Skip to main content

Detection criteria for Advanced rules

Advanced custom rules are query-based EDR detection rules you can use to scan endpoints for patterns of malicious behavior. This page lists the detection criteria available when building Advanced custom detection rules. Each criterion consists of a category, a field, and a value that together define the behavior you want to detect.

The API methods that use these criteria are the following:

Advanced rules use a query syntax where criteria follow this format:

Category.Field:Value

For example: Process.Name:'powershell.exe'

You can combine multiple criteria using logical and comparison operators. For more information on the Advanced rule syntax, refer to this section Advanced rule syntax.

Important

Criteria that accept string values support pattern matching using wildcards. The following criteria do not support wildcards:

  • Process.MD5 

  • Process.SHA2 

  • File.MD5 

  • File.SHA2 

Field

Category

Value validation rules

Process.Name

Process

String

Process.FullPathName

Process.CommandLine

Process.User

Process.CreatedBy.Name

Process.CreatedBy.Path

Process.CreatedBy.FullPathName

Process.CreatedBy.CommandLine

Process.MD5

Hash

Process.SHA2

Process.Files

Array

Important

These fields can be used only with parentheses ( ) and the + operator.

Process.Registries

Process.Connections

Process.Services

Process.Emails

File.Name

File

String

File.FullPathName

File.Extension

File.CreatedBy.Name

File.CreatedBy.Path

File.CreatedBy.FullPathName

File.CreatedBy.Name

File.CreatedBy.User

File.MD5

Hash

File.SHA2

File.Operation

Possible values:

  • create 

  • read 

  • write 

  • move 

  • rename 

  • copy 

File.CertificateSignedStatus

Important

Requires either File.Name or File.FullPathName to be defined in the same rule.

Possible values

  • unknown

  • is_signed 

  • is_unsigned 

Important

The unsigned value is incompatible with File.CertificateIssuer or File.CertificateSigner in the same rule.

File.CertificateSigner

Important

  • Requires either File.Name or File.FullPathName to be defined in the same rule.

  • This criterion is incompatible with the unsigned value of the File.CertificateSignedStatus field.

String

File.CertificateIssuer

Important

  • Requires either File.Name or File.FullPathName to be defined in the same rule.

  • This criterion is incompatible with the unsigned value of the File.CertificateSignedStatus field.

String

Registry.Key

Registry

String

Registry.Value

Registry.CreatedBy.Name

Registry.CreatedBy.Path

Registry.CreatedBy.FullPathName

Registry.CreatedBy.CommandLine

Registry.Operation

Possible values:

  • key_created 

  • key_deleted 

  • key_renamed

  • value_created 

  • value_deleted 

  • value_written 

Registry.DataType

Possible values:

  • none 

  • string 

  • expandablestring 

  • link 

  • multistring 

  • binary 

  • dword 

  • qword 

  • resource_list

  • resource_requirements_list

  • full_resource_descriptor

Registry.Data

Important

  • This criterion must be used together with Registry.DataType.

  • This criterion is incompatible with the multistrings value of the Registry.DataType field.

  • Numerical types are converted to strings

String

Important

For the binary, resource_list, full_resource_descriptor, and resource_requirements_list registry types, the Registry.Data value must be encoded in base64.

Connection.SourceIP

Connection

IP

Connection.DestinationIP

Connection.SourcePort

Numeric

Connection.DestinationPort

Connection.Protocol

Possible values:

  • https 

  • http 

  • ftp 

  • rdp 

  • smb 

  • ssh 

  • ssl 

  • wmi 

  • telnet 

  • file_remote 

Connection.Url

String

Connection.Domain

Important

The Connection.Protocol criterion can only have the values http or http.

String

Connection.HTTPUser

Important

  • If this criterion is used, the Connection.Protocol criterion can have only the values http or https.

  • Incompatible with the following fields in the same rule:

    • Connection.SMBUser 

    • Connection.SSHUser 

    • Connection.FTPUser 

Connection.SMBUser

Important

  • If this criterion is used, the Connection.Protocol criterion can have only the values smb.

  • Incompatible with the following fields in the same rule:

    • Connection.HTTPUser 

    • Connection.SSHUser 

    • Connection.FTPUser 

Connection.FTPUser

Important

  • If this criterion is used, the Connection.Protocol criterion can have only the values ftp.

  • Incompatible with the following fields in the same rule:

    • Connection.SMBUser

    • Connection.HTTPUser

    • Connection.SSHUser

Connection.SSHUser

Important

  • If this criterion is used, the Connection.Protocol criterion can have only the values ssh.

  • Incompatible with the following fields in the same rule:

    • Connection.SMBUser

    • Connection.FTPUser

    • Connection.HTTPUser

Service.Name

Service

String

Service.Path

String

Service.StartType

Possible values:

  • auto_start

  • manual_start 

  • disabled 

Service.CreatedBy.Name

String

Service.CreatedBy.Path

Service.Operation

Possible values:

  • added 

  • deleted 

Email.Sender

Email

String

Email.Receivers

Email.Subject

Email.Attachments

Email.CreatedBy.Name

Email.CreatedBy.Path

Email.CreatedBy.FullPathName

Email.CreatedBy.CommandLine

Email.Operation

Possible values

  • sent 

  • received 

UserLogin.Name

UserLogin

String

UserLogin.Domain

UserLogin.IP

IP

In this section: