synoti logosynoti logo
Syslog / CEF

Detection rules for Syslog / CEF Data sources. Every rule contains its MITRE ATT&CK mapping, an impact rating, and details on what it identifies.

This category lists 3 detection rules.

RuleCategoryTechniqueImpact (C/I/A)
CEF File Hash Mismatch DetectionImpactT1565.001 - Data Manipulation: Stored Data ManipulationC:3 / I:3 / A:2
CEF Source Impersonation DetectionDefense EvasionT1036 - MasqueradingC:2 / I:3 / A:1
CEF User Agent Anomaly DetectionCommand and ControlT1071.001 - Application Layer Protocol: Web ProtocolsC:2 / I:2 / A:1

Rule Example

Below is an example of a rule definition for CEF File Hash Mismatch Detection (view in repository):

# Rule version v1.0.0

dataTypes:
  - syslog
name: CEF File Hash Mismatch Detection
impact:
  confidentiality: 3
  integrity: 3
  availability: 2
category: Impact
technique: "T1565.001 - Data Manipulation: Stored Data Manipulation"
adversary: origin
references:
  - https://attack.mitre.org/techniques/T1565/001/
  - https://www.microfocus.com/documentation/arcsight/arcsight-smartconnectors-8.4/pdfdoc/cef-implementation-standard/cef-implementation-standard.pdf
description: |
  Detects file hash mismatches in CEF logs which may indicate file tampering, malware infection, or unauthorized modifications to critical files. This rule monitors custom string fields (cs1-cs6) for hash values and their labels, as well as dedicated hash fields to identify discrepancies.

  **Next Steps:**
  1. Verify the affected file integrity by recalculating its hash
  2. Check if the file modification was authorized and documented
  3. Investigate the source and timing of the file change
  4. Review system logs for unauthorized access or malware activity
  5. Compare with known good file versions or backups
  6. If malicious activity is confirmed, isolate the affected system and initiate incident response procedures
where: |
  equals("log.dataType", "cef") && 
  (
    (oneOf("log.cs1Label", ["hash", "fileHash", "md5", "sha1", "sha256"]) && exists("log.cs1") && contains("log.message", "mismatch")) ||
    (oneOf("log.cs2Label", ["hash", "fileHash", "md5", "sha1", "sha256"]) && exists("log.cs2") && contains("log.message", "mismatch")) ||
    (oneOf("log.cs3Label", ["hash", "fileHash", "md5", "sha1", "sha256"]) && exists("log.cs3") && contains("log.message", "mismatch")) ||
    (oneOf("log.cs4Label", ["hash", "fileHash", "md5", "sha1", "sha256"]) && exists("log.cs4") && contains("log.message", "mismatch")) ||
    (oneOf("log.cs5Label", ["hash", "fileHash", "md5", "sha1", "sha256"]) && exists("log.cs5") && contains("log.message", "mismatch")) ||
    (oneOf("log.cs6Label", ["hash", "fileHash", "md5", "sha1", "sha256"]) && exists("log.cs6") && contains("log.message", "mismatch")) ||
    (exists("log.fileHash") && contains("log.message", "mismatch")) ||
    (exists("log.oldFileHash") && exists("log.fileHash") && safe(log.oldFileHash, "") != safe(log.fileHash, "")) ||
    contains("log.message", "hash mismatch") ||
    contains("log.message", "checksum failure") ||
    contains("log.message", "integrity violation")
  )
groupBy:
  - lastEvent.log.fname
  - adversary.host

Rule Details

CEF File Hash Mismatch Detection

Identifies discrepancies in file hashes within CEF logs, potentially signaling file tampering, malware infection, or unauthorized changes to critical files. This rule examines custom string fields (cs1-cs6) for hash values and associated labels, along with dedicated hash fields, to uncover inconsistencies.

**

CEF Source Impersonation Detection

Identifies CEF messages whose device vendor or product fields have been spoofed, potentially signaling an attacker inserting fake security events or impersonating a trusted security device to introduce malicious log data.

CEF User Agent Anomaly Detection

Flags suspicious user agent strings in CEF logs that could point to malicious scripts, bots, vulnerability scanners, or efforts to evade security controls via user agent spoofing. This rule spots known attack tools, template injection attempts, and user agent strings that are abnormally short or long.