The release 4.4 adds six new rules and one dashboard to the Security Threat Monitoring package to help you monitor potential distributed denial of service, network denial of service, log enumeration, suspicious use of “powercfg” command to manipulate power settings, possible abuse of cloud management services and suspicious use of cloud administration commands.

The release 4.3 adds 4 new rules to the Security Threat Monitoring package to help you monitor your Windows and Linux environments. Checkout our new video series titled "Mastering ArcSight Series" on You Tube - https://www.youtube.com/playlist?list=PLN3aXmWqzjnGrnbr95kCs_J_SfxlPREuk.

The release 4.2 rebrands Galaxy Threat Acceleration Program to ArcSight Threat Acceleration Program (GTAP to ATAP) and exchanges all CyberRes references for ArcSight. Additionally, 4.2 adds new content to the Security Threat Monitoring and Threat Intelligence Platform packages to help you monitor commThe release 4.4 adds six new rules and one dashboard to the Security Threat Monitoring package to help monitor network denial of service, log enumeration, suspicious use of “powercfg” command to manipulate power settings, possible abuse of cloud management services and suspicious use of cloud administration commands., Suspicious API activity, and communication to malvertising publishing domains/IPs.

The release 4.1 contains 12 new rules in the Security Threat Monitoring package to detect more cyber security attacks for the Windows Operating System, and added 3 new rules in the Threat Intelligence Platform package with very high confidence, and an active channel to display the very high confidence alerts. It also updated 8 rules.

"ArcSight ESM Default Content 4.0" release is a milestone release for the entire ArcSight portfolio.
In this release, the primary focus has been to support "CyberRes Galaxy Threat Acceleration Program (GTAP)" version 2.0. This is done through the "Threat Intelligence Platform" sub-package of the ESM Default Content package.

As you may read more from GTAP 2.0 Release Notes, ArcSight's Threat Intelligence support that is built-into ESM and the Default Content has been significantly improved. The most signifant change has been the introduction of many additional fields to have a richer feed with more SOC-ready context.

As such, Active Lists hosting the realtime IoC information, that are received from the realtime threat intel feed, as well as the rules/filters and other resources that utilize these active lists have been considerably updated.

As this was a significant change in the way the ESM resources worked, "deployment of ESM Default Content 4.0" now requires a couple extra steps that are specific to this release.

Please read this document in full, and preferably watch the following video, to get yourself acquantied with the process.

System Requirements

========================

Micro Focus ArcSight ESM 7.2 or above.

-------------------------------------------------------------------------------

To install this package:

===========================

The zip file contains three files: package arb file, a signature of the arb file, and release note.

Open Text provides a digital public key to enable you to verify that the signed software you received is indeed from Open Text and has not been manipulated in any way by a third party. Visit the following site for information and instructions:

https://support.microfocus.com/kb/doc.php?id=7025140

Perform the following steps in the ArcSight Console.

1. Go to the ArcSight Console.

2. Click on Packages

3. Click Import

4. Select package arb file from the zip file

5. Follow the prompts to import and install this package

NOTE: If you customized standard resources in the resource's original location, back up the resources to an .arb file (exclude related resources) before you upgrade. If you copied the resources to a custom group and then customized them, the upgrade does not impact the custom group.

To upgrade this package from version 3.x

1. Delete /ArcSight Foundation/Threat Intelligence Platform.
Make sure all resources, especially active lists, have been removed from /ArcSight Foundation/Threat Intelligence Platform.
2. Restart the ESM manager (/opt/arcsight/services/init.d/arcsight_services stop manager, then start manager).
Note: If you do not restart the manager, you will receive an error: Install Failed: "Invalid field name: creatorOrg"
3. Go to the ArcSight Console.
4. Click Packages.
5. Click Import.
6. Select the package .arb from the .zip file.
7. Follow the prompts to import and install this package.
8.After the initial install finishes, right-click Threat Intelligence Platform and click Install Package.

To upgrade this package from 4.0

It is not required to delete the existing package.

1. Go to the ArcSight Console.
2. Click Packages.
3. Click Import.
4. Select the package .arb from the .zip file.
5. Follow the prompts to import and install this package.

To uninstall:

Right-click package from ArcSight Console, then selects "Uninstall Package".

Details in the recent releases

In the release version 4.4 following MITRE IDs associated rules, and dashboard were added:

• T1653-Power Settings (New)
• T1654-Log Enumeration (New)
• T1021-Remote Services (New)
• T1651-Cloud Administration Command (New)
• T1498-Network Denial of Service (Updated)

Following resources were added:

/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Suspicious Powercfg Execution To Change Lock Screen Timeout

/All Rules/ArcSight Foundation/Security Threat Monitoring/Network Monitoring/Potential Distributed DoS

/All Rules/ArcSight Foundation/Security Threat Monitoring/Cloud Monitoring/Cloud Administration Commands Executed

/All Rules/ArcSight Foundation/Security Threat Monitoring/Cloud Monitoring/Google Cloud Services Accessed Remotely

/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Logs Enumerated in Windows

New Dashboard - /All Dashboards/Security Threat Monitoring/Network Monitoring/DoS Activity

In the release version 4.3 following MITRE IDs were added or rules were added to existing MITRE IDs:

T1036.008-Masquerade File Type
T1016.002-Wi-Fi Discovery
T1652-Device Driver Discovery
T1556.008-Network Provider DLL

Following resources were added:

/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Device Driver Discovery
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Network Provider DLL Modified Using Registry
/All Rules/ArcSight Foundation/Security Threat Monitoring/Application Monitoring/Process Executed with non-Executable Extension
/All Rules/ArcSight Foundation/Security Threat Monitoring/Network Monitoring/Possible WIFI Discovery

Following resources were updated:

/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Browser Information Discovery
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Possible Exfiltration to Text Storage Sites

In the release version 4.2 following MITRE IDs were added or rules were added to existing MITRE IDs

T1027.010-Command Obfuscation
T1567.003-Exfiltration to Text Storage Sites
T1059.009-Cloud API
T1583.008-Malvertising

Following resources were added:

/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Command Obfuscation Using PowerShell
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Possible Exfiltration to Text Storage Sites
/All Rules/ArcSight Foundation/Security Threat Monitoring/Cloud Monitoring/Suspicious AWS Cloud API Activity Detected
/All Rules/ArcSight Foundation/Threat Intelligence Platform/Dangerous Browsing/Outbound Communication to Malvertising Publishing Address
/All Rules/ArcSight Foundation/Threat Intelligence Platform/Dangerous Browsing/Outbound Communication to a Malvertising Publishing Domain

Following resources were updated:

/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Linux Auditd Kernel Module Loaded in Critical Server
/All Rules/ArcSight Foundation/Security Threat Monitoring/Network Monitoring/System Network Connections Discovery
/All Rules/ArcSight Foundation/Threat Intelligence Platform/High Confidence Alerts/ATAP Plus Very High Confidence Alerts with Suspicious File Hash
/All Rules/ArcSight Foundation/Threat Intelligence Platform/High Confidence Alerts/ATAP Plus Very High Confidence Alerts to Suspicious Source
/All Rules/ArcSight Foundation/Threat Intelligence Platform/ATAP Connector Health/No Update from ATAP Connector
/All Rules/ArcSight Foundation/Threat Intelligence Platform/High Confidence Alerts/ATAP Plus High Confidence Alerts to Suspicious Source
/All Rules/ArcSight Foundation/Threat Intelligence Platform/ATAP Connector Health/Track ATAP Connector Type
/All Rules/ArcSight Foundation/Threat Intelligence Platform/High Confidence Alerts/ATAP Plus High Confidence Alerts with Suspicious File Hash
/All Rules/ArcSight Foundation/Threat Intelligence Platform/ATAP Connector Health/Error in ATAP Connector Service Message
/All Rules/ArcSight Foundation/Threat Intelligence Platform/ATAP Connector Health/Track ATAP Connector Service Message
/All Rules/ArcSight Foundation/Threat Intelligence Platform/ATAP Connector Health/Track ATAP Connector Update Count
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/Internal Domain Found in Suspicious Domains List
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/Suspicious Addresses List
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/Suspicious Domain List
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/Suspicious Email List
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/Suspicious Hash List
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/Suspicious URL List
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/User Defined Reputation Data/Additional Suspicious Addresses
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/User Defined Reputation Data/Additional Suspicious Domain
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/User Defined Reputation Data/Additional Suspicious Email
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/User Defined Reputation Data/Additional Suspicious Hash
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/User Defined Reputation Data/Additional Suspicious URL

In the release version 4.1 following MITRE IDs were added or rules were added to existing MITRE IDs

T1003.002-Security Account Manager
T1053.005-Scheduled Task
T1070.001-Clear Windows Event Logs
T1070.009-Clear Persistence
T1486-Data Encrypted for Impact
T1489-Service Stop
T1490-Inhibit System Recovery
T1546.016-Installer Packages
T1552.001-Credentials In Files
T1555-Credentials from Password Stores

Following resources were added:

/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Credentials Gathered using Mimikatz Tool
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/SystemRestore Task Disabled Using Schtasks
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/File Encrypted Using Encryptor Tool
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Credentials In Files
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Specific Processes Killed Using PowerShell Command
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Spearphishing via Whatsapp
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Disable Windows Recovery Using BCDedit Tool
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Deletion of Active USN Change Journal Using Fsutil
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Delete Backups Using WBadmin
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Credential Dumping Using LaZagne
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Event Log Deleted Using Wevtutil Tool
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Program Install
/All Rules/ArcSight Foundation/Threat Intelligence Platform/High Confidence Alerts/GTAP Plus Very High Confidence Alerts with Suspicious File Hash
/All Rules/ArcSight Foundation/Threat Intelligence Platform/High Confidence Alerts/GTAP Plus Very High Confidence Alerts to Suspicious Source
/All Rules/ArcSight Foundation/Threat Intelligence Platform/Suspicious Email/Email Sent To Suspicious Address
/All Rules/ArcSight Foundation/Threat Intelligence Platform/High Confidence Alerts/GTAP Plus High Confidence Alerts to Suspicious Source
/All Rules/ArcSight Foundation/Threat Intelligence Platform/GTAP Connector Health/Track GTAP Connector Type
/All Active Channels/ArcSight Foundation/Threat Intelligence Platform/Very High Confidence Alerts

Following rules were updated:

/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Chained Rule - Inhibit System Recovery
/All Rules/ArcSight Foundation/Threat Intelligence Platform/Suspicious Email/Email Sent To Suspicious Address
/All Rules/ArcSight Foundation/Threat Intelligence Platform/High Confidence Alerts/GTAP Plus High Confidence Alerts to Suspicious Source
/All Rules/ArcSight Foundation/Threat Intelligence Platform/GTAP Connector Health/Track GTAP Connector Type
/All Rules/ArcSight Foundation/Threat Intelligence Platform/High Confidence Alerts/GTAP Plus High Confidence Alerts with Suspicious File Hash
/All Rules/ArcSight Foundation/Threat Intelligence Platform/Dangerous Browsing/Dangerous Browsing to a Suspicious URL

In the release version 4.0, following MITRE IDs were added or rules were added to existing MITRE IDs

T1552.006 T1553.005

Following new rules are added:

• /All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Credentials in Group Policy Preferences
• /All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Mark-of-the-Web Bypass Using PowerShell
• /All Rules/ArcSight Foundation/Threat Intelligence Platform/GTAP Connector Health/Track GTAP Connector Update Count

Following rules were updated:

• /All Rules/ArcSight Foundation/Security Threat Monitoring/Malware Monitoring/Possible Ransomware Detected
• /All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Large amount of file modifications in users directories

Fields were expended from 15 to 37 in the following active lists:

/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/Suspicious Addresses List
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/Suspicious Domain List
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/Suspicious Email List
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/Suspicious Hash List
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/Suspicious URL List

Following dashboards were added:

• /All Dashboards/ArcSight Foundation/Threat Intelligence Platform/Data Feed Overview
• /All Dashboards/ArcSight Foundation/Threat Intelligence Platform/TI Confidence Comparison - Open Source vs Galaxy-curated
• /All Dashboards/ArcSight Foundation/Threat Intelligence Platform/Top Malware and CVE

Following dashboards were updated:

• /All Dashboards/ArcSight Foundation/Threat Intelligence Platform/GTAP Health Status
• /All Dashboards/ArcSight Foundation/Threat Intelligence Platform/Threat Intelligence Security Incidents Overview
• /All Dashboards/ArcSight Foundation/Threat Intelligence Platform/TI Confidence Details
• /All Dashboards/ArcSight Foundation/Threat Intelligence Platform/Top Malware Types

Sample replay events

This zip file contains four files: two replay events, one arb package, and readme.

In order to trigger/test rules in the default content, you need to:

1) Make sure to install 4.x package before installing the package in this zip file for testing rules in the Threat Intelligence Platform package

2) Enable rules which you want to test

ESM 7.2 and above

Threat Intelligence Platform package requires ThreatHub Connector