Exploit Content Pack

Alarms

• Exploit – Attempt on Internal Host
• Exploit – MountMgr Exploit Attempt
• Exploit - WannaCry Events Detected

Reports

Gives information on all exploit events occurring on the network or all activity occurring on specific resources that have possibly been compromised.

• Exploit – Potentially Compromised Hosts
• Exploit – Potential Exploit Report

Views

• Exploit Overview
• Potentially Exploited Device Activity
• Potential Exploit Activity
• Potentially Exploited Host Activity

Correlation Rules

• Exploit – FTP Login after Possible Exploit
• Exploit – Increasing Number of Exploit Events Occurring on an Internal Host
• Exploit – SSH Login after Possible Exploit
• Exploit – Shellshock Exploit Attempt
• Exploit – VoIP Exploit on a local Host
• Exploit – Attempted Kerberos Ticket Manipulation
• Exploit – Exploits on Potentially Compromised Hosts

Watchlists

• Exploit – Potentially Compromised Hosts (IP Address)
• Exploit – Potentially Compromised Hosts (Host)
• Exploit - WannaCry SigIDs