EP-B-05Level 1 · Signal
Runs suspicious processes or unapproved software
A risky Behavior signal from endpoint protection (EDR, endpoint.process.suspicious): this person ran a process the agent rates suspicious or software outside the approved catalog.
Classification
- Risk domain One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
- Evidence level
- Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
- Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
- NIST CSF 2.0
-
- DE.CM-09
- MITRE ATT&CK
-
- T1204
The definition, in detail
Definition
Unvetted code on the device is how an intrusion starts.
Example
An analyst installs a free PDF converter from a download portal; the agent flags its installer for spawning a hidden script and a remote-access tool.
How it is measured
- Source
- Endpoint protection
- Subject
- Person
- Event
- endpoint.process.suspicious
- Risk domain
- Endpoint and device
- Provenance
- Gartner
How it is used
Programs count "Runs suspicious processes or unapproved software" per person from Endpoint protection and read it beside the other Endpoint and device signals; it feeds 0 cohorts, 1 sequence and 1 breach scenario.
A "runs suspicious processes or unapproved software" event is evidence of behavior under pressure. It is one observed action, and on its own it is no proof of compromise.
Technical mappings
Framework mappings; validate for your use case.
Library indicators
The detailed observations in the indicator library with the same risk domain, dimension and polarity as this signal.
- I.0104Signs into enterprise apps from unmanaged devices
- I.0116Downloads executable files from suspicious domains
- I.0184Disables endpoint security controls
- I.0186Delays software updates repeatedly
- I.0188Uses devices with unnecessary or risky software
- I.0190Runs files from suspicious or unrecognized USB devices
- I.0192Downloads and executes malicious files
- I.0195Runs unsupported legacy applications
- I.0196Delays reboots after patch installation
- I.0197Installs unapproved software
- I.0198Runs portable applications from external drives
- I.0199Uses personal devices for enterprise work without enrollment
- I.0200Connects to unknown USB peripherals
- I.0201Uses devices that boot from removable media
- I.0202Charges devices from untrusted USB sources
- I.0206Uses devices observed to frequently visit risky websites
- I.0207Disables screen lock or timeout
- I.0208Leaves devices unlocked in public or shared spaces
- I.0209Uses jailbroken or rooted mobile devices for work
- I.0210Installs remote access tools without approval
- I.0211Runs browser-based games or crypto mining on work devices
- I.0223Badges in without badging out
- I.0224Badges out without prior badge in
- I.0225Allows additional person to enter without authorization
- I.0226Holds secure door open beyond expected duration
- I.0227Attempts to access unauthorized areas with badge
- I.0228Accumulates excessive denied access attempts
- I.0229Accesses facilities more frequently than expected
- I.0230Accesses facilities outside expected hours
- I.0231Accesses facilities using unexpected badge
- I.0232Accesses facilities while on leave
- I.0233Accesses facilities after offboarding
- I.0234Accesses multiple facilities simultaneously
- I.0235Visits sensitive zones for unusually short durations
- I.0236Loiters in sensitive zones beyond expected durations
- I.0237Appears onsite while also appearing remote
- I.0238Fails to display badge when onsite
- I.0239Sponsors visitors more frequently than expected
- I.0240Attempts to sponsor unauthorized visitors
- I.0241Fails to respond appropriately during security drills
- I.0242Fails clean desk policy audit
- I.0294Uses shared home device to access corporate systems
- I.0298Fails device posture checks during remote access
- I.0299Rarely connects to device management platform
- I.0300Delays applying patches while remote
- I.0301Disables device encryption outside office environments
- I.0302Uses unmanaged personal device for corporate access
- I.0304Accesses work apps from consumer devices
- I.0305Installs unapproved remote access tools
- I.0311Works remotely without connecting to VPN
- I.0315Leaves work device unattended in public places
- I.0320Connects from geolocations inconsistent with work profile
- I.0321Uses open Wi-Fi networks without VPN
- I.0364Operates rooted or jailbroken mobile device
- I.0365Disables full-disk encryption on mobile device
- I.0366Connects mobile device to untrusted Wi-Fi
- I.0367Fails to maintain secure VPN tunnel on mobile device
- I.0368Installs sideloaded or unapproved applications on mobile device
- I.0369Grants excessive mobile app permissions
- I.0371Removes or tampers with MDM profile
- I.0372Operates mobile device from restricted geolocation
- I.0374Runs mobile device with preinstalled riskware
Continue exploring
"Runs suspicious processes or unapproved software" (EP-B-05), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/signals/ep-b-05-runs-suspicious-processes-or-unapproved-software
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · Version history. This page describes one signal.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.