{"id":23484,"date":"2024-11-02T20:51:25","date_gmt":"2024-11-02T16:51:25","guid":{"rendered":"https:\/\/me-en.kaspersky.com\/blog\/siem-update-q3-2024\/23484\/"},"modified":"2024-11-02T20:51:25","modified_gmt":"2024-11-02T16:51:25","slug":"siem-update-q3-2024","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/siem-update-q3-2024\/23484\/","title":{"rendered":"Kaspersky SIEM: early threat detection and other improvements"},"content":{"rendered":"

Clearly, the sooner malicious actions come to the attention of security solutions and experts, the more effectively they\u2019re able to minimize, or even prevent damage. Therefore, while working on new detection rules for our SIEM system named the , we pay special attention to identifying attackers\u2019 activity at the very initial stage of an attack, when they try to collect information about infrastructure. We\u2019re talking about activity related to the discovery tactics<\/a> according to the Enterprise Matrix MITRE ATT&CK Knowledge Base classification.<\/p>\n

Modern attackers are increasingly paying attention to containerization infrastructure, which is where rather dangerous vulnerabilities are sometimes found. For example, our May report on exploits and vulnerabilities<\/a> describes the CVE-2024-21626 vulnerability, which allows for a container escape. That\u2019s why in our Q3 2024 SIEM system update, among the rules for identifying atypical behavior that may indicate attacker activity at the initial data collection stage, we\u2019ve added detection rules that catch (i) attempts to collect data on the containerization infrastructure, and (ii) traces of various attempts to manipulate the containerization system itself.<\/p>\n

This was done by adding detection rules R231, R433, and R434, which are already available to Kaspersky Unified Monitoring and Analysis Platform users through the rule update system. In particular, they\u2019re used to detect and correlate the following events:<\/p>\n