Knowledge Base

A port scan that is initiated from a monitored host can be detect by monitoring Windows Filtering Platform event id 5156https://system32.eventsentry.com/security/event/5156 and applying a threshold filter. Sysmon cannot be used to detect port scans since it only logs successfully established connections. 1. Enable auditing to ensure that ...

Emotet https://en.wikipedia.org/wiki/Emotet is dangerous malware that has been infecting networks since 2016 causing serious damage to organizations. The team of JPCERThttps://www.jpcert.or.jp/english/ created Emocheckhttps://github.com/JPCERTCC/EmoCheck/releases a command line utility that detects running emotet processes. This a...

By monitoring 4688 events from the security event log and filtering on the process file size EventSentry can notify you if a large or small executable was launched. 1. Ensure that 4688 eventshttps://system32.eventsentry.com/security/event/4688 are being logged to the event log. See the link for more information on auditing requirements...

By monitoring 4688 events from the security event log and filtering on the process file size EventSentry can notify you if an unsigned executable a file without a digital signature was launched. 1. Ensure that 4688 eventshttps://system32.eventsentry.com/security/event/4688 are being logged to the event log. See the link for more inform...

Since Ransomware often manifests itself by creating encrypted files with new file extensions detecting neverbefore seen file extensions can be an effective way to detect Ransomware in realtime. EventSentry can utilize the following features to detect new file extensions in real time: Anomaly Detection Insertion String Override w...

Yes the tray utility EventSentray can be configured to monitor all text that is copied to a user39s clipboard. This can prevent certain attacks that can trick a user into copying malicious code and executing it on their system. If EventSentray detects text in the clipboard that matches your settings it can perform any one of the followin...