Technical Library | Support

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Predefined Policies and Classifiers > Data Loss Prevention policies > Data Theft Risk Indicators > Indicators of Compromise
Indicators of Compromise
Predefined Policies and Classifiers | Data Security Solutions | Version 7.8.x
*
Malware communication detection
Identifies traffic that is thought to be malware "phoning home" or attempting to steal information. Detection is based on the analysis of traffic patterns from known infected machines. Applies only when Web Security Gateway is installed. Rules in this policy include:
*
Malware communication detection (Wide)
*
Malware communication detection (Default)
*
Malware communication detection (Narrow)
*
Suspected Malicious Dissemination
Policy for the detection of a suspected malicious content dissemination such as: encrypted or manipulated information, passwords files, credit card tracks, suspected applications and dubious content such as information about the network, software license keys, and database files. The rules for this policy are:
*
Counter Malicious: Dubious Content
*
Counter Malicious: Encrypted files (known format)
*
Counter Malicious: Generic Encryption Detection
*
Counter Malicious: Generic Encryption Detection (Wide)
*
Counter Malicious: Malicious Concealment
*
Counter Malicious: Password files
*
Counter Malicious: Password Information
*
Counter Malicious: Suspected Applications (Steganography and Encryption)
*
Encrypted Files
Policy for detection of desktop encrypted files. Should be complemented with the unknown file type policy for unknown encryption formats. The rules for this policy are:
*
Encrypted File: PDF - encrypted
*
Encrypted File: Word 97-2003 - encrypted
*
Encrypted File: Excel spreadsheet 97-2003 - encrypted
*
Encrypted File: Access 97-2003 - encrypted
*
Encrypted File: Office 2007-2010 encrypted files
*
Encrypted File: PowerPoint 97-2003 - encrypted
*
Encrypted File: ZIP archive - encrypted
*
Encrypted File: RAR archive - encrypted
*
Encrypted File: PGP signed and encrypted data format
*
Encrypted File: PGP encrypted data format
*
Encrypted File: Encrypted data of unknown format
*
Password Files
Searches for outbound password files, such as SAM database and UNIX/Linux password files. The rules for this policy are:
*
Password Files: General files
*
Password Files: Password Files
*
Password Files: Password Files (Wide)
*
Password Files: SAM files
*
Password Files: Shadow Files
*
Password Files: Shadow Files (Wide)

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Predefined Policies and Classifiers > Data Loss Prevention policies > Data Theft Risk Indicators > Indicators of Compromise
Copyright 2016 Forcepoint LLC. All rights reserved.