title: Endpoint Protection Alert
id: 0505792a-a79b-5fcb-96ee-bb82d8f9e895
custom_id: wf-mal-008
status: stable
level: medium
description: |
    Detects alerts forwarded from endpoint protection platforms (EPP/EDR)
    through WitFoo's artifact pipeline. These include antivirus detections,
    behavioral blocks, and exploit prevention alerts.
author: WitFoo
date: 2026-02-21
tags:
    - attack.execution
    - attack.t1027
references:
    - https://attack.mitre.org/techniques/T1027/
logsource:
    product: witfoo
    service: artifact-exporter
detection:
    selection:
        messageType: "endpoint_protection"
    condition: selection
fields:
    - clientIP
    - userName
    - fileName
    - fileHash
    - program
    - action
    - matchedLeadRules
falsepositives:
    - Antivirus quarantine of legitimate files
    - Heuristic false positives on new software