Ticket types for Endpoint Detection and Response (EDR)

Coro creates tickets when it detects malicious processes that match the following detection rules:

• Command and Control
• Credential Access
• Defense Evasion
• Discovery
• Execution
• Initial Access
• Persistence
• Privilege Escalation

Command and Control

Attackers use command and control techniques to control compromised devices, steal data, spread malware, or build botnets. They send commands and receive stolen data through command and control servers. Coro detects these activities and creates tickets for the following command and control rules:

• Remote Access Tool Attack
• Suspicious Usage of a LOLBin

Remote Access Tool Attack

Coro detects remote access tools on devices. Attackers often install and activate these tools covertly to gain unauthorized network access or expose private services. Coro keeps tickets open for admin user review and automatically closes them after 48 hours.

Suspicious Usage of a LOLBin

Coro detects Living Off The Land Binaries (LOLBins) on devices. Attackers exploit these legitimate system tools to download or execute malicious activity while mimicking normal system processes. Coro keeps tickets open for admin user review and automatically closes them after 48 hours.

Credential Access

Attackers use credential access techniques to steal or misuse login credentials and gain unauthorized access to data or devices. Coro detects these attempts and creates tickets for the following credential access rules:

• Brute force attempt using a non-existent username
• Repeated brute force attempts using wrong passwords

Brute force attempt using a non-existent username

Coro detects suspicious account activity on one or more devices. This activity suggests attempts to manipulate accounts or brute force user credentials, potentially leading to unauthorized access. Coro keeps tickets open for admin user review and automatically closes them after 48 hours.

Repeated brute force attempts using wrong passwords

Coro detects suspicious account activity on one or more devices. This activity suggests attempted account manipulation or brute force attacks targeting user credentials and potentially leading to unauthorized access. Coro keeps tickets open for admin user review and automatically closes them after 48 hours.

Defense Evasion

Attackers use defense evasion techniques to avoid detection and bypass security mechanisms. Coro detects these attempts and creates tickets for the following defense evasion rules:

• Malicious UAC Bypass
• Suspicious Usage of a LOLBin
• Execution of a renamed tool

Malicious UAC Bypass

Coro detects User Account Control (UAC) bypasses on devices. Attackers use UAC bypass techniques to gain elevated system privileges. Coro keeps the tickets open for admin user review and automatically closes them after 48 hours.

Execution of a renamed tool

Coro detects renamed tools on devices. Attackers use this masquerading technique to avoid detection. Coro keeps tickets open for admin user review and automatically closes them after 48 hours.

Discovery

Attackers use discovery techniques to gather information about the devices, networks, or infrastructure they’ve infiltrated. Coro detects these actions and creates tickets for the following discovery rules:

• Unauthorized System Discovery Activity

Unauthorized System Discovery Activity

Coro detects use of the whoami command on devices. Attackers often run this command during system discovery to identify user accounts and privileges. Coro keeps tickets open for admin user review and automatically closes them after 48 hours.

Execution

Attackers use execution techniques to run malicious code on target devices or networks. Coro detects these attempts and creates tickets for the following execution rules:

• Suspicious Usage of a LOLBin
• Malicious File Download and/or Execution
• Malicious PowerShell Download from External Source
• Malicious Base64-Encoded PowerShell Command Usage

Malicious File Download and/or Execution

Coro detects use of curl commands on devices. Attackers often use curl to download and remotely execute payloads, enabling discreet transfer and execution of malicious files. Coro keeps tickets open for admin user review and automatically closes them after 48 hours.

Malicious PowerShell Download from External Source

Coro detects PowerShell execution with signs of file download attempts on devices. Attackers often exploit PowerShell’s scripting capabilities to covertly download and execute malicious payloads. Coro keeps tickets open for admin user review and automatically closes them after 48 hours.

Malicious Base64-Encoded PowerShell Command Usage

Coro detects Base64-encoded PowerShell commands on devices. Attackers often use Base64 encoding to hide malicious scripts from detection tools. Coro keeps tickets open for admin user review and automatically closes them after 48 hours.

Initial Access

Attackers use initial access techniques to gain entry into a network or device. Coro detects these attempts and creates tickets for Remote Access Tool Attacks.

Persistence

Attackers use persistence techniques to maintain long-term control of a device or network, often stealthily. Coro detects these actions and creates tickets for the following persistence rules:

• Malicious Scheduled Task Creation/Execution
• Modification of User Accounts in Elevated Groups

Malicious Scheduled Task Creation/Execution

Coro detects scheduled task creation or execution on devices, which might indicate that attackers are attempting to gain persistence or execute malicious code at predetermined times. Coro keeps tickets open for admin user review and automatically closes them after 48 hours.

Modification of User Accounts in Elevated Groups

Coro detects suspicious account activity on devices. This activity suggests attempted account manipulation or brute force attacks targeting user credentials, potentially leading to unauthorized access. Coro keeps tickets open for admin user review and automatically closes them after 48 hours.

Password spray attack involving 200 login attempts

Coro detects suspicious account activity on devices. This activity suggests attempted account manipulation or brute force attacks targeting user credentials, potentially leading to unauthorized access. Coro keeps tickets open for admin user review and automatically closes them after 48 hours.

Password spray attack involving 100 login attempts

Coro detects suspicious account activity on devices. This activity suggests attempted account manipulation or brute force attacks targeting user credentials, potentially leading to unauthorized access. Coro keeps tickets open for admin user review and automatically closes them after 48 hours.

Privilege Escalation

Attackers use privilege escalation techniques to gain higher-level permissions on a device or network after initial access. Coro detects these attempts and creates tickets for the following privilege escalation events:

• Elevated group adding and removal

Elevated group adding and removal

Coro detects suspicious account activity on devices. This activity suggests attempted account manipulation or brute force attacks targeting user credentials, potentially leading to unauthorized access. Coro keeps tickets open for admin user review and automatically closes them after 48 hours.