Classification:

attack

Tactic:

TA0002-execution

Technique:

T1204-user-execution

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects an unusual spike in bad-rated application events from a single computer.

Strategy

This rule monitors the Delinea Privilege Manager events to detect an unusual spike in bad-rated application events from a single computer.

Triage and Response

1. Review the logs of bad-rated application events from a computer name: {{@ComputerName}}({{@_ComputerId}}).
2. Analyze the list of installed and executed applications.
3. Quarantine or isolate affected systems to mitigate potential risks.
4. Update application control policies to block the identified applications with bad security ratings.