Multiple External EDR Alerts by Host

This detection rule aggregates alert data from various external EDR solutions such as Crowdstrike Falcon, SentinelOne, and Microsoft 365 Defender to identify hosts generating multiple distinct alerts. The rule aims to highlight potentially compromised systems where a single host triggers numerous security alerts, suggesting a coordinated attack or widespread infection. By focusing on the quantity and diversity of alerts originating from a single endpoint, analysts can efficiently prioritize their investigation efforts and respond to the most critical threats first. This rule is designed to reduce alert fatigue and improve the efficiency of security operations teams by surfacing hosts with a high probability of compromise based on the alerts generated by external EDR systems.

Attack Chain

1. Initial access is achieved via an unknown method, possibly exploiting a vulnerability or through social engineering.
2. Malware is deployed on the host, evading initial detection mechanisms.
3. The malware executes, performing malicious activities such as reconnaissance or privilege escalation.
4. The EDR solution detects suspicious behavior based on predefined signatures and generates an alert.
5. The attacker attempts lateral movement to other systems on the network, triggering additional alerts on the initially compromised host and potentially other hosts.
6. The EDR solution continues to generate alerts as the attacker performs various actions.
7. This detection rule identifies hosts generating multiple distinct alerts.
8. The attacker achieves their objective, such as data exfiltration or system disruption, which is detected by the EDR.

Impact

A successful attack leading to multiple EDR alerts can indicate a significant compromise within an organization. If multiple alerts are triggered and not addressed promptly, attackers could successfully exfiltrate sensitive data, deploy ransomware, or cause significant disruption to business operations. The rule aims to identify hosts with 3 or more unique alerts/processes or 5+ unique rules from the same host to indicate a significant compromise.

Recommendation

• Deploy the provided Sigma rule to your SIEM and tune it for your specific environment to detect hosts generating multiple EDR alerts.
• Investigate hosts identified by the Sigma rule by examining related logs and telemetry, such as process creation, network connections, and file modifications.
• Integrate IOCs gathered during the investigation into your threat intelligence platform and use them to proactively hunt for similar activity across your environment.
• Review and exclude known benign activities that may trigger multiple alerts, such as scheduled software updates or system maintenance, to reduce false positives (see rule note).