Product documentation
uberAgent
Current Release (7.3.0) 7.2.1 7.2.0 7.1.2 7.1.1 7.1.0 7.0.2 7.0.1 7.0.0
View PDF

File System Activity Monitoring

July 31, 2024
Contributed by: 
C

File system activity monitoring is uberAgent ESA’s capability to detect changes to objects in the file system. The monitored object types include files, of course, but also named pipes. uberAgent ESA can identify and react many different types of file system events, e.g., read, write, delete. Please see the event types documentation for details.

Configuration

File system activity monitoring can be configured via the stanza [FilesystemMonitoring]. By default, file system activity monitoring is enabled. To disable file system activity monitoring set Enabled = false.

Monitored Volumes

New Volumes Added to the System

In the default configuration, uberAgent only monitors volumes that were present when the agent was started; newly added volumes are ignored. This can be changed by setting Hotplug = true.

Disabling Monitoring by Volume Type

To monitor only certain volume types, use the setting Monitor. The following table shows available values.

Volume type Description Platform
Disks Monitors all hard drives. This includes removable media such as USB thumb drives. all
Mailslots Monitors all mailslots, a mechanism for one-way interprocess communication (IPC) using pseudofiles that reside in memory. Windows
NamedPipes Monitors all named pipes, a mechanism for interprocess communication (IPC) that is accessed much like a file. Windows
NetworkShares Monitors all remote file systems (access to network shares). Supported protocols depend on the OS:

Windows: all protocols handled by the multiple UNC provider (MUP), typically: SMBRDPNP (remote desktop services client drives)WebDAV macOS: SMBAFPNFS		 all

Example Configurations

With the following example configuration, uberAgent monitors disks only, i.e., hard drives and removable media. As Hotplug is set to true, uberAgent monitors volumes that were present when the agent was started as well as volumes mounted at runtime. Monitoring of network shares, mailslots, and named pipes is disabled.

[ProductComponents]
EnableESA = true

[FilesystemMonitoring]
Enabled = true
Hotplug = true
Monitor = Disks
<!--NeedCopy-->

With the following example configuration, uberAgent monitors disks and network shares. As Hotplug is not enabled, uberAgent only monitors volumes that were present when the agent was started. Monitoring of mailslots and named pipes is disabled.

[ProductComponents]
EnableESA = true

[FilesystemMonitoring]
Enabled = true
Monitor = Disks
Monitor = NetworkShares
<!--NeedCopy-->

File System Events in Threat Detection Engine (TDE)

File system events are available in TDE rules, whose queries are powered by uAQL. uAQL queries for file system events can make use of common event properties as well as file system event properties.

Example Rule for Windows

The following example detects writes to files in the directory C:\Windows (Windows):

[ActivityMonitoringRule]
# Detect writes to files in the directory C:\Windows.
RuleId = 2b635c8b-3c2b-4c51-b073-40a796d4ab9e-write
RuleName = Any file write
EventType = File.Write
Tag = file-write
RiskScore = 100
Query = File.Path like "%C:\\Windows\\%"
GenericProperty1 = File.Name
GenericProperty2 = File.CreationDate
GenericProperty3 = File.IsExecutable
GenericProperty4 = File.Path
<!--NeedCopy-->

Example Rule for macOS

The following example detects writes to files in the directory /Library/LaunchAgents (macOS):

[ActivityMonitoringRule]
# Detect writes to files in the directory /Library/LaunchAgents.
RuleId = 2b635c8b-3c2b-4c51-b073-40a796d4ab9e-write
RuleName = Any file write
EventType = File.Write
Tag = file-write
RiskScore = 100
Query = File.Path like "%/Library/LaunchAgents/%"
GenericProperty1 = File.Name
GenericProperty2 = File.CreationDate
GenericProperty3 = File.IsExecutable
GenericProperty4 = File.Path
<!--NeedCopy-->

Platform-Specific Notes

Windows

On Windows, uberAgent uses a minifilter driver to monitor the file system. Only successful file system activity is reported. Attempts that are not permitted due to missing permissions and attempts that are blocked by security products are not reported.

macOS

On macOS, uberAgent leverages the Endpoint Security Framework to monitor the file system. The Endpoint Security Framework provides the necessary APIs to capture a comprehensive range of events, including both successful and unsuccessful events. Different from the Windows implementation, on macOS uberAgent may capture unsuccessful events, too. Such events might result from permissions issues, for example. Specific results depend on the altitude at which the framework hooks the list of syscalls needed for file system activity.

File System Activity Monitoring
July 31, 2024
Contributed by: 
C
July 31, 2024
Contributed by: 
C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.