EBA: Web Device Using Lateral Movement Protocols on events, which are detected by the Local system
The QRadar® User Entity Behavior Analytics (UEBA) app supports use cases based on rules for certain behavioral anomalies.
EBA: Web Device Using Lateral Movement Protocols on events, which are detected by the Local system
Enabled by default
True
Default senseValueDestination
0
Default senseValueSource
10
Description
Detects potential lateral movement activity where a host that previously communicated over standard web ports begins communicating over common lateral movement protocols. The rule triggers when lateral movement port activity is observed at least 20 times within 30 minutes after web port activity from the same source IP.
Support rules
- BB:UBA : Common Log Source Filters
- BB:UBA : Lateral Movement Ports
- BB:PortDefinition : Web Ports
Log source types
Firewall logs, Network Flow (NetFlow), EDR telemetry