Abnormal Behavior

Overview

Abnormal behavior refers to the events that should not occur on hosts. For example, a user logs in to the system during an unauthorized time period, some file directories are changed unexpected, or an error occurs in the process. Many of these events are caused by malware. We should keep alert for abnormal behavior. Abnormal behavior data in SA mainly comes from linked services Host Security Service (HSS) and Web Application Firewall (WAF).

Suggestion

If an abnormal behavior threat is detected, handle the threat by following the instructions in Table 1.

**Table 1** Suggestions on handling some abnormal behavior threats
Threat Alarm	Severity	Threat Description	Suggestion
File directory change monitoring event	Informational	Malicious modifications on key file of ECS instances.	Log in to the HSS console and perform the processing.
System login audit event	Informational	Abnormal logins to ECS instances.	Log in to the HSS console and perform the processing.
Abnormal process behavior	Low	Process exceptions on ECS instances, which may be a malicious program.	Log in to the HSS console and perform the processing.