Press CTRL+K to open search

XML Path (XPath) Element and Attribute Definitions

  • Published on Aug 25, 2026
  • 26 minute(s) read
Prev Next

Trellix uses the following parameters in its XML XPath key=value pairs: elements and sub-elements within brackets < >:

Note

The Z character at the end of a time stamp indicates that the time displayed is in the UTC time zone. Starting in the 7.0.0 release, the time is displayed in UTC by default. To change the displayed time to your local time, use the following CLI command: fenotify default timezone localtime

Element Name

Description

Products

Event Type

Data Type

Release

alerts

alerts represents the topmost element NAME in the notification XPath.

For example:

<alerts appliance="test1.mrl.trellix.com"
    appliance-id="000BABDDC3B9"
    msg="normal" product="Web MPS" 
    version="8.2.0.799158"
    xmlns="http://www.trellix.com/alert/[...]>
  <alert ack="no" id="3720" [...]
  </alert>
</alerts>

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

(See more examples in XML notification examples per infection type

)

/appliance-id

/product

/version

/msg

alert/ack

/alert/id

/alert/name

/alert/sc-version

/alert/severity

/alert/src/vlan

/alert/smtp-message/id

/alert/interface/label

/alert/interface/mode

/alert/explanation/analysis

/alert/explanation/protocol

/alert/explanation/urls

/alert/explanation/

malware-detected/

malware/content

/alert/explanation/

malware-detected/

malware/name

/alert/explanation/

malware-detected/

malware/scan

/alert/explanation/

malware-detected/

malware/sid

/alert/explanation/

malware-detected/

malware/type

/alert/explanation/

malware-detected/

malware/stype

/alert/explanation/

malware-detected/

malware/archives

/alert/explanation/

malware-detected/

malware/parent

/alert/explanation/

malware-detected/

malware/origid

/alert/explanation/

malware-detected/

malware/

malicious

/alert/explanation/

stolen_data/event_id

/alert/explanation/

stolen_data/size

/alert/explanation/

stolen_data/info/

decrypted

/alert/explanation/

stolen_data/

info/encryption

/alert/explanation/

stolen_data/info/

type

/alert/explanation/

stolen_data/info/

field/name

/alert/explanation/

cnc-services/

cnc-service/port

/alert/explanation/

cnc-services/

cnc-service/protocol

/alert/explanation/

os-changes/osinfo

/alert/explanation/

os-changes/id

/alert/explanation/

os-changes/

version

7.x

8.x

alerts/

appliance-id

appliance-id represents the appliance that was the origin of the alert.

For example (from a Central Management appliance):

<alerts appliance="xx.xx.xx.xx"
    appliance-id="xx:xx:90:87:4A:14"
    msg="normal" product="CMS"
    version="8.0.0.628198"
    [...]

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

Appliance ID

Six hexadecimal numbers

7.5 and later

alerts/

alert

alert represents the element REF= in the notification XPath.

For example:

<alerts appliance="xx.xx.xx.xx"
    appliance-id="xx:xx:90:87:4A:14"
    msg="normal" product="CMS"
    version="8.0.0.628198"
    [...]>
  <alert ack="no"
    appliance-id="xx:xx:90:86:7B:54"
    id="2235"
    name="malware-object"
    product="Email MPS"
    root-infection="613"
    sensor="Kikat"
    sensor-ip="xxx.xxx.xxx.xxx"
    severity="majr"
    uuid="3e6295b8-5517-40b3-a1e6-916ff3"
    version="8.0.0.628198">

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

/alert is the secondary level element of each notification message. It may include at least one of the following sub-elements:

(See more examples in XML notification examples per infection type):

/src

/explanation

/alert-url

/action

/locations

/occurred

7.x

8.x

sc-version

sc-version represents the security content version

For example:

"sc-version": "845.114"

EX

DM

IM

MC

MO

WI

version number

8.3

alerts/

alert/

src

src represents the element REF for the infected host. The source is either an email address or an IP address. The source IP address is that of the victim of the infection, not the origin of the malware.

For example:

                        <src>
  <ip>xx.12.191.101 </ip>
  <port>62918</port>
  <mac>xx:1b:63:9c:52:95</mac>
</src>

or

                        <src>
  <domain>automation.local</domain>
  <smtp-mail-from>
    fqpubz-bsfgut@automation.local
  </smtp-mail-from>
  <url>
    /analysis/3fYy54121kz389Qc-0-Email-68684_54dc0a8bd5
  </url>
</src>

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

This element might include at least one of the following sub-elements or attributes in the notification:

/src

/vlan

/ip

/mac

/url

/host

/port

/domain

/smtp-mail-from

/repository

/proxy

These sub-elements and attributes are further described in other rows of this table.

7.x

8.x

alerts/

alert/

src/

vlan

vlan represents the VLAN ID.

For example:

<src vlan="0">
  <ip>xxx.xx.xxx.xxx</ip>
  <port>62918</port>
  <mac>xx:1b:63:9c:52:95</mac>
</src>

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

integer

vlan is an XPath attribute of the src element, and this attribute includes the following sub-element values:

ip

port

mac

7.x

8.x

alerts/

alert/

src/

ip

ip represents the IP address of the infected host.

For example:

<src vlan="0">
<ip>
    xxx.12.191.101
  </ip>
</src>

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

String. IPv4 or IPv6 address

7.x

8.x

alerts/

alert/

src/

mac

mac represents the MAC address of the infected host

For example:

<src vlan="0">
<mac>
    xx:1b:63:9c:52:95
  </mac>
</src>

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

MAC Address

Six colon-separated hexadecimal numbers

7.x

8.x

alerts/

alert/

src/

url

url represents the URL associated with the malware.

For example:

                        <url>
  https://xxx.xxx.xxx.xxx/
  event_stream/
  events_for_bot?ma_id\
  =51056&lms_iden\
  =00:25:90:54:7E:6E cs1Label
  =sname cs1=Trojan. Generic
</url>

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

HTTP or HTTPS source URL of the malware.

7.x

8.x

alerts/

alert/

src/

host

host represents the hostname of the infected machine as detected by a Trellix appliance MVX.

For example:

                        <host>
  icqdos
</host>

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

src/

port

port is the port of the infected machine as detected by a Trellix appliance MVX.

For example:

                        <port>
 1100
</port>

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

Integer

Valid Port Numbers: 0~65535

7.x

8.x

alerts/

alert/

src/

domain

domain represents the domain of the infected machine as detected by a Trellix appliance MVX.

For example:

                        <domain>
  networkAlpha.com
</domain>

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

String

7.x

8.x

alerts/

alert/

src/

smtp-mail-from

smtp-mail-from represents the user name of the sender of the malicious email detected by a Trellix appliance MVX.

For example:

                        <smtp-mail-from>
  perfEmailautomation.local
</smtp-mail-from>

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

src/

repository

repository is the file system SharePoint or mount point.

For example:

                        <repository>
  sharepoint
</repository>

AX

FX

CM

DM

IE

IM

MC

MO

RC RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

src/

proxy

proxy represents HTTP proxy (IP address) of the infected host system.

For example:

                        <proxy>
  xxx.xxx.xxx.xxx
</proxy>

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

IP address

7.x

8.x

alerts/

alert/

alert-url

alert-url represents the URL generated by the Trellix MVX of the alert notification for a detected malware.

For example:

                        <alert-url>
  https://xxx.xxx.xxx.xxx/event_stream_events
  _for_bot?ev_id= 12762&amp;lms_iden
  =00:E0:81 :4F:AC:03
</alert-url>

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

action

action represents the notification action taken by the system during a malware detection.

For example:

                        <action>
  notified
</action>

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

action options:

notified

blocked

7.x

8.x

alerts/

alert/

locations

locations represents the geolocation from which the detected malware originated.

For example:

                        <locations>
  FR
</locations>

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

String

Two-letter abbreviation of country name(s); comma-separated multiple locations are supported.

7.x

8.x

alerts/

alert/

occurred

occurred represents the date and time of the malware infection.

For example:

                        <occurred>
  2012-10-11T20:09:39Z
</occurred>

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

Time stamp. There are two formats:

yyyy-mm-ddTHH:mm

standard XML daytime format

7.x

8.x

alerts/

alert/

dst

For Email Security — Server Edition appliances, dst represents the email destination of the targeted host. For Network Security appliances, dst represents the destination host targeted by the infected source host.

For example, for an Email Security — Server Edition appliance:

                        <dst>
  <ip>
    xxx.xxx.xxx.xxx
  </ip>
  <mac>
    xx:10:db:ff:20:80
  </mac>
  <port>
    80
  </port>
</dst>

For example, for a Network Security appliance:

                        <dst>
  <ip>
    xxx.xxx.xxx.xxx
  </ip>
  <mac>
    xx:09:0f:e2:a6:31
  </mac>
  <port>
    80
  </port>
</dst>

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

This element might include at least one of the following sub-elements in the notification:

/mac

/port

/ip

/smtp-to

/smtp-cc

These sub-elements are described further in other rows of this table.

7.x

8.x

alerts/

alert/

dst/

mac

mac represents the MAC address of the attacker host.

For example:

<dst>
<mac>
    xx:10:db:ff:20:80
  </mac>
</dst>

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

MAC Address

Six colon-separated hexadecimal numbers

7.x

8.x

alerts/

alert/

dst/

port

port is the port of the attacker machine as detected by a Trellix appliance MVX.

For example:

<dst>
<port>
    80
  </port>
</dst>

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

Integer

Valid Port Numbers 0~65535

7.x

8.x

alerts/

alert/

dst/

ip

ip represents the IP address of the attacker host.

For example:

<dst>
  <ip>
    xxx.xx.xxx.xxx
  </ip>
</dst>

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

16-byte integer IPv4 address

7.x

8.x

alerts/

alert/

dst/

smtp-to

smtp-to represents the recipient of the malicious email detected by a Trellix appliance MVX.

For example:

<dst>
<smtp-to>
    johndoe@xyz.com
  </smtp-to>
</dst>

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

dst/

smtp-cc

smtp-cc represents the CC'd recipient of the malicious email detected by a Trellix appliance MVX.

For example:

<dst>
<smtp-cc>
    johndoe@zAnew.com
  </smtp-cc>
</dst>

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

smtp-message

smtp-message represents the SMTP email message ID and other information associated with the infected email.

For example:

<dst>
  <smtp-message>
    20121017232425.6706.77689.Email
      -48trellix.com
  </smtp-message>

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

String

1023 characters

This element might include at least one of the following sub-elements and attribute in the notification:

/subject

/smtp-header

/last-malware

/protocol

/id

These sub-elements and attributes are described further in other rows in this table.

7.x

8.x

alerts/

alert/

smtp-message/

subject

subject represents the SMTP email message subject line on the infected email.

For example:

<smtp-message>
<subject>
    RE:Upcoming Meeting
  </subject>
</smtp-message>

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

smtp-message/

smtp-header

smtp-header provides the SMTP email message header (including any configured X-header) of the infected email.

For example:

<smtp-message>
<smtp-header>
    RE:Upcoming Meeting
  </smtp-header>
</smtp-message>

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

smtp-message/

last-malware

last-malware represents the name associated with last malicious email infection.

For example:

                        <last-malware>
    Trojan.Win32
  </last-malware>
</smtp-message>

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

smtp-message/

protocol

protocol represents the transport protocol detected by the Trellix appliance MVX.

For example:

<smtp-message>
<protocol>
    udp
  </protocol>
</smtp-message>

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

TCP or UDP

7.x

8.x

alerts/

alert/

smtp-message/

id

id represents the SMTP email message ID of the infected email.

For example:

<smtp-message id=20121017232425
.6706.77689.Email-48trellix.com
</smtp-message>

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

interface

The interface element represents the configured interface in the Trellix appliance.

For example:

<interface label="A1" mode="tap">
  pether3
</interface>

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

String

1023 characters

This element might include at least one of the following attributes in the notification:

/label

/mode

These attributes are described further in other rows in this table.

7.x

8.x

alerts/

alert/

interface/

label

The label attribute represents the label of the Trellix appliance interface.

<interface label="A1">
  pether3
</interface>

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

interface/

mode

The mode attribute indicates whether the Trellix appliance is deployed in SPAN or TAP mode.

For example:

<interface mode="tap">
  pether3
</interface>

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

String

1023 characters

There are two values:

tap

inline

7.x

8.x

alerts/

alert/

explanation

The explanation element provides supporting details about the MVX analysis and detected malware.

For example:

                        <explanation>
  <ips-detected>
    <ips-event>
      <sig-id>85305243</sig-id>
      <sig-revision>12</sig-revision>
      <sig-name>
        Dynamic DNS Jar File Download Request
      </sig-name>
      <match-count>1</match-count>
      <cve-id></cve-id>
      <action-taken>
        may be blocked in future
      </action-taken>
      <attack-mode>client</attack-mode>
      <mvx-status>N/A</mvx-status>
    </ips-event>
  </ips-detected>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

This element might include at least one of the following attributes in the notification:

/analysis

/protocol

/urls

/service

/anomaly

/ips-detected

/target-application

/target-os

/stolen_data

/malware-detected/

/malware-detected

/cnc-services

/os-changes

These sub-elements and attributes are described further in other rows of this table.

7.x

8.x

alerts/

alert/

explanation/

analysis

The explanation element’s attribute analysis describes the type of analysis performed by the Trellix appliance MVX.

For example:

<explanation analysis="content" protocol="">
     ...
 </explanation>

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

The type of malware analysis model used with the following possible values:

none

replay

direct-entry

malware

binary-analysis

content-analysis

7.x

8.x

alerts/

alert/

explanation/

protocol

The explanation element’s attribute protocol describes the type of protocol detected by the Trellix appliance MVX.

For example:

<explanation protocol=udp>
    ...
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

protocol options include:

udp

tcp

7.x

8.x

alerts/

alert/

explanation/

urls

The explanation element’s attribute urls represents the URLs detected by the Trellix appliance MVX.

For example:

<explanation urls=https://xxx.xxx.xxx.xxx/
   event_stream/events_for_bot?ma_id\
   =51056&l ms_iden\=00:25:90:54:7E:6E 
   cs1Label=sname cs1=Trojan. Generic
  ...
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

URLs that may have been involved in an infection.

7.x

8.x

alerts/

alert/

explanation/

service

The service element represents the profile service name set for the Trellix appliance MVX.

For example:

<explanation>
<service>service name</service>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

explanation/

anomaly

The anomaly element defines the type of anomalous event detected by the Trellix appliance MVX.

For example:

<explanation>
<anomaly>
    misc-anomaly
  </anomaly>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

Available values for the type of anomaly detected:

anomaly-tag

datatheft

keylogger

misc-anomaly

7.x

8.x

alerts/

alert/

explanation/

target-application

The target-application element indicates the application running in the Trellix appliance MVX profile at the time of infection.

For example:

<explanation>
<target-application>
    InternetExplorer 6.0.2600. 
     0000.xpclient.010817-1148
  </target-application>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM

MC

MO

RC RO

WI

String

1023 characters

Name of the application running on the infected target.

7.x

8.x

alerts/

alert/

explanation/

target-os

The target-os element indicates the operating system running in the Trellix appliance MVX at the time of infection.

For example:

<explanation>
<target-os>
    Microsoft WindowsXP Professional 5.1 base
  </target-os>
</explanation>

AX

EX

FX

NX

CM

DM

IE

IM

MC

MO

RC RO

WI

String

1023 characters

Name of the OS running on the infected target.

7.x

8.x

alerts/

alert/

explanation/ stolen_data

The stolen-data element provides information about data stolen at the time of infection.

For example:

<stolen_data size="99">
  <info type="identity" 
       encryp tion="RC4" decrypted="yes">
    <description>
      Trellix sample malware-call back
 data-theft plugin output for sid 2345
    </description>
    <severity>3</severity>
    <field name="service">
      https://www.fe-examples.com/
        samples/reporting/login
    </field>
    <field name="user">usr-abc</ field>
    <field name="password">pass- yz</field>
  </info>
  <info type="identity" encryption="pki"
     decrypted="yes">
    <description>
      Trellix sample malware-call back
      data-theft plugin output for sid 2345
    </description>
    <field name="service">
      https://www.fe-examples.com/
      samples/reporting/account
    </field>
    <field name="user">xyzabc</ field>
    <field name="password">
    yz123</field>
  </info>
</stolen_data>

AX

EX

FX

NX

CM

DM

IE

IM

MC

MO

RC RO

WI

This element might include at least one of the following attributes in the notification:

/event_id

/size

/info/ decrypted

/info/encryption

/ info/type

/info/description

/info/severity

/info/field/ name

These sub-elements and attributes are described further in other rows in this table.

7.x

8.x

alerts/

alert/

explanation/ stolen_data/

event_id

The event_id attribute represents the stolen data event ID.

For example:

<explanation>
  <stolen-data event_id=
   events_for_bot?ma_id\
   =51056&lms_iden\=
   00:25:90:54:7E:6E>
  </stolen-data>
</explanation>

AX

EX

FX

NX

CM

DM

IE

IM

MC

MO

RC RO

WI

String

1023 characters

Trellix appliance internal unique event ID.

7.x

8.x

alerts/

alert/

explanation/ stolen_data/

size

The size attribute represents the size of the stolen data in bytes.

For example:

<explanation>
  <stolen-data size=107 >
  </stolen-data>
</explanation>

AX

EX

FX

NX

CM

DM

IE

IM

MC

MO

RC RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

explanation/ stolen_data/

info/

decrypted

The decrypted attribute indicates whether the stolen data file was decrypted.

For example:

<explanation>
  <stolen-data decrypted=yes >
    ...
  </stolen-data>
</explanation>

AX

EX

FX

NX

CM

DM

IE

IM

MC

MO

RC RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

explanation/ stolen_data/

info/

encrypted

The encrypted attribute indicates whether the stolen data file was encrypted.

For example:

<explanation>
  <stolen-data encrypted=yes >
    ...
  </stolen-data>
</explanation>

AX

EX

FX

NX

CM

DM

IE

IM

MC

MO

RC RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

explanation/ stolen_data/

info/

type

The type attribute represents the type of stolen data.

For example:

<explanation>
  <stolen-data type=”identity” >
    ...
  </stolen-data>
</explanation>

AX

EX

FX

NX

CM

DM

IE

IM

MC

MO

RC RO

WI

String

1023 characters

Available stolen data types:

identity (identity theft)

credit card theft

7.x

8.x

alerts/

alert/

explanation/ stolen_data/

info/

description

The info/description element provides a description of the stolen data.

For example:

<explanation>
  <stolen-data>
    <info type="identity" encryption
        ="RC4" decrypted="yes">
     <description>
       Trellix sample
       malware-call back data-theft
       plugin output for sid 2345
    </description>
    <severity>3</severity>
  </stolen-data>
</explanation>

AX

EX

FX

NX

CM

DM

IE

IM

MC

MO

RC RO

WI

String

4096 characters

7.x

8.x

alerts/

alert/

explanation/ stolen_data/

info/

severity

The info/severity element represents the severity level of the infection.

For example:

<explanation>
  <stolen-data>
    <info>
      <severity>3</severity>
    </info>
  </stolen-data>
</explanation>

AX

EX

FX

NX

CM

DM

IE

IM

MC

MO

RC RO

WI

String

Available severity levels:

unkn (unknown 0)

minr (minor 1)

majr (major 2)

crit (critical 3)

7.x

8.x

alerts/

alert/

explanation/ stolen_data/

info/

field/

name

The name attribute represents name of the info field in the alert notification.

<explanation>
  <stolen-data>
    <info type="identity" encryption
      = "RC4" decrypted="yes">
      <field name="service">
        https://www.fe-examples.com/
        samples/reporting/login
      </field>
      <field name ="user">
        usr-abc
      </ field>
      <field name="password">
        pass-xyz
      </field>
    </info>
  </stolen-data>
</explanation>

AX

EX

FX

NX

CM

DM

IE

IM

MC

MO

RC RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

explanation/

malware-detected

The malware-detected element provides details about detected malware.

For example:

<explanation analysis="binary" protocol="udp">
<malware-detected>
    <malware name="InfoStealer
      .Ban xker.Zbot.DNS" sid="80440378" 
      stype="blacklist"/>
  </malware-detected>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

This element might include at least one of the following attributes in the notification:

/malware

/malware/content

/malware/name

/malware/scan

/malware/sid

/malware/type

/malware/stype

/malware/archives

/malware/parent

malware/origid

/malware/archive

/malware/malicious

/malware/note

/malware/url

/malware/profile

/malware/md5sum

/malware/application

/malware/http-header

/malware/domain

/malware/user

/malware/original

/malware/downloaded-at

/malware/executed-at

malware/objurl

These sub-elements and attributes are described further in other rows in this table.

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware

The malware element uses attributes that define the detected malware.

For example:

<explanation analysis="binary" protocol="udp">
  <malware-detected>
    <malware name="InfoStealer. 
     xBanker.Zbot.DNS" sid="80440378" 
     stype="blacklist"/>
  </malware-detected>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

This element might include at least one of the following attributes in the notification:

  • content

  • name

  • scan

  • sid

  • type

  • stype

  • archives

  • parent

  • origid

  • malicious

These attributes are described further in other rows in this table.

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

content

The content attribute defines the content type of a URL associated with the detected malware.

For example:

<explanation analysis="content" protocol="">
  <malware-detected>
    <malware content=”mime” 
     name="Trojan.Down loader" stype="av-match"/>
    <malware name="VirTool.Win32
     .DelfInject.gen.AA" sid="89016770;" 
     stype="vm-bot-coand;av- match" type="exe">
      <downloaded-at>
        2012-10-10T04:06:35Z
      </downloaded-at>
      <md5sum>4c40057a9b2412e
        61472154d 66df4c0d
      </md5sum>
      <original>
        load.exe
      </original>
      <http-header>...

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

Content attribute options:

  • mime

  • text

  • and so on...

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

name

The name attribute indicates the name of the detected malware.

For example:

<explanation analysis="binary" protocol="udp">
  <malware-detected>
    <malware name="InfoStealer.Ban 
     xker.Zbot.DNS" sid="80440378" stype="blacklist"/>
  </malware-detected>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

scan

The scan attribute specifies the scan iteration ID for detected malware.

For example:

<explanation analysis="binary" protocol="udp">
  <malware-detected>
    <malware name="InfoStealer.Ban 
     xker.Zbot.DNS" sid="80440378" 
scan="54042166" stype="blacklist"/>
  </malware-detected>
</explanation>

FX

CM

DM

IE

IM MC

MO

RC

RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

sid

The sid attribute represents the Trellix internal alert sID for the detected malware.

For example:

<explanation analysis="binary" protocol="udp">
  <malware-detected>
    <malware name="InfoStealer.Ban 
     xker.Zbot.DNS" sid="80440378"
     scan="" stype="blacklist"/>
  </malware-detected>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

Integer

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

type

The type attribute specifies the file type of the detected malware.

For example:

<explanation analysis="binary" protocol="udp">
  <malware-detected>
    <malware name="InfoStealer.Ban 
     xker.Zbot.DNS" sid="80440378"
     type=”exe”  
     stype="blacklist"/>
  </malware-detected>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

Possible values:

exe

pdf

ppt

doc

docx

and so on...

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

stype

The stype attribute specifies the Trellix-assigned signature for the detected malware.

For example:

<explanation analysis="binary" protocol="udp">
  <malware-detected>
  <malware name="InfoStealer.Ban 
     xker.Zbot.DNS" sid="80440378"
     stype="blacklist"/ >
  </malware-detected>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

Possible values:

'unknown',

'generated-content',

'trellix-content',

'bot-command',

'fqc',

‘known-md5sum',

'duplicate-md5sum',

'av-match',

'vm-bot-command',

'blacklist',

'yara',

'avs',

'archive',

'encoding',

'timestamp'

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

archives

The archives attribute specifies the archives count.

For example:

<explanation analysis="binary" protocol="udp">
  <malware-detected>
    <malware name="InfoStealer.Ban 
     xker.Zbot.DNS" sid="80440378" archives=”8”/ >
  </malware-detected>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

Integer

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

parent

The parent attribute specifies the parent malware ID of detected child/nested malware.

For example:

<explanation analysis="binary" protocol="udp">
  <malware-detected>
    <malware name="InfoStealer.Ban 
      xker.Zbot.DNS" sid="80440378" 
parent=”33459873” />
  </malware-detected>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

origid

The origid attribute specifies the original malware ID for an infection, indicating that the detected malware is a duplicate of an original malware.

For example:

<explanation 
   analysis="binary" 
   protocol="udp">
  <malware-detected>
    <malware 
      name="InfoStealer.Ban 
      xker.Zbot.DNS"
      sid="80440378 
      origid=”218799” />
  </malware-detected>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

malicious

The malicious attribute specifies whether the detected malware is malicious: true or false.

For example:

<explanation analysis="binary" protocol="udp">
  <malware-detected>
  <malware name="InfoStealer.Ban 
     xker.Zbot.DNS" sid="80440378" 
malicious=”true” />
  </malware-detected>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

Available options:

true

false

unknown

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

note

The note element allows the system to add notes or details to alert notifications about the detected malware.

For example:

<explanation
   analysis="content" 
   protocol="">
  <malware-detected>
    <malware
      name="Trojan.Down loader" 
      stype="av-match"/>
    <malware
      name="VirTool. 
      Win32.DelfInject.gen.AA"
      sid="89016770;" 
      stype="vm-bot-coand;av-match"
      type="exe">
<note>
        “AttackZone3”
      </note>
      <md5sum>
        4c40057a9b241 
        2e61472154d66df4c0d
      </md5sum>
      <original>
        load.exe
      </original>
    </malware>
  </malware-detected>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

url

The url element provides the primary URL associated with the detected malware.

For example:

<explanation analysis="binary" protocol="udp">
  <malware-detected>
    <malware name="InfoStealer.Ban 
     xker.Zbot.DNS"
<url>
        https://xxx.xxx.xxx.xxx/event_stream/ 
       events_for_bot?ma_id\=51056&lms_iden\
       =00:25:90:54:7E:6E cs1Label=sname 
       cs1=Trojan. Generic
      </url>
    </malware>
  </malware-detected>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

HTTP or HTTPS

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

profile

The profile element provides details about the MVX profile in use during detection of the malware.

For example:

<explanation analysis="binary" protocol="udp">
  <malware-detected>
    <malware name="InfoStealer.Banxker.Zbot.DNS"
<profile>
        winxp-sp2
      </profile>
    </malware>
  </malware-detected>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

md5sum

The md5sum element provides the MD5 checksum details for the detected malware.

For example:

<explanation analysis="binary"
     protocol="udp">
  <malware-detected>
    <malware name="InfoStealer.Banxker.Zbot.DNS"
<md5sum>
        4c40057a9b2412e61472154d66df4c0d
      </md5sum>
    </malware>
  </malware-detected>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

application

The application element specifies the application running at the time of malware detection.

For example:

<explanation analysis="binary" protocol="udp">
  <malware-detected>
    <malware name="InfoStealer.Ban 
      xker.Zbot.DNS"
<application>
        Multiple Adobe Reader X
      </application>
    </malware>
  </malware-detected>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

http-header

The http-header element provides the captured header information for the detected malware.

For example:

<explanation analysis="binary" protocol="udp">
  <malware-detected>
    <malware name="InfoStealer.Ban 
     xker.Zbot.DNS"
<http-header>
        GET /pood/load.php HTTP/1.1 Accept: */*
        Accept-Encoding: gzip, deflate
        User-Agent: Mozilla/4.0 (compatible; 
        MSIE 6.0; Windows
        NT 5.1;SV1)
        Host: icqdosug.com
        Connection: Keep-Alive...
      </http-header>
    </malware>
  </malware-detected>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

domain

The domain element names the domain associated with the detected malware.

For example:

<explanation analysis="binary" 
   protocol="udp">
  <malware-detected>
    <malware name="InfoStealer.Ban 
       xker.Zbot.DNS"
<domain>
        networkAlpha.com
      </domain>
    </malware>
  </malware-detected>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

user

The user element specifies the user name of the appliance user that has submitted the malware for analysis.

For example:

<explanation
  analysis="binary" 
  protocol="udp">
  <malware-detected>
    <malware
      name="InfoStealer.Ban 
      xker.Zbot.DNS"
<user>
        zlroberrizez
      </user>
    </malware>
  </malware-detected>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

original

The original element specifies the name of the original detected malware.

For example:

<explanation analysis="binary" 
   protocol="udp">
  <malware-detected>
    <malware name="InfoStealer.Ban 
       xker.Zbot.DNS"
<original>
        load.exe
      </original>
    </malware>
  </malware-detected>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

downloaded-at

The downloaded-at element provides date and time information about when the detected malware was first downloaded.

For example:

<explanation analysis="binary" 
    protocol="udp">
  <malware-detected>
    <malware name="InfoStealer.Ban 
       xker.Zbot.DNS"
<downloaded-at>
        2018-10-01T15:53:46+05:30
      </downloaded-at>
    </malware>
  </malware-detected>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

String

1023 characters

Standard XML daytime format

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

executed-at

The executed-at element provides details about when the detected malware was executed in the MVX.

For example:

<explanation analysis="binary" 
   protocol="udp">
  <malware-detected>
    <malware name="InfoStealer.Ban 
       xker.Zbot.DNS"
<executed-at>
         2012-10-10T05:04:30Z
       </executed-at>
    </malware>
  </malware-detected>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

String

1023 characters

Standard XML daytime format

7.x

8.x

alerts/

alert/

explanation/

malware-detected/

malware/

objurl

The objurl element provides details about detected malware URL.

For example:

<explanation
  analysis="binary" 
  protocol="udp">
  <malware-detected>
    <malware
       name="InfoStealer.Ban 
       xker.Zbot.DNS"
<objurl>
        http://www.networkAlpha.com/fr
      </objurl>
    </malware>
  </malware-detected>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

explanation/

cnc-services

The cnc-services element uses attributes and sub-elements that detail command and control center information.

For example:

<explanation analysis="binary" protocol="udp">
<cnc-services>
    <cnc-service port="80" protocol= "tcp">
      <address>
        xxx.xxx.xxx.xxx
      </address>
      <location>
        FR
      </location>
      <channel>
        GET /images/xnews.php?p=15353&amp;
         id= 34992661&amp;e=0 HTTP/ 
         1.1::~~User-Agent: szNotify Ident::~~Host: 
         efrering- basilea.com::~~::~~
      </channel>
    <cnc-service>
  </cnc-services>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

String

1023 characters

This element might include at least one of the following attributes in the notification:

cnc-service

port

protocol

address

channel

location

These attributes and sub-elements are described further in other rows in this table.

7.x

8.x

alerts/

alert/

explanation/

cnc-services/

cnc-service

The cnc-service element uses attributes that detail command and control center port and protocol information.

For example:

<explanation analysis="binary" protocol="udp">
  <cnc-services>
    <cnc-service port="80" 
     protocol= "tcp">
  </cnc-services>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

This element might include at least one of the following attributes in the notification:

port (integer)

protocol (string: udp or tcp)

sid

sname

type

7.x

8.x

alerts/

alert/

explanation/

cnc-services/

cnc-service/

sname

The name of the network anomaly.

For example:

<cnc-service port="53" protocol="udp"
    sname="Malware.Binary.doc"
    type="NetworkAnomaly">

NX

CM

DM

IE

IM MC

MO

RC

RO

WI

String

7.9 and later

alerts/

alert/

explanation/

cnc-services/

cnc-service/

type

The type of network anomaly.

For example:

<cnc-service port="53" protocol="udp"
    sname="Malware.Binary.doc"
    type="NetworkAnomaly">

NX

CM

DM

IE

IM MC

MO

RC

RO

WI

String

7.9 and later

alerts/

alert/

explanation/

cnc-services/

cnc-service/

address

The address element specifies the IP address associated with the malware’s command and control center.

For example:

<cnc-service port="53" protocol="udp"
   sname="Malware.Binary.doc" type="NetworkAnomaly">
  <address>
    wtfismyip.com
  </address>
</cnc-service>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

IPv4 or IPv6 IP address

7.x

8.x

alerts/

alert/

explanation/

cnc-services/

/cnc-service/

channel

The channel element specifies the GET command for the channel associated with the detected malware.

For example:

<explanation analysis="binary" protocol="udp">
<cnc-services>
    <cnc-service port="80" protocol= "tcp">
<channel>
        GET /images/xnews.php?p=15353&amp;
         id= 34992661&amp;e=0 HTTP/ 
         1.1::~~User-Agent: szNotify Ident::~~Host: 
         efrering- basilea.com::~~::~~
      </channel>
    <cnc-service>
  </cnc-services>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

String

1023 characters

7.x

8.x

alerts/

alert/

explanation/

cnc-services/

cnc-service/

location

The location element specifies the geolocation(s) from which the detected malware originated.

For example:

<explanation analysis="binary" protocol="udp">
  <cnc-services>
    <cnc-service>
<location>
        FR
      </location>
    <cnc-service>
  <cnc-services>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

String

Location. For example:

US

US/OH/Columbus

7.x

8.x

alerts/

alert/

explanation

/os-changes

The os-changes element uses attributes that detail MVX operating system information at the time of infection.

For example:

<explanation analysis=
   "binary" protocol="udp">
 <os-changes
   osinfo=”Microsoft WindowsXP Professional
   5.1 base” id=”34872232” 
   version= ”6.2.0.75853”>
  </os-changes>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

This element might include at least one of the following attributes in the notification:

os-changes

osinfo

id

version

7.x

8.x

alerts/

alert/

explanation

/static-analysis

The static-analysis element uses attributes that detail information about the static analysis tool(s) used during malware analysis.

For example:

<explanation 
   analysis="binary" 
   protocol="udp">
  <static-analysis
    tool=”sophos” 
    version=”5.1”/>
</explanation>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

This element might include at least one of the following attributes in the notification:

tool

version

7.x

8.x

javacall

The javacall element is reported when the Java method of interest is called.

For example (with repeat attribute present):

<javacall context=
   "not-signed-applet"
   timestamp="3249" 
   repeat="100">
  <processinfo>
  <pid>3276</pid>
  <imagepath>
    c:\Program Files
    \Internet Explorer\iexplore.exe
  </imagepath>
  </processinfo>
  <class>
    java/lang/System
  </class>
  <method>
    setSecurityManager
  </method>
  <params>
    <param id="1">
      0x0484A3B0
    </param>
  </params>
</javacall>

For example (without repeat attribute):

<javacall context=
   "not-signed-applet"
   timestamp="3249">
  <processinfo>
    <pid>3276</pid>
    <imagepath>
      c:\Program Files
      \Internet Explorer\iexplore.exe
    </imagepath>
  </processinfo>
  <class>
    java/lang/System
  </class>
  <parentClass>
      Lsun/plugin/AppletViewer;
  </parentClass> 
  <parentMethod>
    initEnvironment
  </parentMethod>
  <method>
    setSecurityManager
  </method>
  <this>static</this>
  <params>
    <param id="1">
      0x0484A3B0
    </param>
  </params>
</javacall>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

This element might include at least one of the following items in the notification:

context

Always set to "not-signed-applet".

timestamp

A relative VM time.

repeat

Optional. Avoids reporting too many events. XML nodes marked with (*) are not present if the repeat attribute is present.

pid

Java VM process ID.

imagepath

Process path.

class

Java class name (method of interest).

method

Java method name (method of interest). Two special cases <clinit> and <init> are reported as "CLASS-CONSTRUCTOR" and "CONSTRUCTOR", respectively.

parentClass/parentMethod

The class and method that made a call to the method of interest.

this

Address of this class instance.

static

The method is static.

params/param

A list of parameters and their values.

7.x

8.x

javaevent

The javaevent attribute is reported when an action is taken to modify the current Java SecurityManager state.

For example:

<javaevent context="not-signed-applet" 
    timestamp="3249">
  <id>
    sm-reset-init
  </id>
</javaevent>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

This element might include at least one of the following in the notification:

context

Always set to "not-signed-applet".

timestamp

A relative VM time.

sm-reset-init

Reported when the Java SecurityManager is getting initialized. This value is nonmalicious.

sm-reset-null

Reported when a non-null pointer to the Java SecurityManager is getting reset to null. This value is highly malicious.

sm-reset-value

Reported with a non-null pointer to the Java SecurityManager is set to another non-null instance of the Java Security Manager. This value is inconclusive.

7.x

8.x

dialog-dismissed

The dialog-dismissed element is reported when a dialog box is recognized and about to be dismissed.

For example:

<dialog-dismissed 
   timestamp="12345">
  <pid>123</pid>
  <dlg-id>g_SampleID</dlg-id>
  <note>
    Dialog was dismissed with 
    a click on default button
  </note>
</dialog-dismissed>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

This element might include at least one of the following items in the notification:

timestamp

A relative VM time.

pid

The process ID that owns the dialog box to be dismissed.

dlg-id

A unique dialog box identifier.

note

A user-friendly string describing the dismissal method.

7.x

8.x

popup-dialog

The popup-dialog element is reported when a recognized dialog box is shown from a browser process.

For example:

<popup-dialog timestamp="12345">
  <title>System Settings</title>
  <processinfo>
    <pid>3456</pid>
    <tid>123</tid>
    <imagepath>
      c:\Program Files\Internet Explorer
       \iexplore.exe
    </imagepath>
  </processinfo>
</popup-dialog>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

This element might include at least one of the following items in the notification:

timestamp

A relative VM time.

title

The dialog box title.

pid

The process ID that owns the dialog box to be dismissed.

tid

The thread ID that created this dialog box.

imagepath

The process path.

7.x

8.x

api_patch

This an internal detection-only feature.

NX

AX

FX

EX

CM

MC

WI

IM

DM

MO

IE

RC

RO

Not applicable

7.x

8.x

thread

The thread element is reported for various operation on a thread (such as suspended, terminated, or hide), for threads created with NtQueueApcThread[Ex]/QueueUserAPC, and for opened threads (opened or duplicate_opened).

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

This element might include at least one of the following items in the notification:

source

Specifies the actor (source-process) performing the action.

target

Specifies the target (target-process) for the action.

duplicate_source

Specifies the process for which the thread handle is duplicated from. It only applies to duplicate_opened.

duplicate_target

Specifies the process for which the tread handle is copied to. It only applies to duplicate_opened.

desiredaccess

An ACCESS request for open or duplicate_open.

ntstatus

The system-call result. The result is 0x00000000/STATUS_SUCCESS for successful operations. For some operations, both success and failure are reported.

7.x

8.x

BootSectorModified

The BootSectorModified element is reported when a specimen overwrites the master boot record (MBR) of the system volume.

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

Not applicable

7.x

8.x

stackpivot

The stackpivot element refers to the stack pointer going out of the range maintained in the thread execution block (TEB). This an industry-known indicator of exploit/ROP attempts.

For example:

<stackpivot timestamp="4401541">
  <processinfo>
    <pid>3124</pid>
    <imagepath>
      C:\Program Files\Internet Explorer
       \iexplore.exe
    </imagepath>
  </processinfo>
  <apiname>
    VirtualAlloc
  </apiname>
  <StackAddress>
    0x00042348
  </StackAddress>
  <StackBottom>
    0x003fc000
  </StackBottom>
  <StackTop>
    0x00410000
  </StackTop>
</stackpivot>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

This element might include at least one of the following items in the notification:

processinfo

Provides details of the process where the stack pivot is observed.

apiname

The API where the stack pivot was discovered.

StackAddress

The value of the stack pointer.

StackBottom, StackTop

The allowed range for the stack pointer.

7.x

8.x

ROP

Return-oriented programming (ROP) is an exploit technique that leverages executable code from loaded system modules. Also a well-known technique in the security space.

For example:

<ROP mode="shellcode" 
   sequenceId="0x000525bf">
  <processinfo>
  <pid>2412</pid>
  <imagepath>
    C:\WINDOWS\explorer.exe
  </imagepath></processinfo>
  <apiname>
    LoadLibraryA
  </apiname>
  <address>
    0x00cdef1c
  </address>
  <params>
    <gadgets enc="base64">
      cG9wIGVicA0KcmV0IDB4Yw0KcG
      9wIGVicA0KcmV0IDB4Yw0KcG9w
      IGVicA0KcmV0IDB4NA0KcG9wIGV
      icA0KcmV0IDB4NA0KcG9wIGVicA
      0KcmV0IDB4NA0KcG9wIGVicA0Kc
      mV0IDB4NA0K
    </gadgets>
  </params>
</ROP>

NX

AX

FX

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

This element might include at least one of the following items in the notification:

processinfo

Provides details of the process where ROP is observed.

mode

The shellcode provides details of the ROP attempt.

stack

Provides details of stack pointer position with respect to the stack limits (similar to stackpivot.

shellcode

Provides the actual details for the ROP attempt.

apiname

The API where ROP was discovered.

address

The location from where the call to the specified API (apiname) was made.

gadgets

Encoded using base64. Crafted disassembly pieces that perform ROP.

7.x

8.x

alerts/

alert/

smtp-message/

queue-id

Postfix queue ID.

For example:

<smtp-message 
   id="queue-id-3ycy1m0lp8z3RB5q@no-message-id"
    queue-id="3ycy1m0lp8z3RB5q">
  <last-malware>PUP.Generic.MVX</last-malware>
  <protocol>attachment</protocol>
  <smtp-header>
    Received: from [127.0.1.1] (unknown [10.5.23.53])
  </smtp-header>
  <date>Thu, 01 Jan 1970 00:00:00 +0000</date>
  <subject>subject</subject>
</smtp-message>

EX

CM

DM

IE

IM MC

MO

RC

RO

WI

String

7.6 and later

alerts/

alert/

explanation/

malware-detected/

malware/

submitted-at

Submitted time.

For example:

                        <submitted-at>
  2018-10-01T15:52:11+05:30
</submitted-at>

NX

AX

FX

EX

CM

MC

MO

RO

Time stamp

8.x

alerts/

alert/

root-infection

Identifies the original infection alert ID from the sensor.

For example:

<alert ack="no" 
   appliance-id="00:25:90:86:7B:54"
   id="2235" name="malware-object"
   product="Email MPS"
   root-infection="613"
   sensor="Kitkat"
   sensor-ip="xxx.xxx.xxx.xxx"
   severity="majr"
   uuid="3e6295b8-5517-40b3-a1e6-98116ff3"
   version="8.0.0.628198">

NX

CM

DM

IM

MC

MO

RC

RI

RO

WI

String

7.x

8.x

alerts/

alert/

ack

Indicates whether the alert has been acknowledged.

For example:

<alert ack="no" id="3720"
    name="malware-callback"
    severity="crit"
    uuid="c53adc7a-4b7a-4cfd-93cb-133d287a8">

EX

NX

CM

DM

IE

IM

MC

MO

RC

RI

RO

WI

yes or no

7.x

8.x

apicall

An apicall event is reported when a library, system, or user routine is called.

For example:

<apicall timestamp="18532" sequenceNumber="40">

<processinfo>

<pid>3032</pid>

<imagepath>

C:\Documents and Settings\

admin\Local Settings\Temp\

MALWARE_35cfcc3d-b4cc-

4c18-906d-17a2270f038e\

61e1bdf1b3a21b3cfda841ec65bf27df.exe

</imagepath>

<md5sum>

61e1bdf1b3a21b3cfda841ec65bf27df

</md5sum>

</processinfo>

<dllname>user32.dll

</dllname>

<apiname>FindWindowA

</apiname>

<address>0x00fe2a69

</address>

<params>

<param id="1">Shell_TrayWnd

</param>

<param id="2">NULL

</param>

</params></apicall>

NX

AX

FX

EX

CM

MO

This element might include at least one of the following items in the notification:

  • processinfo

    Provides the details of the of the process that is being reported.

  • apiname

    Name of the called API function.

  • params

    List of parameters provided to the API function.

GI

version 15.0210

codeinjection

A code injection event is reported when a source process injects code into a target process.

For example:

<codeinjection mode="named section

direct code injection" suppressed=

"false" timestamp="26867"

sequenceNumber="45">

<source tainted="true">

<processinfo>

<pid>3032</pid>

<imagepath>

C:\Documents and Settings\

admin\Local Settings\Temp\

MALWARE_35cfcc3d-b4cc-

4c18-906d-17a2270f038e\

61e1bdf1b3a21b3cfda841ec65bf27df.exe

</imagepath>

<md5sum

>61e1bdf1b3a21b3cfda841ec65bf27df

</md5sum>

</processinfo>

</source>

<target tainted="false">

<processinfo>

<pid>1512</pid>

<imagepath>

C:\WINDOWS\explorer.exe

</imagepath>

<md5sum>

12896823fb95bfb3dc9b46bcaedc9923

</md5sum>

</processinfo>

</target>

</codeinjection>

NX

AX

FX

EX

CM

BA

This element might include at least one of the following items in the notification:

  • source:processinfo

    Provides the details of the sources of the process performing the code injection.

  • target:processinfo

    Provides the details of the target of the process performing the code injection.

GI

version 15.0210

exploitcode

exploitcode represents the detection of shell code in a browser or document viewer such as Adobe Acrobat.

For example:

<exploitcode

protection="00000004"

timestamp="17934">

<processinfo>

<pid>3032</pid>

<imagepath>

C:\Program Files\Adobe\

Reader 8.0\Reader\

AcroRd32.exe

</imagepath><md5sum>

1a5b4b58dbb62677

6920260704fd0116

</md5sum></processinfo>

<dllname>kernel32.dll

</dllname><apiname>

GetFileSize</apiname>

<address>0x0a0bfd20

</address><params>

<param id="1">0x1

</param>

<param id="2">0x12cecc

</param></params>

<callstack><callstack-entry>

<frame-number>3

</frame-number>

<instruction-address>

0x000000000a0bfd20

</instruction-address>

</callstack-entry>

<callstack-entry>

<frame-number>4

</frame-number>

<instruction-address>

0x000000007c9032a8

</instruction-address>

<module-name>C:\WINDOWS\

system32\ntdll.dll

</module-name>

<symbol-name>

ExecuteHandler2

</symbol-name>

<symbol-displacement>

0x00000026

</symbol-displacement>

</callstack-entry>

<callstack-entry>

<frame-number>5

</frame-number>

<instruction-address>

0x000000007c90327a

</instruction-address>

<module-name>

C:\WINDOWS\

system32\ntdll.dll

</module-name>

<symbol-name>

ExecuteHandler

</symbol-name>

<symbol-displacement>

0x00000024

</symbol-displacement>

</callstack-entry>

<callstack-entry>

<frame-number>6

</frame-number>

<instruction-address>

0x000000007c90e46a

</instruction-address>

<module-name>C:\WINDOWS\

system32\ntdll.dll

</module-name>

<symbol-name>

KiUserExceptionDispatcher

</symbol-name>

<symbol-displacement>

0x0000000e

</symbol-displacement>

</callstack-entry></callstack>

</exploitcode>

NX

AX

FX

EX

CM

BA

This element might include at least one of the following items in the notification:

  • protection

    Current memory setting where the exploit occurs.

  • timestamp

    Time when the exploit occurred.

  • processinfo

    Provides details of the process where the exploit is observed.

  • pid

    Process ID.

  • dllname

    Name of the DLL used in the exploit.

  • apiname

    Name of the API function called.

  • params

    List of parameters provided to the exploit.

  • param id

    ID of parameter used in the exploit.

GI

version 15.0210

folder

folder represents folder activity.

For example:

<folder mode="open" src_thread="VBA_MACRO" timestamp="9873">
  <value>C:\Documents and Settings\admin</value>
  <processinfo>
    <pid>3244</pid>
    <imagepath>C:\Program Files\Microsoft Office\Office12\WINWORD.EXE</imagepath>
    <md5sum>f13f5ac8b89c9ac8d02d1ef7cf9bdf0a</md5sum>
  </processinfo>
  <ntstatus>0x0</ntstatus>
  <CreateOptions>0x21</CreateOptions>
</folder>

NX

AX

FX

EX

CM

MO

This element might include at least one of the following items in the notification:

  • mode

    Mode of the folder operation. Possible values: 'failed', 'open', 'delete', 'cutpaste', 'overwrite', 'date_change', and 'created'.

  • failure

    If the mode is 'failed', this field contains which operation failed.

  • processinfo

    Provides details of the process where the folder is observed.

  • fid

    Folder ID.

  • pid

    Process ID.

  • md5sum

    Folder hash.

  • ntstatus

    Numeric value for internal error code.

  • filesize

    Size of folder.

  • old_name

    If the folder name was changed, this field contains the original file name.

  • new_name

    If the folder name was changed, this field contains the new file name.

  • sha1sum

    SHA-1 hash of the folder.

  • lastWriteTime

    Date and time when the folder was last written to.

  • newCreationTime

    If the date of the folder was changed, this field contains the new date.

  • newChangeTime

    If the time of the folder was changed, this field contains the new time.

GI

version 15.0210

heapspraying

A heapspray event is reported when there is the intent to exploit a process with arbitrary code execution.

For example:

<heapspraying name="acrord32.exe" type="Allocation" timestamp="2728">
  <processinfo>
    <pid>3896</pid>
    <imagepath>C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe</imagepath>
    <md5sum>7a97aa40d8a3da4a9095873c72d524c5</md5sum>
  </processinfo>
  <bytesreceived>284672000</bytesreceived>
  <totalmemory>284672000</totalmemory>
  <lastbytesreceived>163627008</lastbytesreceived>
  <lasttotalmemory>284672000</lasttotalmemory>
  <incrementCount>121044992</incrementCount>
</heapspraying>

NX

AX

FX

EX

CM

MO

This element might include at least one of the following items in the notification:

  • processinfo

    Provides the details of the process where the heapspray attack is observed.

  • bytesreceived

    Size of detected spray allocation.

  • totalmemory

    Size of detected spray allocation.

GI

version 15.0210

mutex

mutex is reported when there is a text event.

For example:

<mutex timestamp="8599">

<value>

\BaseNamedObjects\

CTF.LBES.MutexDefaultS-

1-5-21-1409082233-

688789844-725345543-1003

</value><processinfo>

<pid>3040</pid>

<imagepath>

C:\Documents and Settings\admin\

Local Settings\Temp\

fdfc52cc36f04317c87

98b6929159c5d.exe

</imagepath><md5sum>

fdfc52cc36f04317c87

98b6929159c5d

</md5sum></processinfo>

</mutex>

NX

AX

FX

EX

CM

BA

This element might include at least one of the following items in the notification:

  • timestamp

    Time when the text event occurred.

  • value

    Name of the mutex.

  • processinfo

    Provides details of the process where the file event is observed.

  • pid

    Process ID.

GI

version 15.0210

alerts/

alert/

explanation/

oschanges/

network

network is reported when there is a network event.

For example:

<network mode="http_request" timestamp="11790">
  <processinfo tainted="false">
    <pid>800</pid>
    <imagepath>
      C:\Program Files\Internet Explorer7\iexplore.exe
    </imagepath>
    <md5sum>
      de49b348a18369b4626fba1d49b07fb4
    </md5sum>
  </processinfo>
  <protocol_type>tcp</protocol_type>
  <destination_port>8080</destination_port>
  <ipaddress>10.0.0.2</ipaddress>
  <http_request>
    GET http://illegaltopcounters.ru/favicon.ico
     HTTP/1.1~~Accept: */*~~UA-CPU:
      x86~~Accept-Encoding:
     gzip, deflate~~User-Agent: Mozilla/4.0
     (compatible; MSIE 7.0; Windows NT 5.1;
     .NET CLR 2.0.50727; .NET CLR 3.0.04506.30;
     .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
     .NET4.0C; .NET4.0E)
     ~~Host: illegaltopcounters.ru~~Proxy-Connection:
     Keep-Alive~~~~
  </http_request>
</network>

NX

AX

FX

EX

CM

MO

WI

This element might include at least one of the following items in the notification:

  • mode

    Mode of the network event. For example: 'dns_query'.

  • timestamp

    Time when the network event occurred.

  • processinfo

    Provides details of the process where the network event is observed.

  • pid

    Process ID.

  • md5sum

    Hash of the image file that the network evnet was launched from.

  • protocol_type

    Type of protocol used.

  • qtype

    Type of queue.

  • hostname

    Hostname.

GI

version 15.0210

process

process is reported when a process is created or terminated.

For example:

<process mode="started" timestamp="14294">

<value>

C:\Users\admin\AppData\Local\

Temp\fdfc52cc36f04317

c8798b6929159c5d.exe

</value><pid>1052</pid>

<ppid>1944</ppid>

<parentname>

C:\Windows\System32\cmd.exe

</parentname><cmdline>

&quot;fdfc52cc36f04317c87

98b6929159c5d.exe&quot;

</cmdline><filesize>19968</filesize>

<md5sum>

fdfc52cc36f04317c87

98b6929159c5d

</md5sum><sha1sum>

9d85a23347d27180c57

d9b31b7d28c5d45cb36f4

</sha1sum><fid ads="">

1970324836992459

</fid></process>

NX

AX

FX

EX

CM

BA

This element might include at least one of the following items in the notification:

  • mode

    Mode of the file operation. Possible values: 'started' or 'terminated'.

  • timestamp

    Time when the process occurred.

  • value

    Name of the process.

  • pid

    Process ID.

  • ppid

    Parent process ID.

  • parentname

    Name of the parent process.

  • cmdline

    Command used to invoke the process.

  • filesize

    Size of the image file that the process launched from.

  • md5sum

    Hash of the image file that the process launched from.

  • sha1sum

    SHA-1 hash of the image file that the process launched from.

  • fid

    ID of the image file that the process launched from.

GI

version 15.0210

regkey

regkey is reported when there is registry activity.

For example:

<regkey mode="added"

timestamp="7994">

<value>

\REGISTRY\USER\

S-1-5-21-1409082233-

688789844-725345543-1

003\SOFTWARE\

Microsoft\Windows\

CurrentVersion\Internet Settings

</value><processinfo>

<pid>3040</pid>

<imagepath>

C:\Documents and Settings\

admin\Local Settings\Temp\

fdfc52cc36f04317c87

98b6929159c5d.exe

</imagepath><md5sum>

fdfc52cc36f04317c87

98b6929159c5d

</md5sum>

</processinfo></regkey>

<regkey mode="queryvalue"

randomized="true"

timestamp="8031">

<value>\REGISTRY\

MACHINE\SYSTEM\

ControlSet001\Control\

ComputerName\

ActiveComputerName\

&quot;ComputerName&quot;

</value><processinfo>

<pid>3040</pid>

<imagepath>

C:\Documents and Settings\

admin\Local Settings\Temp\

fdfc52cc36f04317c87

98b6929159c5d.exe

</imagepath><md5sum>

fdfc52cc36f04317c87

98b6929159c5d

</md5sum>

</processinfo>

</regkey>

NX

AX

FX

EX

CM

BA

This element might include at least one of the following items in the notification:

  • mode

    Mode of the registry operation. For example: 'added' or 'queryvalue'.

  • value

    Name of the register or the register name plus the value.

  • processinfo

    Provides details of the process where the registry activity is observed.

  • pid

    Process ID.

GI

version 15.0210

uac

uac is reported when there is a Windows user account control.

For example:

<uac mode="service" timestamp="10880">
  <value>Telephony</value>
  <status>running</status>
</uac>

NX

AX

FX

EX

CM

MO

This element might include at least one of the following items in the notification:

  • mode

    Mode of the Windows user account control. For example: 'service'.

  • timestamp

    Time when the Windows user account control occurred.

  • value

    String representing the type of Windows user account control.

  • status

    Status of the Windows user account control.

GI

version 15.0210

dll-loaded

dll-loaded is reported when a new or unknown dynamic link library (DLL) is loaded into a process.

For example:

<dll-loaded timestamp="40593">

<processinfo>

<pid>3088</pid>

<ppid>3076</ppid>

<imagepath>

C:\WINDOWS\winspooll.exe

</imagepath>

<cmdline>&quot;c:\windows\

winspooll.exe&quot;

</cmdline><md5sum>

c7fb56f61bcf2fb6ef

02b6da9adfb319

</md5sum></processinfo>

<dllpath>C:\WINDOWS\

twain16.dll</dllpath>

<md5sum>6eb97e0f573

a4c6b44b9fd0361ed0078

</md5sum><sha1sum>

99940a8d08bbea4335528

26f74de1947c865d9d6

</sha1sum></dll-loaded>

NX

AX

FX

EX

CM

BA

This element might include at least one of the following items in the notification:

  • timestamp

    Time when the DLL was loaded.

  • processinfo

    Provides details of the process where the DLL is observed.

  • pid

    Process ID.

  • ppid

    Parent process ID.

  • cmdline

    Command used to invoke the process.

  • md5sum

    Hash of the DLL that was loaded.

  • dllpath

    Name of the DLL that was loaded.

  • sha1sum

    SHA-1 hash of the DLL that was loaded.

GI

version 15.0210

:
Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy.
Products
Company
Top Features
Solutions
Existing Users
Connect With Us
Sales and Support
Copyright © Abc Inc. All Rights Reserved