DocsAttack Types

Malicious Payload Distribution

A VM serving or fetching known malicious payloads.

A VM serves or downloads known malicious files. Hosting malware gets IP ranges blocklisted quickly. Frabs matches the traffic against malware and payload lists.

Detectors (10)

Detector	Measures	Warning	Incident	Critical
Malware Distribution	Contacts with addresses on threat-intelligence lists (contacts)	1 in 10 min	10 in 1 h	100 in 1 h
Trojan Distribution	Contacts with addresses on threat-intelligence lists (contacts)	1 in 10 min	10 in 1 h	100 in 1 h
RAT Distribution	Contacts with addresses on threat-intelligence lists (contacts)	1 in 10 min	10 in 1 h	100 in 1 h
Stealer Distribution	Contacts with addresses on threat-intelligence lists (contacts)	1 in 10 min	10 in 1 h	100 in 1 h
Botnet Distribution	Contacts with addresses on threat-intelligence lists (contacts)	1 in 10 min	10 in 1 h	100 in 1 h
Ransomware Distribution	Contacts with addresses on threat-intelligence lists (contacts)	1 in 10 min	10 in 1 h	100 in 1 h
Exploit Kit Traffic	Contacts with addresses on threat-intelligence lists (contacts)	1 in 10 min	10 in 1 h	100 in 1 h
Malicious Payload Distribution	Contacts with addresses on threat-intelligence lists (contacts)	1 in 10 min	10 in 1 h	100 in 1 h
Malware Download Traffic	Contacts with addresses on threat-intelligence lists (contacts)	1 in 10 min	10 in 1 h	100 in 1 h
Malicious Script Distribution	Contacts with addresses on threat-intelligence lists (contacts)	1 in 10 min	10 in 1 h	100 in 1 h

Change the thresholds

Use Custom Protection to change any of these, or set them for one VM. See Detectors and Thresholds.

PreviousMalware & Command-and-Control NextSpam & Email Abuse