Probable Sophos denial of service (DoS) attack (view in repository):

# Rule version v1.0.0

dataTypes:
  - "firewall-sophos-xg"
name: "Probable Sophos denial of service (DoS) attack"
impact:
  confidentiality: 3
  integrity: 3
  availability: 3
category: "Impact"
technique: "T1499 - Endpoint Denial of Service"
adversary: origin
references: 
  - "https://support.sophos.com/support/s/article/KB-000035754?language=en_US"
  - "https://docs.sophos.com/nsg/sophos-firewall/18.5/PDF/SF%20syslog%20guide%2018.5.pdf"
  - "https://attack.mitre.org/tactics/TA0040"
  - "https://attack.mitre.org/techniques/T1499/"
description: "A Denial of Service (DoS) attack is an attempt to make a machine or network resource unavailable to the intended users.
              One common method of attack involves saturating the target machine with external communications requests so that it cannot
              respond to legitimate traffic or the machine responds so slowly that it is essentially useless."
where: |
  equalsIgnoreCase("log.component", "dos attacks") && equalsIgnoreCase("log.subType", "dos")
groupBy:
  - adversary.ip
  - target.ip

Rule Details

Probable Sophos denial of service (DoS) attack

A Denial of Service (DoS) attack seeks to prevent intended users from accessing a machine or network resource. A frequent attack technique is to flood the target machine with external communications requests, causing it either to fail to answer legitimate traffic or to respond so slowly that it becomes effectively unusable.

Probable Sophos initial access vulnerability

Sophos firewall has detected the Guest account activation

Probable Sophos ip spoofing attack

IP spoofing involves generating Internet Protocol (IP) packets whose source address has been altered, either to conceal the sender's identity, to pose as another computer system, or to do both. Bad actors frequently use this technique to launch DDoS attacks against a target device or the infrastructure around it.

Probable malware detected by sophos firewall

The Sophos firewall has detected a suspicious event and made some actions according to his configuration

Probable password guessing in Sophos Administrator account

Adversaries who lack prior knowledge of valid credentials in a system or environment might guess passwords in an effort to access accounts. With no knowledge of an account's password, an adversary may choose to guess it systematically through a repetitive or iterative process. During an operation, an adversary may guess login credentials without prior knowledge of system or environment passwords by drawing on a list of common passwords. Password guessing might or might not consider the target's password complexity policies or use policies that can lock accounts after a set number of failed attempts.

Sophos XG Advanced Threat Protection Alert

Identifies when Advanced Threat Protection (ATP) on Sophos XG Firewall detects malicious activity, such as sandboxing results, malware detection, and zero-day threats. This rule fires on ATP events that signal threat detection, malware identification, or virus findings.

Sophos XG IPS Alert Detection

Identifies IPS alert triggers on Sophos XG Firewall that indicate active exploitation attempts, vulnerability scanning, or known attack signatures aimed at protected hosts.

Sophos XG VPN Authentication Failures

Identifies repeated VPN authentication failures on Sophos XG Firewall, which can indicate potential brute force attacks against SSL VPN or IPsec VPN services.

Sophos detected high priority alerts

The Sophos firewall device has identified a high priority event. For this alert, high priority means the log priority is Emergency, Critical, or Alert and is not included in the list of risked applications. Refer to the logs attached to this alert for more details.