UTMSTACK logoUTMSTACK logo
Sophos XG Firewall

Detection rules for XG Firewall data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects.

This category contains 9 detection rules.

RuleCategoryTechniqueImpact (C/I/A)
Probable Sophos denial of service (DoS) attackImpactT1499 - Endpoint Denial of ServiceC:3 / I:3 / A:3
Probable Sophos initial access vulnerabilityInitial AccessT1078.001 - Valid AccountsC:2 / I:2 / A:1
Probable Sophos ip spoofing attackImpactT1499 - Endpoint Denial of ServiceC:3 / I:3 / A:3
Probable malware detected by sophos firewallExecutionT1204 - User ExecutionC:3 / I:3 / A:3
Probable password guessing in Sophos Administrator accountCredential AccessT1110.001 - Brute ForceC:3 / I:3 / A:2
Sophos XG Advanced Threat Protection AlertMalwareT1204 - User ExecutionC:3 / I:3 / A:2
Sophos XG IPS Alert DetectionIntrusion DetectionT1190 - Exploit Public-Facing ApplicationC:3 / I:3 / A:2
Sophos XG VPN Authentication FailuresCredential AccessT1110 - Brute ForceC:3 / I:2 / A:1
Sophos detected high priority alertsInitial AccessT1190 - Exploit Public-Facing ApplicationC:3 / I:3 / A:3

Rule Example

Below is an example of a rule definition for Probable Sophos denial of service (DoS) attack (view in repository):

# Rule version v1.0.0

dataTypes:
  - "firewall-sophos-xg"
name: "Probable Sophos denial of service (DoS) attack"
impact:
  confidentiality: 3
  integrity: 3
  availability: 3
category: "Impact"
technique: "T1499 - Endpoint Denial of Service"
adversary: origin
references: 
  - "https://support.sophos.com/support/s/article/KB-000035754?language=en_US"
  - "https://docs.sophos.com/nsg/sophos-firewall/18.5/PDF/SF%20syslog%20guide%2018.5.pdf"
  - "https://attack.mitre.org/tactics/TA0040"
  - "https://attack.mitre.org/techniques/T1499/"
description: "A Denial of Service (DoS) attack is an attempt to make a machine or network resource unavailable to the intended users.
              One common method of attack involves saturating the target machine with external communications requests so that it cannot
              respond to legitimate traffic or the machine responds so slowly that it is essentially useless."
where: |
  equalsIgnoreCase("log.component", "dos attacks") && equalsIgnoreCase("log.subType", "dos")
groupBy:
  - adversary.ip
  - target.ip

Rule Details

Probable Sophos denial of service (DoS) attack

A Denial of Service (DoS) attack is an attempt to make a machine or network resource unavailable to the intended users. One common method of attack involves saturating the target machine with external communications requests so that it cannot respond to legitimate traffic or the machine responds so slowly that it is essentially useless.

Probable Sophos initial access vulnerability

Sophos firewall has detected the Guest account activation

Probable Sophos ip spoofing attack

IP spoofing is the creation of Internet Protocol (IP) packets which have a modified source address in order to either hide the identity of the sender, to impersonate another computer system, or both. It is a technique often used by bad actors to invoke DDoS attacks against a target device or the surrounding infrastructure.

Probable malware detected by sophos firewall

The Sophos firewall has detected a suspicious event and made some actions according to his configuration

Probable password guessing in Sophos Administrator account

Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism. An adversary may guess login credentials without prior knowledge of system or environment passwords during an operation by using a list of common passwords. Password guessing may or may not take into account the target's policies on password complexity or use policies that may lock accounts out after a number of failed attempts.

Sophos XG Advanced Threat Protection Alert

Detects when Sophos XG Firewall's Advanced Threat Protection (ATP) identifies malicious activity, including sandboxing results, malware detection, and zero-day threats. This rule triggers on ATP events indicating threat detection, malware identification, or virus findings.

Sophos XG IPS Alert Detection

Detects IPS alert triggers on Sophos XG Firewall indicating active exploitation attempts, vulnerability scanning, or known attack signatures targeting protected hosts.

Sophos XG VPN Authentication Failures

Detects multiple VPN authentication failures on Sophos XG Firewall, indicating potential brute force attacks against SSL VPN or IPsec VPN services.

Sophos detected high priority alerts

The Sophos firewall device has detected a high priority event. For the alert purpose, high priority is when log priority is: Emergency, Critical or Alert, and not part of the list of risked applications. Please see the logs attached to this alert for additional details.