Automatic Reaction for Threat Emulation events

DR_74 · ‎2017-09-27

Hi,

I try to create an automatic reaction (email) when a Threat Emulation event occures.

I can generate event (as I try the demo malware on theatwiki web site) but looks like it never sends email to notify the admin.

What would be the correct event definition in the SmartEvent Policy so that I can get an email notification?

kind regards

Nisse_Blankenda · ‎2018-03-26

I have the same question. A customer want's to receive an email if a malicous file is detected by Threat Emulation.

I did create a automatic reaction and a custom event as we are running SmartEvent with a multi customer MDS.

The event definition is;

But when a malicious file is detected, there is no e-mail sent.

PhoneBoy · ‎2018-03-26

It would be helpful to see what log entries are showing up in your gateways for events that are not triggering.

You probably only need to match on the Verdict, not on the domain or the log_id.

Nisse_Blankenda · ‎2018-04-09

Hi Dameon,

As we are running in an MDS wich has multiple cusomers connected I have to filter on Domain.

Here are some of the log entrys;

Time

Blade

Action

Type

Interface

Origin

Severity

Source User Name

Source

Destination

Protection Type

Protection Name

Vulnerable OS

File Name

Email Subject

Resource

Description

Log ID

Id

Sequencenum

Duplicated

Product Family

Marker

Log Server Origin

Orig Log Server Ip

Domain

Lastupdatetime

Lastupdateseqnum

Confidence Level

Rounded Sent Bytes

Rounded Bytes

Stored

Rounded Received Bytes

Destination Country

IP Protocol

Destination Port

Malware Rule ID

Scope

File Type

File Size (Bytes)

File MD5

File SHA1

File Sha256

Verdict

Analyzed On

Sender

Recipient

Service

Malicious Activity Determined By

Packet Capture Unique Id

Packet Capture

Corename

Description

Malware Action

3/30/2018 12:47:53 PM

Threat Emulation

Prevent

Log

xxx

Critical

xxx

SMTP Emulation

Malicious archive file

Summary Report (see report for more information)

1EBF4.zip

PP Copy

xxx

4000

e07d5c82-65fb-bf07-d175-8b6736825846

2147483647

1

Threat

@A@@B@1522360746@C@2873831

xxx

1,52241E+12

2147483647

High

0

TRUE

0

Netherlands

TCP (6)

25

F37A30BF-20E7-D041-AAA7-6D0A02BBF7B7

xxx

zip

298B

b71b0c34c5c341842ce502dd9d70bc46

90a758530462cc5a3c5d93ae797ad76532c1b36d

f2e45cc2fc6a989b8aa9e9796a7ef6bae3f51e8bf1806705727bb0aa3e9a4023

Malicious

Check Point Threat Cloud

sheri.mackley@nebraskaballoonclub.com

xxx

smtp (TCP/25)

Win8.1 64b Office 2013 Adobe 11: archive.

{D1758B67-3682-5846-825C-7DE007BFFB65}00000000-0000-0000-0000-000000000000

Packet Capture

http://127.0.0.1:8210/solr/other_2018-03-30T00-00-00

Malicious files: 29ADC7.url Â

Behaves like a known malware ( Generic.MALWARE.acce ) Malware detected ( Trojan.Downloader.JUED )

3/30/2018 12:15:12 PM

Threat Emulation

Prevent

Log

xxx

Critical

xxx

SMTP Emulation

Malicious archive file

Summary Report (see report for more information)

4201.zip

Copy

xxx

4000

534f52b4-6d11-8385-51db-b7c53246784f

2147483647

1

Threat

@A@@B@1522360746@C@2637642

xxx

1,5224E+12

2147483647

High

0

TRUE

0

Netherlands

TCP (6)

25

F37A30BF-20E7-D041-AAA7-6D0A02BBF7B7

xxx

zip

297B

6f2fdc68b2945d52bf1e1f1cfa24fcb9

f077b1fa8c6129e6f4dd6bfba96b37361a8b62e3

1f01e07642f0f1aa1ebcf6805120f02763ea52e905f4bd49119a402bf1b46752

Malicious

Check Point Threat Cloud

nina.mccloy@bowmanmediaonline.com

xxx

smtp (TCP/25)

Win8.1 64b Office 2013 Adobe 11: archive.

{51DBB7C5-3246-784F-B452-4F538583116D}00000000-0000-0000-0000-000000000000

Packet Capture

http://127.0.0.1:8210/solr/other_2018-03-30T00-00-00

Malicious files: 9DFBE.url Â

Behaves like a known malware ( Generic.MALWARE.780c ) Malware detected ( Trojan.Downloader.JUED )

3/29/2018 7:17:25 AM

Threat Emulation

Prevent

Log

xxx

Critical

xxx

SMTP Emulation

Exploited doc document

Win8.1 64b Office 2013 Adobe 11

Purchase Order #2324-18-29-3.doc

Quotation Request / Frecht (Thailand) Co. Ltd.

xxx

4000

48581e89-502c-8683-226f-477f84597048

2147483647

1

Threat

@A@@B@1522274347@C@546522

xxx

1,5223E+12

2147483647

High

0

TRUE

0

Netherlands

TCP (6)

25

F37A30BF-20E7-D041-AAA7-6D0A02BBF7B7

xxx

doc

713.6KB

21872ebb9ced7787a8647143004ab565

c5f2a212f3349675a11669f5a73d428082b234d8

78bb5e4627fddb52a7120f558420890b2e42b3dfab4b0d5f92768bf987664cd3

Malicious

Check Point Threat Cloud

ashley.jensen@frecht.com

xxx

smtp (TCP/25)

Win8.1 64b Office 2013 Adobe 11: local cache.

{226F477F-8459-7048-891E-584883862C50}6c453c9b-20f7-471a-956c-3198a868dc92 {226F477F-8459-7048-891E-584883862C50}00000000-0000-0000-0000-000000000000

Packet Capture

http://127.0.0.1:8210/solr/other_2018-03-29T00-00-00

Behaves like a known malware ( Generic.MALWARE.1f29 ) Malicious Filesystem Activity Malicious Registry Activity Malware activity observed ( HEUR:Trojan.Script.Agent.gen ) Malware detected ( VB:Trojan.Agent.CWSP Malware signature matched ( Malicious Binary.TC.cdlf ) Unexpected Process Creation VB:Trojan.Agent.CWSP VB:Trojan.Agent.CWSP )

3/29/2018 7:17:24 AM

Threat Emulation

Prevent

Log

xxx

Critical

xxx

SMTP Emulation

Exploited doc document

Win8.1 64b Office 2013 Adobe 11

Profile.doc

Quotation Request / Frecht (Thailand) Co. Ltd.

xxx

4000

f7c2be8a-bd52-aa86-5618-0978f6ba9f41

2147483647

1

Threat

@A@@B@1522274347@C@546497

xxx

1,5223E+12

2147483647

High

0

TRUE

0

Netherlands

TCP (6)

25

F37A30BF-20E7-D041-AAA7-6D0A02BBF7B7

xxx

doc

713.6KB

21872ebb9ced7787a8647143004ab565

c5f2a212f3349675a11669f5a73d428082b234d8

78bb5e4627fddb52a7120f558420890b2e42b3dfab4b0d5f92768bf987664cd3

Malicious

Check Point Threat Cloud

ashley.jensen@frecht.com

xxx

smtp (TCP/25)

Win8.1 64b Office 2013 Adobe 11: local cache.

{56180978-F6BA-9F41-8ABE-C2F786AA52BD}6c453c9b-20f7-471a-956c-3198a868dc92 {56180978-F6BA-9F41-8ABE-C2F786AA52BD}00000000-0000-0000-0000-000000000000

Packet Capture

http://127.0.0.1:8210/solr/other_2018-03-29T00-00-00

Behaves like a known malware ( Generic.MALWARE.1f29 ) Malicious Filesystem Activity Malicious Registry Activity Malware activity observed ( HEUR:Trojan.Script.Agent.gen ) Malware detected ( VB:Trojan.Agent.CWSP Malware signature matched ( Malicious Binary.TC.cdlf ) Unexpected Process Creation VB:Trojan.Agent.CWSP VB:Trojan.Agent.CWSP )

3/29/2018 6:21:03 AM

Threat Emulation

Prevent

Log

xxx

Critical

xxx

SMTP Emulation

Exploited doc document

Win8.1 64b Office 2013 Adobe 11

Purchase Order #2324-18-29-3.doc

Quotation Request / Frecht (Thailand) Co. Ltd.

xxx

4000

9dba0e99-a664-4938-49a1-4e4b7d68fb48

2147483647

1

Threat

@A@@B@1522274347@C@440927

xxx

1,5223E+12

2147483647

High

0

TRUE

0

Netherlands

TCP (6)

25

F37A30BF-20E7-D041-AAA7-6D0A02BBF7B7

xxx

doc

713.6KB

21872ebb9ced7787a8647143004ab565

c5f2a212f3349675a11669f5a73d428082b234d8

78bb5e4627fddb52a7120f558420890b2e42b3dfab4b0d5f92768bf987664cd3

Malicious

Check Point Threat Cloud

ashley.jensen@frecht.com

xxx

smtp (TCP/25)

Win8.1 64b Office 2013 Adobe 11: local cache.

{49A14E4B-7D68-FB48-990E-BA9D384964A6}6c453c9b-20f7-471a-956c-3198a868dc92 {49A14E4B-7D68-FB48-990E-BA9D384964A6}00000000-0000-0000-0000-000000000000

Packet Capture

http://127.0.0.1:8210/solr/other_2018-03-29T00-00-00

Behaves like a known malware ( Generic.MALWARE.1f29 ) Malicious Filesystem Activity Malicious Registry Activity Malware activity observed ( HEUR:Trojan.Script.Agent.gen ) Malware detected ( VB:Trojan.Agent.CWSP Malware signature matched ( Malicious Binary.TC.cdlf ) Unexpected Process Creation VB:Trojan.Agent.CWSP VB:Trojan.Agent.CWSP )

3/29/2018 6:18:07 AM

Threat Emulation

Prevent

Log

xxx

Critical

xxx

SMTP Emulation

Exploited doc document

Win8.1 64b Office 2013 Adobe 11

Profile.doc

Quotation Request / Frecht (Thailand) Co. Ltd.

xxx

4000

09ac5696-b85a-b623-63be-6f688dee5d40

2147483647

1

Threat

@A@@B@1522274347@C@440895

xxx

1,5223E+12

2147483647

High

0

TRUE

0

Netherlands

TCP (6)

25

F37A30BF-20E7-D041-AAA7-6D0A02BBF7B7

xxx

doc

713.6KB

21872ebb9ced7787a8647143004ab565

c5f2a212f3349675a11669f5a73d428082b234d8

78bb5e4627fddb52a7120f558420890b2e42b3dfab4b0d5f92768bf987664cd3

Malicious

Check Point Threat Cloud

ashley.jensen@frecht.com

xxx

smtp (TCP/25)

Win8.1 64b Office 2013 Adobe 11: cloud emulation.

{63BE6F68-8DEE-5D40-9656-AC0923B65AB8}6c453c9b-20f7-471a-956c-3198a868dc92 {63BE6F68-8DEE-5D40-9656-AC0923B65AB8}00000000-0000-0000-0000-000000000000

Packet Capture

http://127.0.0.1:8210/solr/other_2018-03-29T00-00-00

Behaves like a known malware ( Generic.MALWARE.1f29 ) Malicious Filesystem Activity Malicious Registry Activity Malware activity observed ( HEUR:Trojan.Script.Agent.gen ) Malware detected ( VB:Trojan.Agent.CWSP Malware signature matched ( Malicious Binary.TC.cdlf ) Unexpected Process Creation VB:Trojan.Agent.CWSP VB:Trojan.Agent.CWSP )

3/26/2018 8:38:30 AM

Threat Emulation

Prevent

Log

xxx

Critical

xxx

SMTP Emulation

Exploited rtf document

Win8.1 64b Office 2013 Adobe 11

Verificatieverslag-171-18-0009-NVWA-585-Verificatieverslag-Instandhouding-ELFPO-POP3 -Stoutjesdijk- (4).rtf

FW: NVWA

xxx

4000

8c913eb2-cc4e-82d1-2cd5-8be7915dee4c

2147483647

1

Threat

@A@@B@1522015143@C@1074940

xxx

1,52205E+12

2147483647

High

0

TRUE

0

Netherlands

TCP (6)

25

F37A30BF-20E7-D041-AAA7-6D0A02BBF7B7

xxx

rtf

12.2MB

75e87f79ba69f66b57fb93441d469817

fc5f4b6ffbe655b67865fde3df3cd912f327e0a3

dd14b14a116b6d2f0f40e4f0dc237a15037ed0482a551766660426c45233c31e

Malicious

Check Point Threat Cloud

cha.stoutjesdijk@hetnet.nl

xxx

smtp (TCP/25)

Win8.1 64b Office 2013 Adobe 11: local cache.

{2CD58BE7-915D-EE4C-B23E-918CD1824ECC}6c453c9b-20f7-471a-956c-3198a868dc92 {2CD58BE7-915D-EE4C-B23E-918CD1824ECC}00000000-0000-0000-0000-000000000000

Packet Capture

http://127.0.0.1:8210/solr/other_2018-03-26T00-00-00

Malicious Registry Activity

3/26/2018 8:38:25 AM

Threat Emulation

Prevent

Log

xxx

Critical

xxx

SMTP Emulation

Exploited rtf document

Win8.1 64b Office 2013 Adobe 11

Verificatieverslag-171-18-0009-NVWA-585-Verificatieverslag-Instandhouding-ELFPO-POP3 -Stoutjesdijk- (4).rtf

FW: NVWA

xxx

4000

c4b4a0af-c85f-5737-1bbf-1c3ee4191c4f

2147483647

1

Threat

@A@@B@1522015143@C@1074159

xxx

1,52205E+12

2147483647

High

0

TRUE

0

Netherlands

TCP (6)

25

F37A30BF-20E7-D041-AAA7-6D0A02BBF7B7

xxx

rtf

12.2MB

75e87f79ba69f66b57fb93441d469817

fc5f4b6ffbe655b67865fde3df3cd912f327e0a3

dd14b14a116b6d2f0f40e4f0dc237a15037ed0482a551766660426c45233c31e

Malicious

Check Point Threat Cloud

cha.stoutjesdijk@hetnet.nl

xxx

smtp (TCP/25)

Win8.1 64b Office 2013 Adobe 11: cloud emulation.

{1BBF1C3E-E419-1C4F-AFA0-B4C437575FC8}6c453c9b-20f7-471a-956c-3198a868dc92 {1BBF1C3E-E419-1C4F-AFA0-B4C437575FC8}00000000-0000-0000-0000-000000000000

Packet Capture

http://127.0.0.1:8210/solr/other_2018-03-26T00-00-00

Malicious Registry Activity

3/18/2018 6:39:58 PM

Threat Emulation

Prevent

Log

xxx

Critical

xxx

SMTP Emulation

Exploited rtf document

Win8.1 64b Office 2013 Adobe 11

INV 001.doc

Invoice Information

xxx

4000

a9039db6-6ede-5c04-3792-7a45bb20974c

2147483647

1

Threat

@A@@B@1521327544@C@1788237

xxx

1,52139E+12

2147483647

Low

0

TRUE

0

Netherlands

TCP (6)

25

F37A30BF-20E7-D041-AAA7-6D0A02BBF7B7

xxx

rtf

93.2KB

6fbada941589b58f579c5fbabf7e3f80

9ecadee568e30b7f97bf649d1cac13b7b235f508

676f26a3d9a76120dc702f16b43338c021afe81a0f113be549714b5ce647f1bd

Malicious

Check Point Threat Cloud

bounces+i-dmunfr-j6dcsholzypaw2@bounces.elasticemail.net

xxx

smtp (TCP/25)

Win8.1 64b Office 2013 Adobe 11: cloud emulation.

{37927A45-BB20-974C-B69D-03A9045CDE6E}6c453c9b-20f7-471a-956c-3198a868dc92 {37927A45-BB20-974C-B69D-03A9045CDE6E}00000000-0000-0000-0000-000000000000

Packet Capture

[not a shard request]

File type reclassified to: rtf.

[low confidence] Behaves like a known malware ( Generic.MALWARE.6b93 )

3/16/2018 7:48:11 PM

Threat Emulation

Prevent

Log

xxx

Critical

xxx

SMTP Emulation

Exploited rtf document

Win8.1 64b Office 2013 Adobe 11

Statements.doc

Statement & Invoices

xxx

4000

0da539a6-52af-8d93-16f4-189bb5c33d43

2147483647

1

Threat

@A@@B@1521154746@C@5055484

xxx

1,52123E+12

2147483647

High

0

TRUE

0

Netherlands

TCP (6)

25

F37A30BF-20E7-D041-AAA7-6D0A02BBF7B7

xxx

rtf

375.4KB

19b25ae6135b5b0fc9960783bf5f5e72

8eb27bd75ed10489e87fe5d6d50a75fcaafc24c8

1ce234e5d160d628a1b364def57c04fd75014038b504a6a91384c5f58284f7c3

Malicious

Check Point Threat Cloud

anne.hameroff@livemadellc.com

xxx

smtp (TCP/25)

Win8.1 64b Office 2013 Adobe 11: local cache.

{16F4189B-B5C3-3D43-A639-A50D938DAF52}6c453c9b-20f7-471a-956c-3198a868dc92 {16F4189B-B5C3-3D43-A639-A50D938DAF52}00000000-0000-0000-0000-000000000000

Packet Capture

[not a shard request]

File type reclassified to: rtf.

Behaves like a known malware ( Generic.MALWARE.0bbf ) Malware signature matched ( Malicious Binary.TC.ujl )

3/16/2018 7:36:55 PM

Threat Emulation

Prevent

Log

xxx

Critical

xxx

SMTP Emulation

Exploited rtf document

Win8.1 64b Office 2013 Adobe 11

Statements.doc

Statement & Invoices

xxx

4000

70edf3b1-91eb-bc65-3d46-6c1f6e30794b

2147483647

1

Threat

@A@@B@1521154746@C@5037448

xxx

1,52123E+12

2147483647

High

0

TRUE

0

Netherlands

TCP (6)

25

F37A30BF-20E7-D041-AAA7-6D0A02BBF7B7

xxx

rtf

375.4KB

19b25ae6135b5b0fc9960783bf5f5e72

8eb27bd75ed10489e87fe5d6d50a75fcaafc24c8

1ce234e5d160d628a1b364def57c04fd75014038b504a6a91384c5f58284f7c3

Malicious

Check Point Threat Cloud

anne.hameroff@livemadellc.com

xxx

smtp (TCP/25)

Win8.1 64b Office 2013 Adobe 11: cloud emulation.

{3D466C1F-6E30-794B-B1F3-ED7065BCEB91}6c453c9b-20f7-471a-956c-3198a868dc92 {3D466C1F-6E30-794B-B1F3-ED7065BCEB91}00000000-0000-0000-0000-000000000000

Packet Capture

[not a shard request]

File type reclassified to: rtf.

Behaves like a known malware ( Generic.MALWARE.0bbf ) Malware signature matched ( Malicious Binary.TC.ujl )

PhoneBoy · ‎2018-04-13

Perhaps instead of filtering on Domain, you can try filtering on Origin, which would correspond to a gateway in a given domain.

It's possible you may also need to engage with the TAC.

Nisse_Blankend1 · ‎2018-04-23

Hi,

I’ll try to filter on origin and if that doesn’t help I will open a TAC case.

Thank you for your help so far

Are you a member of CheckMates?

Automatic Reaction for Threat Emulation events