Antivirus Analysis and Detection

Ingest and Analyze Antivirus Data

Antivirus (AV) scanning is an essential part of an organization’s security monitoring and provides valuable data for security teams to handle potential compromise and improve their security posture. With integration, analysis, and detection of AV logs from third-party tools, Alert Logic helps place threats identified from your AV data into a more comprehensive threat management view.

Alert Logic ingests and analyzes antivirus logs to provide key insights for alerting and Security Operations Center (SOC) support, such as:

• Detection of known hack tools such as pwdump, wincred, and mimikatz whose presence is highly correlated with malicious post-compromise activity
• Detection of writing to privileged locations on the local system, which is indicative of a user or malware with administrative privileges – often a later stage action in the attack cycle