uberAgent

View PDF

Event Types

August 21, 2024

Contributed by:

uberAgent ESA’s Threat Detection rules can be triggered by many different types of events.

Event types are specified in the EventType component of [ActivityMonitoringRule] stanzas (rule syntax).

Process & Image Events

Event Types

The following process event types are available:

Process.Start: a new process is created/started.
Process.Stop: a process is terminated/stopped.
Process.CreateRemoteThread: a process is starting a thread in another process.
Process.TamperingEvent: a process tampering event is detected.
Image.Load: an executable image (e.g., a DLL) is loaded.
Driver.Load: a kernel image (e.g., a driver) is loaded.

Event Properties

Common event properties are available with all types of events. Remote thread creation events and image load events have additional properties.

Network Events

Event Types

The following network event types are available:

Net.Send: a network packet is sent.
Net.Receive: a network packet is received.
Net.Connect: a network connection is established.
Net.Reconnect: a network connection is re-established.
Net.Retransmit: a network packet is retransmitted (sent again).

Event Properties

Please see the documentation for the properties of network events.

Registry Events

Event Types

The following registry event types are available:

Reg.Key.Create: a registry key is created.
Reg.Value.Write: a registry value is written. This includes registry value creation as well as changes to the value’s name and data.
Reg.Delete: a registry key or value is deleted.
Reg.Key.Delete: a registry key is deleted.
Reg.Value.Delete: a registry value is deleted.
Reg.Key.SecurityChange: a registry key’s security descriptor is changed.
Reg.Key.Rename: a registry key is renamed.
Reg.Key.SetInformation: a registry key metadata is changed (e.g. last-write time, tags, virtualization, etc.).
Reg.Key.Load: a registry hive is loaded.
Reg.Key.Unload: a registry hive is unloaded.
Reg.Key.Save: a registry key is saved.
Reg.Key.Restore: a registry key is restored.
Reg.Key.Replace: a registry key is replaced.
Reg.Any: any of the above.

Event Properties

Please see the documentation for the properties of registry events.

DNS Query Events

Event Types

The following DNS query event types are available:

DNS.Query: an outgoing DNS query request has completed, and a response has been received.

Event Properties

Please see the documentation for the properties of DNS query events.

File System Events

Event Types

The following file system activity event types are available:

File.ChangeCreationTime: a file’s original creation timestamp is changed (available on Windows only).
File.Create: a file is created.
File.CreateStream: an alternate data stream (ADS) is created (available on Windows only).
File.Delete: a file is deleted (all platforms)
File.PipeCreate: a named pipe is created.
File.PipeConnected: a client connects to a named pipe.
File.RawAccessRead: raw read access to a target device, bypassing ACLs (available on Windows only).
File.Rename: a file is renamed.
File.Write: a file is being written to.
File.Read: a file is being read from.

Event Properties

Please see the documentation for the properties of file system activity events.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Event Types

August 21, 2024

Contributed by:

August 21, 2024

Contributed by:

Event Types

Process & Image Events

Event Types

Event Properties

Network Events

Event Types

Event Properties

Registry Events

Event Types

Event Properties

DNS Query Events

Event Types

Event Properties

File System Events

Event Types

Event Properties

In this article