[#825] SOC sweep: UCS machine-account suppression (CR 24) + churn root causes

https://projects.knownelement.com/issues/825
2026-09-06 16:17:45 -05:00
parent cb2a24eaf9
commit 9476f92029
2 changed files with 19 additions and 0 deletions
@@ -159,6 +159,12 @@
    <description>Cloudron: PHP file in uploads dir - #823-pattern webshell staging (41 webshells found there 2026-09-06).</description>
    <mitre><id>T1505.003</id></mitre>
  </rule>
+  <rule id="100520" level="3">
+    <if_sid>5710</if_sid>
+    <srcip>100.68.10.17</srcip>
+    <regex type="pcre2">Invalid user tsys-ucs-02\$</regex>
+    <description>UCS machine-account SSH probe (tsys-ucs-02$ from tsys-ucs-02 every 20min, UCS domain artifact CR 24 - dispositioned L3).</description>
+  </rule>
  <rule id="100510" level="8">
    <if_sid>31100, 31101, 31103, 31104, 31106, 31108, 31109, 31110, 31115, 31120, 31121, 31122, 31123</if_sid>
    <match>uploads/.*\.php</match>