Updated on 2023-06-09 GMT+08:00

Abnormal Behavior

Overview

Abnormal behavior refers to the events that should not occur on hosts. For example, a user logs in to the system during an unauthorized time period, some file directories are changed unexpected, or an error occurs in the process. Many of these events are caused by malware. We should keep alert for abnormal behavior. Abnormal behavior data in SA mainly comes from linked services Host Security Service (HSS) and Web Application Firewall (WAF).

Suggestion

If an abnormal behavior threat is detected, handle the threat by following the instructions in Table 1.

Table 1 Suggestions on handling some abnormal behavior threats

Threat Alarm

Severity

Threat Description

Suggestion

File directory change monitoring event

Informational

Malicious modifications on key file of ECS instances.

Log in to the HSS console and perform the processing.

System login audit event

Informational

Abnormal logins to ECS instances.

Log in to the HSS console and perform the processing.

Abnormal process behavior

Low

Process exceptions on ECS instances, which may be a malicious program.

Log in to the HSS console and perform the processing.