JSON Definitions

Prev Next

All Trellix JSON values are strings. See the parameters in the table for examples of JSON syntax.

Note

The Z character at the end of a time stamp indicates that the time displayed is in the UTC time zone. Starting in the 7.0.0 release, the time is displayed in UTC by default. To change the displayed time to your local time, use the following CLI command: fenotify default timezone localtime

Element Name

Description

Products

Event Type

Data Type

Release

alerts

alerts represents the topmost element NAME in the notification XPath.

For example:

"appliance": "2001:470:84a7:1720:2e0:81ff:fe4f:ac03",

"product": "Web MPS",

"version": "6.2.0.75853",

"msg": "concise",

"alert": {

"id": "918",

"name": "domain-match",

"severity": "minr",

"src": " "

"smtp-message

"action": "notified",

"alert-url": "https://xxx.xxx.xxx.xxx/...",

"dst": {

"mac": "00:50:56:e8:ba:21"

"malware-detected": {

"malware": {

"name": "Trojan.Downloader.Bredolab"

}

}

}

},

{

"appliance": "2001:470:84a7:1720:2e0:81ff:fe4f:ac03",

"product": "Web MPS",

"version": "6.2.0.75853",

"alert": {

"id": "2989",

"name": "infection-match",

"severity": "minr",

"action": "notified",

"alert-url": "https://xxx.xxx.xxx.xxx/"

"dst": {

"ip": "xxx.xxx.xxx.xxx",

"mac": "0a:20:02:8f:a4:27",

"port": "80"

},

"explanation": {

"analysis": "binary",

"protocol": "tcp",

"cnc-services": {

"cnc-service": {

"port": "80",

"protocol": "tcp",

"address": "xxx.xxx.xxx.xxx",

"channel": "GET /games/... HTTP/1.1::...::~~::~~"

}

},

"malware-detected": {

"malware": {

"name": "Exploit.ToolKit",

"sid": "84000006",

"stype": "bot-command"

}

}

},

"interface": {

"label": "A1",

"mode": "tap",

"interface": "pether3"

},

"occurred": "2012-10-10T07:10:50Z",

"src": {

"vlan": "0",

"ip": "xxx.xxx.xxx.xxx",

"mac": "42:54:11:11:ff:03",

"port": "49169"

}

}

}

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

(See more examples in XML notification examples per infection type):

  • /appliance

  • /appliance-id

  • /product

  • /version

  • /msg

  • /alert/id

  • /alert/name

  • /alert/severity

  • /alert/src/vlan

  • /alert/smtp-message/id

  • /alert/interface/label

  • /alert/interface/mode

  • /alert/explanation/

    analysis

  • /alert/explanation/

    protocol

  • /alert/explanation/urls

  • /alert/explanation/

    malware-detected/

    malware/content

  • /alert/explanation/

    malware-detected/

    malware/name

  • /alert/explanation/

    malware-detected/

    malware/scan

  • /alert/explanation/

    malware-detected/

    malware/sid

  • /alert/explanation/

    malware-detected/

    malware/type

  • /alert/explanation/

    malware-detected/

    malware/stype

  • /alert/explanation/

    malware-detected/

    malware/archives

  • /alert/explanation/

    malware-detected/

    malware/parent

  • /alert/explanation/

    malware-detected/

    malware/origid

  • /alert/explanation/

    malware-detected/

    malware/malicious

  • /alert/explanation/

    stolen_data/event_id

  • /alert/explanation/

    stolen_data/size

  • /alert/explanation/

    stolen_data/info/

    decrypted

  • /alert/explanation/

    stolen_data/info/

    encryption

  • /alert/explanation/

    stolen_data/info/type

  • /alert/explanation/

    stolen_data/info/

    field/name

  • /alert/explanation/

    cnc-services/

    cnc-service/port

  • /alert/explanation/

    cnc-services/

    cnc-service/protocol

  • /alert/explanation/

    os-changes/osinfo

  • /alert/explanation/

    os-changes/id

  • /alert/explanation/

    os-changes/version

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

appliance-id

appliance-id represents the appliance that was the origin of the alert.

For example (from a Central Management appliance):

"product": "CMS",

"appliance-id": "01234567897A",

"appliance": "xxx.xxx.xxx.xxx",

"alert": {

"src": {

"ip": "87.678.913.234",

"mac": "00:0c:29:4e:57:60",

"vlan": "0"

},

"product": "Web MPS",

"appliance-id": "9876543210D0",

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

Appliance ID.

Six hexadecimal numbers

7.x

8.x

alerts/

alert

alert represents the element REF= in the notification XPath

For example:

"alert": {

"id": "29129",

"name": "malware-object",

"severity": "majr",

"action": "notified",

"alert-url":

"https://xxx.xxx.xxx.xxx/

event_stream/events_for_bot?

ma_id=29129&lms_iden=00:E0:81:4F:AC:03",

"dst": {

"ip": "221.187.185.88"

},

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

“/alert“ is the secondary level element of each notification message. It may include at least one of the following sub-elements:

See more examples in :XML notification examples per infection type

  • /src

  • /explanation

  • /alert-url

  • /action

  • /locations

  • /occurred

6.0

6.1

6.2

6.3

6.4

7.x

8.x

sc-version

sc-version represents the security content version

For example:

"sc-version": "845.114"

EX

MC

WI

IM

DM

MO

version number

8.3

alerts/

alert/

src

src represents the element REF for the infected host. The source is either an email address or an IP address. The source IP address is that of the victim of the infection, not the origin of the malware.

For example:

"src": {

"ip": "xxx.xxx.xx.xxx",

"mac": "00:20:18:11:ff:40",

"vlan": "0",

"port": "49177"

},

or

"src": {

"url": "/3lC3L55QC4z3NZNm

-1-5_mal_files.zip",

"domain": "sender.com",

"smtp-mail-from":

"trellix@sender.com"

},

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

This element might include at least one of the following sub-elements or attributes in the notification:

  • /alerts/alert/src

  • /alerts/alert/src/vlan

  • /alerts/alert/src/ip

  • /alerts/alert/src/mac

  • /alerts/alert/src/url

  • /alerts/alert/src/host

  • /alerts/alert/src/port

  • /alerts/alert/src/

    domain

  • /alerts/alert/src/

    smtp-mail-from

  • /alerts/alert/src/

    repository

  • /alerts/alert/src/

    proxy

These sub-elements and attribute are described further in other rows of this table.

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

src/

vlan

vlan represents the VLAN ID.

For example:

"src": {

"vlan": "0",

"ip": "xxx.xxx.xxx.xxx",

"mac": "42:54:11:11:ff:03",

"port": "49169"

}

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

vlan is an XPath attribute of the src element, and this attribute includes the following sub-element values:

  • ip

  • port

  • mac

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

src/

ip

ip represents the IP address of the infected host.

For example:

"src": {

"vlan": "0",

"ip": "xxx.xxx.xxx.xxx",

}

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

16-byte integer IPv4 address

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

src/

mac

mac represents the MAC address of the infected host.

For example:

"src": {

"vlan": "0",

"ip": "xxx.xxx.xxx.xxx",

"mac": "42:54:11:11:ff:03",

"port": "49169"

}

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

MAC Address

Six colon-separated hexadecimal numbers

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

src/

url

url represents the URL associated with the malware.

For example:

"src": {

"vlan": "0",

"ip": "xxx.xxx.xxx.xxx",

"mac": "42:54:11:11:ff:03",

"port": "49169"

"url": “https://xxx.xxx.xxx.xxx/event_stream/

events_for_bot?ma_id\=51056&lms_iden\=00:25:90:54:7E:6E cs1Label=sname cs1=Trojan.

Generic”

}

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

HTTP or HTTPS source URL of the malware.

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

src/

host

host represents the hostname of the infected machine as detected by a Trellix appliance MVX.

For example:

"src": {

"host": "icqdos0",

}

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

src/

port

port is the port of the infected machine as detected by a Trellix appliance MVX.

For example:

"src": {

"port": "49169",

}

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

Integer

Valid Port Numbers 0~65535

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

src/

domain

domain represents the domain of the infected machine as detected by a Trellix appliance MVX

For example:

"src": {

"domain": "networkAlpha.com",

}

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

6.x

7.x

8.x

alerts/

alert/

src/

smtp-mail-from

smtp-mail-from represents the user name of the sender of the malicious email detected by a Trellix appliance.

For example:

“smtp-mail-from”: “perfEmailauto

mation.local”

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

src/

repository

repository is the file system SharePoint or mount point.

For example:

“repository”: “sharepoint”

AX

FX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

src/

proxy

proxy represents HTTP proxy (IP address) of the infected host system.

For example:

“proxy”: “xxx.xxx.xxx.xxx”

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

IP address

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

alert-url

alert-url represents the URL generated by the Trellix MVX of the alert notification for a detected malware.

For example:

“alert-url”:

“https://xxx.xxx.xxx.xxx/event_

stream_events_for_bot?ev_id=

12762&lms_iden=00:E0:81

:4F:AC:03”

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

action

action represents the notification action taken by the system during a malware detection.

For example:

“action”: “notified”,

“action”: “blocked”

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

action options:

  • notified

  • blocked

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

locations

locations represents the geolocation from which the detected malware originated.

For example:

“locations”: “FR”

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

Two-letter abbreviation of country name(s); comma-separated multiple locations are supported.

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

occurred

occurred represents the date and time of the malware infection.

For example:

“occurred”: “2012-10-11T20:09:39Z”

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

Time stamp:

  • yyyy-mm-ddTHH:mm

  • standard XML daytime format

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

dst

For Email Security — Server Edition appliances, dst represents the email destination of the targeted host. For Network Security appliances, dst represents the destination host targeted by the infected source host.

For example, for an Email Security — Server Edition appliance:

"dst": {

"ip": "xxx.xxx.xxx.xxx",

"mac": "00:10:db:ff:20:80",

"port": "80"

...

For example, for a Network Security appliance:

"dst": {

"ip": "xxx.xxx.xxx.xxx",

"mac": "02:35:4b:f8:74:8e",

"port": "80"

...

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

This element might include at least one of the following sub-elements in the notification:

  • alerts/alert/dst/mac

  • alerts/alert/dst/port

  • alerts/alert/dst/ip

  • alerts/alert/dst/smtp-to

  • alerts/alert/dst/smtp-cc

These sub-elements are described further in other rows of this table.

6.x

7.x

8.x

alerts/

alert/

dst/

mac

mac represents the MAC address of the attacker host.

For example:

"dst": {

"ip": "xxx.xxx.xxx.xxx",

"mac": "00:10:db:ff:20:80",

"port": "80"

...

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

MAC Address

Six colon-separated hexadecimal numbers

6.x

7.x

8.x

alerts/

alert/

dst/

port

port is the port of the attacker machine as detected by a Trellix appliance MVX.

For example:

"dst": {

"ip": "xxx.xxx.xxx.xxx",

"mac": "00:10:db:ff:20:80",

"port": "80"

...

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

Integer

Valid port numbers 0~65535

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

dst/

ip

ip represents the IP address of the attacker host.

For example:

"dst": {

"ip": "xxx.xxx.xxx.xxx",

"mac": "00:10:db:ff:20:80",

"port": "80"

...

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

16-byte integer IPv4 address

6.x

7.x

8.x

alerts/

alert/

dst/

smtp-to

smtp-to represents the recipient of the malicious email detected by a Trellix appliance.

For example:

"dst": {

"smtp-to":

"trellix_1@rock.titania.com"

},

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.x

7.x

8.x

alerts/

alert/

dst/

smtp-cc

smtp-cc represents the recipient of the malicious email detected by a Trellix appliance

For example:

"dst": {

"ip": "xxx.xxx.xxx.xxx",

"smtp-cc": "johndoe@zAnew.com",

"port": "80"

...

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.x

7.x

8.x

alerts/

alert/

smtp-message

smtp-message represents the SMTP email message ID and other information associated with the infected email.

For example:

"smtp-message":

“20121017232425.6706.77689.

Email-48trellix.com”

...

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

This element might include at least one of the following sub-elements and attribute in the notification:

  • alerts/alert/

    smtp-message/

    subject

  • alerts/alert/

    smtp-message/

    smtp-header

  • alerts/alert/

    smtp-message/

    last-malware

  • alerts/alert/

    smtp-message/

    protocol

  • alerts/alert/

    smtp-message

    /id

These sub-elements and attribute are described further in other rows of this table.

6.x

7.x

8.x

alerts/

alert/

smtp-message/

subject

subject represents the SMTP email message subject line on the infected email.

For example:

"smtp-message": {

“subject”:

“RE:Upcoming Meeting”

}

...

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.x

7.x

8.x

alerts/

alert/

smtp-message/

smtp-header

smtp-header provides the SMTP email message header (including any configured X-header data) of the infected email.

For example:

"smtp-message": {

“smtp-header”:

“X-Trellix: Malicious Email Found”

}

...

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.x

7.x

8.x

alerts/

alert/

smtp-message/

last-malware

last-malware represents the name associated with last malicious email infection.

For example:

"smtp-message": {

“last-malware”:

“Trojan.Win32”

}

...

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.x

7.x

8.x

alerts/

alert/

smtp-message/

protocol

protocol represents the transport protocol detected by the Trellix appliance MVX.

For example:

"smtp-message": {

“protocol”:

“udp”

}

...

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

TCP or UDP

6.x

7.x

8.x

alerts/

alert/

smtp-message/

id

The id attribute represents the SMTP email message ID of the infected email.

For example:

"smtp-message": {

“id”: “20121017232425.6706.77689.Email-48trellix.com”

}

...

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.x

7.x

8.x

alerts/

alert/

interface

The interface element represents the configured interface n the Trellix appliance.

For example:

"interface": {

"label": "A1",

"mode": "tap",

"interface": "pether3"

},

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

This element might include at least one of the following attributes in the notification:

  • alerts/alert/interface/

    label

  • alerts/alert/interface/

    mode

These attributes are described further in other rows of this table.

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

interface/

label

The label attribute represents the label of the Trellix appliance interface.

For example:

"interface": {

"label": "A1",

"mode": "tap",

"interface": "pether3"

},

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.x

7.x

8.x

alerts/

alert/

interface/

mode

The mode attribute indicates whether the Trellix appliance is deployed in SPAN or TAP mode.

For example:

"interface": {

"label": "A1",

"mode": "tap",

"interface": "pether3"

},

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

There are two values:

  • tap

  • inline

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation

The explanation element provides supporting details about the MVX analysis and detected malware.

For example:

"explanation": {

"analysis": "binary",

"protocol": "tcp",

"cnc-services": {

"cnc-service": {

"port": "80",

"protocol": "tcp",

"address": "xxx.xxx.xxx.xxx",

"channel": "GET /games/...

...Connection: keep-

alive::~~Referer: http://

moa3.co.cc/imgurlfx.php?

hl=180ce3af78870604::~~::

~~"

}

},

"malware-detected": {

"malware": {

"name": "Exploit.Tool

Kit.BlackHole",

"sid": "84000006",

"stype": "bot-command"

}

}

},

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

This element might include at least one of the following attributes and sub-elements in the notification:

  • alerts/alert/explanation/

    analysis

  • alerts/alert/explanation/

    protocol

  • alerts/alert/explanation/

    urls

  • alerts/alert/explanation/

    service

  • alerts/alert/explanation/

    anomaly

  • alerts/alert/explanation/

    target-application

  • alerts/alert/explanation/

    target-os

  • alerts/alert/explanation/

    stolen_data

  • alerts/alert/explanation/

    malware-detected/

  • alerts/alert/explanation/

    malware-detected

  • alerts/alert/explanation/

    cnc-services

  • alerts/alert/explanation/

    os-changes

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

analysis

The “explanation” element’s attribute analysis describes the type of analysis performed by the Trellix appliance MVX.

For example:

"explanation": {

"analysis": "binary",

"protocol": "tcp",

"cnc-services": {

"cnc-service": {

"port": "80",

"protocol": "tcp",

"address": "xxx.xxx.xxx.xxx",

...

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

The type of malware analysis model used with the following possible values:

  • none

  • replay

  • direct-entry

  • malware

  • binary-analysis

  • content-analysis

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

protocol

The “explanation” element’s attribute protocol describes the type of protocol detected by the Trellix appliance MVX.

For example:

(not applicable for release 6.0; same for releases 6.1 and later)

"explanation": {

"analysis": "binary",

"protocol": "tcp",

...

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

protocol options include:

  • udp

  • tcp

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

urls

The “explanation” element’s attribute urls represents the URLs detected by the Trellix appliance MVX, separated by commas.

For example:

"explanation": {

"analysis": "binary",

"protocol": "tcp",

"urls”: “https://xxx.xxx.xxx.xxx/event_stream/events_for_bot?ma_id\=51056&l

ms_iden\=00:25:90:54:7E:6E cs1Label=sname cs1=Trojan. Generic>”...

...}

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

URLs that may have been involved in an infection.

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

service

The service element represents the profile service name set for the Trellix appliance MVX.

For example:

"explanation":

"service": "service name”...

...

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

anomaly

The anomaly element defines the type of anomalous event detected by the Trellix appliance MVX.

For example:

"explanation":

"anomaly": "misc-anomaly”...

...

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

Available values for the type of anomaly detected:

  • anomaly-tag

  • datatheft

  • keylogger

  • misc-anomaly

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

target-application

The target-application element indicates the application running in the Trellix appliance MVX profile at the time of infection.

For example:

"explanation":

"target-application": "InternetEx

plorer 6.0.2600.0000.xpcli

ent.010817-1148”...

...

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

Name of the application running on the infected target.

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

target-os

The target-os element indicates the operating system running in the Trellix appliance MVX at the time of infection.

For example:

"explanation":

"target-os": "Microsoft WindowsXP Professional 5.1

base”...

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

Name of the OS running on the infected target.

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

stolen_data

The stolen-data element provides information about data stolen at the time of infection.

For example:

“stolen_data”: }

” "size”: "99"

}

"info:”: {

"type”: "identity" ,

"encryption": “RC4",

"decrypted”: "yes"

}

"description”:

"Trellix sample malware-call

back data-theft plugin output

for sid 2345”,

"severity”: “3”,

"field”: {

"service" “https://www.fe-/

examples.com/samples/

reporting/login

"name”: "user",

"name”: "password",

}

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

This element might include at least one of the following attributes in the notification:

  • alerts/alert/explanation/

    stolen_data/event_id

  • alerts/alert/explanation/

    stolen_data/size

  • alerts/alert/explanation/

    stolen_data/info/decrypted

  • alerts/alert/explanation/

    stolen_data/info/encryption

  • alerts/alert/explanation/

    stolen_data/info/type

  • alerts/alert/explanation/

    stolen_data/info/description

  • alerts/alert/explanation/

    stolen_data/info/severity

  • alerts/alert/explanation/

    stolen_data/info/field/name

These sub-elements and attributes are described further in other rows in this table.

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

stolen_data/

event_id

The event_id attribute represents the stolen data event ID.

For example:

“stolen_data”: }

” "size”: "99"

” "event_id”: "events_for_bot?ma_id\

=51056&lms_iden\= 00:25:90:54:7E:6E"

}

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

Trellix appliance internal unique event ID

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

stolen_data/

size

The size attribute represents the size of the stolen data in bytes.

For example:

“stolen_data”: }

” "size”: "99"

” "event_id”: "events_for_bot?ma_id\

=51056&lms_iden\= 00:25:90:54:7E:6E"

}

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

stolen_data/

info/

decrypted

The decrypted attribute indicates whether the stolen data file was decrypted.

For example:

“stolen_data”: }

” "size”: "99"

}

"info:”: {

"type”: "identity" ,

"encryption": “RC4",

"decrypted”: "yes"

}

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

stolen_data/

info/

encrypted

The encrypted attribute indicates whether the stolen data file was encrypted.

For example:

“stolen_data”: }

” "size”: "99"

}

"info:”: {

"type”: "identity" ,

"encryption": “RC4",

"decrypted”: "yes"

}

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

stolen_data/

info/

type

The type attribute represents the type of stolen data.

For example:

“stolen_data”: }

” "size”: "99"

}

"info:”: {

"type”: "credit card theft" ,

"encryption": “RC4",

"decrypted”: "yes"

}

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

Available stolen data types:

  • identity (identity theft)

  • credit card theft

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

stolen_data/

info/

description

The info/description element provides a description of the stolen data.

For example:

“stolen_data”:

"description”:

"Trellix sample malware-call

back data-theft plugin output

for sid 2345”,

"severity”: “3”,

...

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

4096 characters

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

stolen_data/

info/

severity

The info/severity element represents the severity level of the infection.

For example:

“stolen_data”:

"description”:

"Trellix sample malware-call

back data-theft plugin output

for sid 2345”,

"severity”: “crit”,

...

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

Available severity levels:

  • unkn (unknown 0)

  • minr (minor 1)

  • majr (major 2)

  • crit (critical 3)

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

stolen_data/

info/

field/

name

The name attribute represents name of the info field in the alert notification.

For example:

“stolen_data”: }

” "size”: "99"

}

"description”:

"Trellix sample malware-call

back data-theft plugin output

for sid 2345”,

"severity”: “3”,

"field”: {

"service" “https://www.fe-/

examples.com/samples/

reporting/login

"name”: "user",

"name”: "password",

}

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

malware-detected

The malware-detected element provides details about detected malware.

For example:

"malware-detected": {

"malware": {

"name":

"Worm.Email.Bagle",

"sid": "11111276",

"stype": "bot-command"

}

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

This element might include at least one of the following attributes in the notification:

  • alerts/alert/explanation/

    malware-detected/

    malware

  • alerts/alert/explanation/

    malware-detected/

    malware/content

  • alerts/alert/explanation/

    malware-detected/

    malware/name

  • alerts/alert/explanation/

    malware-detected/

    malware/scan

  • alerts/alert/explanation/

    malware-detected/

    malware/sid

  • alerts/alert/explanation/

    malware-detected/

    malware/type

  • alerts/alert/explanation/

    malware-detected/

    malware/stype

  • alerts/alert/explanation/

    malware-detected/

    malware/archives

  • alerts/alert/explanation/

    malware-detected/

    malware/parent

  • alerts/alert/explanation/

    malware-detected/

    malware/origid

  • alerts/alert/explanation/

    malware-detected/

    malware/archive

  • alerts/alert/explanation/

    malware-detected/

    malware/malicious

  • alerts/alert/explanation/

    malware-detected/

    malware/note

  • alerts/alert/explanation/

    malware-detected/

    malware/url

  • alerts/alert/explanation/

    malware-detected/

    malware/profile

  • alerts/alert/explanation/

    malware-detected/

    malware/md5sum

  • alerts/alert/explanation/

    malware-detected/

    malware/application

  • alerts/alert/explanation/

    malware-detected/

    malware/http-header

  • alerts/alert/explanation/

    malware-detected/

    malware/domain

  • alerts/alert/explanation/

    malware-detected/

    malware/user

  • alerts/alert/explanation/

    malware-detected/

    malware/original

  • alerts/alert/explanation/

    malware-detected/

    malware/downloaded-at

  • alerts/alert/explanation/

    malware-detected/

    malware/executed-at

  • alerts/alert/explanation/

    malware-detected/

    malware/objurl

These sub-elements and attributes are described further in other rows of this table.

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware

The malware element uses attributes that define the detected malware.

For example:

"explanation": {

"malware-detected": {

"malware": {

"name": "Trojan.Down

loader.Bredolab"

}

}

,

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

This element might include at least one of the following attributes in the notification:

  • content

  • name

  • scan

  • sid

  • type

  • stype

  • archives

  • parent

  • origid

  • malicious

These attributes are described further in other rows of this table.

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

content

The content attribute defines the content type of a URL associated with the detected malware.

For example:

"explanation": {

"malware-detected": {

"malware": {

"name": "Trojan.Down

loader.Bredolab"

"content": "mime"

}

}

,

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

Content attribute options:

  • mime

  • text

  • and so on...

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

name

The name attribute indicates the name of the detected malware.

For example:

"explanation": {

"malware-detected": {

"malware": {

"name": "InfoStealer.Ban

ker.Zbot.DNS"

"content": "mime"

}

}

},

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

scan

The scan attribute specifies the scan iteration ID for detected malware.

For example:

"explanation": {

"malware-detected": {

"malware": {

"name":

"InfoStealer.Banker.Zbot.DNS"

"scan": "54042166"

}

}

},

FX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

sid

The sid attribute represents the Trellix internal alert sID for the detected malware.

For example:

"explanation": {

"malware-detected": {

"malware": {

"name":

"InfoStealer.Banker.Zbot.DNS"

"sid": "80440378"

}

}

},

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

Integer

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

type

The type attribute specifies the file type of the detected malware.

For example:

"explanation": {

"malware-detected": {

"malware": {

"name":

"InfoStealer.Banker.Zbot.DNS"

"type": "exe"

}

}

},

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

Possible values:

  • exe

  • pdf

  • ppt

  • doc

  • docx

  • and so on...

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

stype

The stype attribute specifies the Trellix-assigned signature for the detected malware.

For example:

"explanation": {

"malware-detected": {

"malware": {

"name":

"InfoStealer.Banker.Zbot.DNS"

"stype": "blacklist"

}

}

},

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

Possible values:

'generated-content',

'fireeye-content',

'bot-command',

'fqc',

‘known-md5sum',

'known-url',

'duplicate-md5sum',

'av-match',

'vm-bot-command',

'blacklist',

'yara',

'avs',

'archive',

'encoding',

'timestamp',

'embedded',

'file-check',

'protocol-header-check',

'email-block-listed',

'malware-block-listed',

'malware-intrinsic-analysis',

'fireeye-feed-match',

'custom-feed-match',

'retroactive',

'pe-sign-riskware',

'malware-guard',

'email-impersonation', 

'custom-blacklist',

'faude',

'email-faude',

'email-hdr-typosquat',

'fscan',

'faude-url-click',

'static-analysis-extraction',

'impersonation-newdomain',

'impersonation-sender-profiling',

'impersonation-sender-domain',

'url-scan-policy',

'dynamic-url-analysis',

'fe-feed',   

'custom-feed',

'local-avs',

'local-faude',

'private-GTI',

'phish-Detector',

'parent-child-correlator',

'bale',

'unknown'

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

archives

The archives attribute specifies the archives count.

For example:

"explanation": {

"malware-detected": {

"malware": {

"name":

"InfoStealer.Banker.Zbot.DNS"

"archives": "8"

}

}

},

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

Integer

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

parent

The parent attribute specifies the parent malware ID of detected child/nested malware.

For example:

"explanation": {

"malware-detected": {

"malware": {

"name":

"InfoStealer.Banker.Zbot.DNS"

"parent": "33459873"

}

}

},

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

origid

The origid attribute specifies the original malware ID for an infection, indicating that the detected malware is a duplicate of an original malware.

For example:

"explanation": {

"malware-detected": {

"malware": {

"name":

"InfoStealer.Banker.Zbot.DNS"

"origid": "218799"

}

}

},

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

malicious

The malicious attribute specifies whether the detected malware is malicious: true or false.

For example:

"explanation": {

"malware-detected": {

"malware": {

"name":

"InfoStealer.Banker.Zbot.DNS"

"malicious": "true"

}

}

},

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

Available options:

  • true

  • false

  • unknown

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

note

The note element allows the system to add notes or details to alert notifications about the detected malware.

For example:

"explanation": {

"malware-detected": {

"malware": {

"note": "AttackZone3"

"content": "mime"

}

}

},

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

url

The url element provides the primary URL associated with the detected malware.

For example:

"explanation": {

"malware-detected": {

"malware": {

"url": "https://xxx.xxx.xxx.xxx/event_streamevents_for_bot?ma_id\=51056&lms_iden\=00:25:90:54:7E:6Ecs1Label=sname cs1=Trojan.

Generic"

"malicious": "true"

}

}

},

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

HTTP or HTTPS

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

profile

The profile element provides details about the MVX profile in use during detection of the malware.

For example:

"explanation": {

"malware-detected": {

"malware": {

"profile": "winxp-sp2"

}

}

},

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

md5sum

The md5sum element provides the MD5 checksum details for the detected malware.

For example:

"explanation":

"malware-detected":

"malware":

"md5sum": "4c40057a9b241

2e61472154d66df4c0d"

...

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

application

The application element specifies the application running at the time of malware detection.

For example:

"explanation":

"malware-detected":

"malware":

"application": "InternetExplorer6.0.2600.0000

.xpclient010817-1148"

...

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

http-header

The http-header element provides the captured header information for the detected malware.

For example:

"explanation":

"malware-detected":

"malware":

"http-header": "GET /pood

load.php HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (com

patible; MSIE 6.0; Windows

NT 5.1;SV1)

Host: icqdosug.com

Connection: Keep-Alive..."

...

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

domain

The domain element names the domain associated with the detected malware.

For example:

"explanation":

"malware-detected":

"malware":

"domain":"networkAlpha.com"

...

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

user

The user element specifies the user name of the appliance user that has submitted the malware for analysis.

For example:

"explanation":

"malware-detected":

"malware":

"user":"networkAlpha.com"

...

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

original

The original element specifies the name of the original detected malware.

For example:

"explanation":

"malware-detected":

"malware":

"original":"load.exe"

...

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

downloaded-at

The downloaded-at element provides date and time information about when the detected malware was first downloaded.

For example:

"explanation":

"malware-detected":

"malware":

"downloaded-at":"2012-10-

10T04:06:35Z"

...

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

Standard XML daytime format

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

executed-at

The executed-at element provides details about when the detected malware was executed in the MVX.

For example:

"explanation":

"malware-detected":

"malware":

"executed-at":"2012-10-

10T05:08:30Z"

...

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

Standard XML daytime format

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

objurl

The objurl element provides details about detected malware URL.

For example:

"explanation":

"malware-detected":

"malware":

"objurl":"www.networkAlpha

.com"

...

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

cnc-services

The cnc-services element uses attributes and sub-elements that detail command and control center information.

For example:

"explanation": {

"analysis": "binary",

"protocol": "tcp",

"cnc-services": {

"cnc-service": {

"port": "80",

"protocol": "tcp",

"address": "xxx.xxx.xxx.xxx",

"channel": "GET /images/

news.php?p=15353&id=349

92661&e=0 HTTP/1.1::~

~User-Agent: szNotify

Ident::~~Host: efrering-

basilea.com::~~::~~",

"location": "FR"

}

},

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

This element might include at least one of the following attributes in the notification:

  • cnc-service

  • port

  • protocol

  • address

  • channel

  • location

These attributes and sub-elements are described further in other rows of the table.

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

cnc-services/

cnc-service

The cnc-service element uses attributes that detail command and control center port and protocol information.

For example:

"explanation": {

"analysis": "binary",

"protocol": "tcp",

"cnc-services": {

"cnc-service": {

"port": "80",

"protocol": "tcp",

...

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

cnc-service

  • port (integer)

  • protocol (string: udp or tcp)

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

cnc-services/

address

The address element specifies the IP address associated with the malware’s command and control center.

For example:

"explanation": {

"cnc-services": {

"cnc-service": {

"port": "80",

"protocol": "tcp",

"address": "xxx.xxx.xxx.xxx",

...

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

IPv4 or IPv6 IP address

6.0

6.1

6.2

6.3

6.4

7.x

alerts/

alert/

explanation/

cnc-services/

channel

The channel element specifies the GET command for the channel associated with the detected malware.

For example:

"explanation": {

"cnc-services": {

"cnc-service": {

"port": "80",

"protocol": "tcp",

"address": "xxx.xxx.xxx.xxx",

"channel": "GET /images/

news.php?p=15353&id=349

92661&e=0 HTTP/1.1::~

~User-Agent: szNotify

Ident::~~Host: efrering-

basilea.com::~~::~~",

"location": "FR"

}

},

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

1023 characters

6.x

7.x

8.x

alerts/

alert/

explanation/

cnc-services/

location

The location element specifies the geolocation(s) from which the detected malware originated.

For example:

"explanation": {

"cnc-services": {

"cnc-service": {

"port": "80",

"protocol": "tcp",

"address": "xxx.xxx.xxx.xxx",

"location": "FR"

}

},

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

Location. For example:

  • US

  • US/OH/Columbus

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

os-changes

The os-changes element uses attributes that detail MVX operating system information at the time of infection.

For example:

"explanation": {

"os-changes": {

"“osinfo": “WindowsXP Pro

fessional 5.1”

"id": "34872232",

"version": "6.2.0.75853",

...

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

This element might include at least one of the following attributes in the notification:

os-changes

  • osinfo

  • id

  • version

6.0

6.1

6.2

6.3

6.4

7.x

8.x

alerts/

alert/

explanation/

static-analysis

The static-analysis element uses attributes that detail information about the static analysis tool(s) used during malware analysis.

For example:

"explanation": {

"static-analysis": {

"“osinfo": “Sophos”

""version": "5.1",

...

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

This element might include at least one of the following attributes in the notification:

static-analysis

  • tool

  • version

6.0

6.1

6.2

6.3

6.4

7.x

8.x

javacall

The javacall element is reported when the Java method of interest is called.

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

This element might include at least one of the following items in the notification:

  • context

    Always set to "not-signed-applet".

  • timestamp

    A relative VM time.

  • repeat

    Optional. Avoids reporting too many events. XML nodes marked with (*) are not present if the repeat attribute is present.

  • pid

    Java VM process ID.

  • imagepath

    Process path.

  • class

    Java class name (method of interest).

  • method

    Java method name (method of interest). Two special cases <clinit> and <init> are reported as "CLASS-CONSTRUCTOR" and "CONSTRUCTOR", respectively.

  • parentClass/parentMethod

    The class and method that made a call to the method of interest.

  • this

    Address of this class instance.

  • static

    The method is static.

  • params/param

    A list of parameters and their values.

7.x

8.x

javaevent

The javaevent attribute is reported when an action is taken to modify the current Java SecurityManager state.

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

This element might include at least one of the following in the notification:

  • context

    Always set to "not-signed-applet".

  • timestamp

    A relative VM time.

  • sm-reset-init

    Reported when the Java SecurityManager is getting initialized. This value is nonmalicious.

  • sm-reset-null

    Reported when a non-null pointer to the Java SecurityManager is getting reset to null. This value is highly malicious.

  • sm-reset-value

    Reported with a non-null pointer to the Java SecurityManager is set to another non-null instance of the Java Security Manager. This value is inconclusive.

7.x

8.x

dialog-dismissed

The dialog-dismissed element is reported when a dialog box is recognized and about to be dismissed.

For example:

"dialog-dismissed": {

"note": "Dismissed with a click on the first button",

"timestamp": "30630",

"pid": "3168",

"sequenceNumber": "22",

"dlg-id": "General_purpose_

Adobe_8_and_better_MB"

},

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

This element might include at least one of the following items in the notification:

  • timestamp

    A relative VM time.

  • pid

    The process ID that owns the dialog box to be dismissed.

  • dlg-id

    A unique dialog box identifier.

  • note

    A user friendly string describing the dismissal method.

7.x

8.x

popup-dialog

The popup-dialog element is reported when a recognized dialog box is shown from a browser process.

For example:

"popup-dialog": {

"timestamp": "131480",

"processinfo": {

"tid": "2624",

"imagepath": "c:\\program files

\\internet explorer

\\iexplore.exe",

"pid": "3048"

},

"title": "File Download - Security Warning"

},

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

This element might include at least one of the following items in the notification:

  • timestamp

    A relative VM time.

  • title

    The dialog box title.

  • pid

    The process ID that owns the dialog box to be dismissed.

  • tid

    The thread ID that created this dialog box.

  • imagepath

    The process path.

7.x

8.x

api_patch

This an internal detection-only feature.

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

Not applicable

7.x

8.x

thread

The thread element is reported for various operation on a thread (such as suspended, terminated, or hide), for threads created with NtQueueApcThread[Ex]/QueueUserAPC, and for opened threads (opened or duplicate_opened).

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

This element might include at least one of the following items in the notification:

  • source

    Specifies the actor (source-process) performing the action.

  • target

    Specifies the target (target-process) for the action.

  • duplicate_source

    Specifies the process for which the thread handle is duplicated from. It only applies to duplicate_opened.

  • duplicate_target

    Specifies the process for which the tread handle is copied to. It only applies to duplicate_opened.

  • desiredaccess

    An ACCESS request for open or duplicate_open.

  • ntstatus

    The system-call result. The result is 0x00000000/STATUS_SUCCESS for successful operations. For some operations, both success and failure are reported.

7.x

8.x

BootSectorModified

The BootSectorModified element is reported when a specimen overwrites the master boot record (MBR) of the system volume.

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

Not applicable

7.x

8.x

StackPivot

The StackPivot element refers to the stack pointer going out of the range maintained in the thread execution block (TEB). This an industry-known indicator of exploit/ROP attempts.

For example:

"stackpivot": [

{

"StackBottom":

"0x0000000000126000",

"processinfo": {

"imagepath": "C:\\Program Files

\\Adobe\\Reader 8.0

\\Reader\\AcroRd32.exe",

"pid": "860",

"md5sum": "1a5b4b58dbb62677

6920260704fd0116"

},

"SuppressMode": "None",

"timestamp": "16329",

"CallerAddress":

"0x000000004a802f70",

"StackAddress":

"0x000000000f602038",

"apiname": "MapViewOfFile",

"StackTop":

"0x0000000000130000",

"params": {

"param": [

{

"id": "1",

"param": "0x238"

},

{

"id": "2",

"param": "38"

},

{

"id": "3",

"param": "0"

},

{

"id": "4",

"param": "0"

},

{

"id": "5",

"param": "0"

}

]

},

"suppressed": "false",

"CallerModule": "C:\\Program Files

\\Adobe\\Reader 8.0

\\Reader\\icucnv34.dll"

},

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

This element might include at least one of the following items in the notification:

  • processinfo

    Provides details of the process where the stack pivot is observed.

  • apiname

    The API where the stack pivot was discovered.

  • StackAddress

    The value of the stack pointer.

  • StackBottom, StackTop

    The allowed range for the stack pointer.

7.x

8.x

ROP

Return-oriented programming (ROP) is an exploit technique that leverages executable code from loaded system modules. Also a well-known technique in the security space.

For example:

"ROP": [

{

"PreviousBytes": "75 08 e8 b1 ff ff ff 59 59 50 ff 15 1c 0d d1 01",

"ModuleName": "NULL",

"processinfo": {

"imagepath": "C:\\Program Files

\\Internet Explorer\\iexplore.exe",

"pid": "2768",

"md5sum": "b60dddd2d63ce

41cb8c487fcfbb6419e"

},

"CallerOffset":

"0x0000000000000000",

"timestamp": "8357",

"mode": "CallerCheck",

"apiname": "LoadLibraryA",

"ForwardBytes": "8b d8 33 ff 3b df 74 34 66 39 7d 10 76 2e 8b 4d",

"ModuleBase":

"0x0000000000000000"

},

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

This element might include at least one of the following items in the notification:

  • processinfo

    Provides details of the process where ROP is observed.

  • mode

    The shellcode provides details of the ROP attempt.

  • stack

    Provides details of stack pointer position with respect to the stack limits (similar to stackpivot.

  • shellcode

    Provides the actual details for the ROP attempt.

  • apiname

    The API where ROP was discovered.

  • address

    The location from where the call to the specified API (apiname) was made.

  • gadgets

    Encoded using base64. Crafted disassembly pieces that perform ROP.

7.x

8.x

queue-id

Postfix queue ID.

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

7.6 and later

sname

The name of the network anomaly.

For example:

"cnc-services": {

"cnc-service": {

"sname": "InfoStealer.Banker.Zbot.DNS",

"protocol": "udp",

"sid": "80441019",

"address": "sir-t.cn",

"type": "CncSigMatch",

"port": "53"

}

},

NX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

7.9 and later

type

The type of network anomaly.

For example:

"cnc-services": {

"cnc-service": {

"sname": "InfoStealer.Banker.Zbot.DNS",

"protocol": "udp",

"sid": "80441019",

"address": "sir-t.cn",

"type": "CncSigMatch",

"port": "53"

}

},

NX

CM

MC

WI

IM

DM

MO

IE

RC

RO

String

7.9 and later

ack

Indicates whether the alert has been acknowledged.

EX

NX

CM

DM

IM

MC

MO

WI

yes or no

7.x

8.x

submitted-at

Submitted time.

NX

AX

FX

EX

CM

MC

MO

RC

RO

Time stamp

8.x