Product documentation
uberAgent
Select version Current Release 7.2.1 7.2.0 7.1.2 7.1.1 7.1.0 7.0.2 7.0.1 7.0.0

MS Office & Acrobat Reader Monitoring

July 9, 2024
Contributed by: 
C

The ESA Threat Detection rules for monitoring Microsoft Office and Adobe Acrobat Reader are vast limits vendor rules.

Microsoft Office Rules

The rules in this section detect suspicious behavior with MS Office applications.

  • Detect macro execution with the default Office security configuration applied ("disable all macros with notification")
  • Detect child processes of Microsoft Office applications (dedicated rules for scripts and other types of child processes)
  • Detect Microsoft Office download operations
  • Detect Microsoft Office applications executing macros that access WMI to create child processes
  • Suspicious DLL load by Office
  • Detect loading of MAPI DLLs from processes other than Outlook

Adobe Acrobat Reader Rules

The rules in this section detect suspicious behavior with Adobe Acrobat Reader.

  • Detect child processes of Adobe Reader
MS Office & Acrobat Reader Monitoring
July 9, 2024
Contributed by: 
C
July 9, 2024
Contributed by: 
C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.