Alarm for CVE 2019-0708

[Alessio_DM]

Hi all, 

I am trying to create an alarm that  trigger whenever suspicious events occur towards the RDP port (3389)

The problem is the following:

for other customers we use Qradar, and the rule, in addition to destination port 3389, also includes:
same source
same destination
7 events
within 10 minutes

I can't understand how I can put these last rules into McAfee. I can't find the way, I tried with the correlation rules, but it doesn't work. Do you think there is a possible method to solve my problem?

Thanks in advance

[lratcliffe · Accepted solution]

This can definitely be done through a correlation rule.  In the correlation rule configuration group by source ip, destination ip to ensure the events all have the same source and destination.

In the filters add the destination port (3389), the signature IDs or normalisation IDs you expect it to match and any other filters as needed.  In the properties of the logical element (for a single set of events any will do - if you are combining multiple events use the appropriate one) you can set the threshold and time window (7 events, 10 minutes).

[Alessio_DM]

Thank you so much for your help!

Have a good day 😄

[Alessio_DM]

Hi, thank you for the help. The solution that you have provided seems to work fine but i see that in the alarm the events are grouped only by source IP. So the alarm trigger even if the destination IP are different. In the correlation rule i set group by: Destination IP, Source IP. Am i missing something??

Thank you in advance

[lratcliffe]

That sounds like it should work - if you're getting behaviour that does not match your expectations, please raise a Service Request with details of the configured rule and the events which triggered it - we will investigate and identify what is happening.

[Alessio_DM]

Thanks for your reply. Where can i open a Service request?

Thank you

[YuvrajSalaria]

You can submit a service request on our Support Portal (https://support.mcafee.com).