Appendix; System Rules And Reports; List Of System Rules - Cisco CS-MARS-20-K9 - Security MARS 20 User Manual

System Rules and Reports

This appendix presents the list of system rules and reports and provides a brief description of their
intended use.
This chapter contains the following topics:
•
•

List of System Rules

This topic defines the complete list of system rules issued with this release.
•
•
•
•
78-17020-01
List of System Rules, page D-1
List of System Reports, page D-13
System Rule: Backdoor: Active.
This correlation rule detects a connection to a backdoor server or a response from a backdoor server
in your network accompanied by malicious follow-up activity on the server hosting the backdoor -
this may indicate that a malicious backdoor service is likely running in your network. Malicious
follow-up activity includes excessive scans, denied packets, installation of malicious services, local
buffer overflow attacks etc. Backdoors such as Unix rootkits or Trojan horses are malicious
programs that offer extensive remote control of a host and may be left by an attacker on a
compromised host to maintain future remote access.
System Rule: Backdoor: Connect.
This correlation rule detects a connection to a backdoor server or a response from a backdoor server
in your network - there may or may not be any follow-up activity on the destination host. Backdoors
(e.g. Rootkits, Trojan Horse programs) and command shells provide extensive remote control of a
host and may be left by an attacker on a compromised host to maintain future remote access.
System Rule: Backdoor: Covert Channel.
This correlation rule detects communication over covert channels - this means DMZ services such
as HTTP, DNS, ICMP, FTP, SMTP etc. are being misused to tunnel inappropriate traffic via those
ports. DMZ services are chosen since firewalls permit them but may not perform deep protocol
inspection. Either the source or the destination in this event may be compromised.
System Rule: Backdoor: Spyware.
This rule detects spyware e.g. Gator, Bonzi etc. installed on hosts or requests to hosts with spyware
installed. Spyware are malicious applications that can be installed on a computer without the
knowledge of the user, e.g. when one visits a web site or clicks on an advertising link or installs file
A P P E N D I X
User Guide for Cisco Security MARS Local Controller
D
D-1