UTMSTACK logoUTMSTACK logo
Antivirus ESMC / ESET

Detection rules for ESMC / ESET data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects.

This category contains 13 detection rules.

RuleCategoryTechniqueImpact (C/I/A)
Advanced Heuristic Detection TriggersDefense Evasion, Privilege EscalationT1055 - Process InjectionC:3 / I:3 / A:2
ESET Agent Disabled or TamperedDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:3 / I:3 / A:3
ESET Blocked Suspicious PowerShell ActivityExecutionT1059.001 - Command and Scripting Interpreter: PowerShellC:3 / I:3 / A:1
ESET Botnet Communication DetectionCommand and ControlT1071 - Application Layer ProtocolC:3 / I:3 / A:2
ESET ERA/ESMC Console Suspicious ActivityLateral MovementT1072 - Software Deployment ToolsC:3 / I:3 / A:2
ESET Exploit Detection AlertPrivilege EscalationT1068 - Exploitation for Privilege EscalationC:3 / I:3 / A:2
ESET Host Intrusion Prevention System TriggeredDefense Evasion, Privilege EscalationT1055 - Process InjectionC:3 / I:3 / A:2
ESET Network Attack DetectionInitial AccessT1190 - Exploit Public-Facing ApplicationC:3 / I:2 / A:1
ESET Repeated Quarantine FailuresDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:2 / I:3 / A:2
Machine Learning Detection AnomaliesExecutionT1204.002 - User Execution: Malicious FileC:3 / I:3 / A:2
Registry Modification Attempts BlockedDefense Evasion, PersistenceT1112 - Modify RegistryC:2 / I:3 / A:2
Suspicious Encrypted File ActivityImpactT1486 - Data Encrypted for ImpactC:3 / I:3 / A:2
Suspicious Process Behavior DetectionDefense Evasion, Privilege EscalationT1055 - Process InjectionC:3 / I:3 / A:2

Rule Example

Below is an example of a rule definition for Advanced Heuristic Detection Triggers (view in repository):

# Rule version v1.0.0

dataTypes:
  - antivirus-esmc-eset
name: Advanced Heuristic Detection Triggers
impact:
  confidentiality: 3
  integrity: 3
  availability: 2
category: Defense Evasion, Privilege Escalation
technique: "T1055 - Process Injection"
adversary: origin
references:
  - https://help.eset.com/eea/8/en-US/idh_config_threat_sense.html
  - https://attack.mitre.org/techniques/T1055/
description: |
  Detects when ESET's advanced heuristic engine identifies suspicious behavior patterns that may indicate novel malware or zero-day threats. These detections use DNA signatures and behavioral analysis.
  
  Next Steps:
  - Review the affected hostname and user context to understand the scope
  - Check the process name (if available) that triggered the detection
  - Verify if the action taken (cleaned/deleted/quarantined) was successful
  - Look for related alerts from the same host within the past 24 hours
  - If multiple hosts show similar detections, investigate potential lateral movement
  - Consider isolating the affected system if threat persists
  - Review ESET console link (if available) for detailed threat information
  - Check file hash against threat intelligence databases if available
  - Capture and analyze the malicious file sample if quarantined
  - Review system logs for any unusual activities before and after detection
  - Update ESET signatures and run a full system scan
where: |
  oneOf("log.msgType", ["EnterpriseInspectorAlert_Event", "threat_event", "FirewallAggregatedAlert_Event"]) &&
  contains("log.jsonMessage", ["heuristic", "NewHeur", "suspicious behavior"]) &&
  contains("log.jsonMessage", ["cleaned", "deleted", "quarantined", "blocked"])
afterEvents:
  - indexPattern: v11-log-antivirus-esmc-eset-*
    with:
      - field: log.headHostname
        operator: filter_term
        value: '{{.log.headHostname}}'
    within: now-30m
    count: 3
groupBy:
  - lastEvent.log.headHostname
  - lastEvent.log.msgType

Rule Details

Advanced Heuristic Detection Triggers

Detects when ESET's advanced heuristic engine identifies suspicious behavior patterns that may indicate novel malware or zero-day threats. These detections use DNA signatures and behavioral analysis.

ESET Agent Disabled or Tampered

Detects when the ESET security agent is disabled, uninstalled, or tampered with. This is a critical defense evasion indicator as attackers commonly disable endpoint protection before executing their payload.

ESET Blocked Suspicious PowerShell Activity

Detects when ESET blocks suspicious PowerShell commands or scripts that exhibit malicious behavior patterns, including obfuscated scripts, encoded commands, or attempts to bypass execution policies. This is a high-priority security event that indicates potential malicious activity was prevented.

ESET Botnet Communication Detection

Detects attempts to communicate with known botnet command and control servers. ESET identifies typical communication patterns when a computer is infected and a bot is attempting to communicate with malicious C2 infrastructure.

ESET ERA/ESMC Console Suspicious Activity

Detects suspicious activity on the ESET ERA/ESMC management console including unauthorized policy changes, mass task deployments, or admin account modifications that could indicate console compromise.

ESET Exploit Detection Alert

Detects when ESET's Exploit Blocker identifies and blocks exploitation attempts targeting vulnerabilities in commonly exploited applications such as browsers, document readers, email clients, Flash, and Java.

ESET Host Intrusion Prevention System Triggered

Detects when ESET's Host-based Intrusion Prevention System (HIPS) blocks suspicious behavior, including process manipulation, registry modifications, and file system changes that indicate potential malware activity. HIPS events indicate active attempts to compromise system integrity through various attack techniques.

ESET Network Attack Detection

Detects network-based attacks and exploits blocked by ESET's Network Attack Protection (IDS). This includes attempts to exploit known vulnerabilities in network services and protocols.

ESET Repeated Quarantine Failures

Detects repeated quarantine failures in ESET, which may indicate malware actively resisting quarantine through file locks, permission manipulation, or rapid re-creation of malicious files.

Machine Learning Detection Anomalies

Identifies threats detected by ESET's machine learning engine that analyzes file behavior patterns and characteristics to identify previously unknown malware variants. Machine learning detection indicates advanced malware that may evade signature-based detection methods.

Registry Modification Attempts Blocked

Identifies attempts to modify critical Windows registry keys that were blocked by ESET, indicating potential persistence or system tampering attempts. Registry modifications are a common technique used by malware to establish persistence, disable security features, or alter system behavior.

Suspicious Encrypted File Activity

Detects suspicious encrypted file activities that may indicate ransomware encryption attempts or unauthorized file encryption operations. This rule triggers when ESET detects ransomware-related threats or file encryption activities.

Suspicious Process Behavior Detection

Detects suspicious process behaviors including injection attempts, privilege escalation, and abnormal process creation patterns identified by ESET's behavioral monitoring. This alert indicates potential malware activity or exploitation attempts on the affected system.