1. Home
  2. Data Components
  3. Host Status

Host Status

Logging, messaging, and other artifacts that highlight the health and operational state of host-based security sensors, such as Endpoint Detection and Response (EDR) agents, antivirus software, logging services, and system monitoring tools. Monitoring sensor health is essential for detecting misconfigurations, sensor failures, tampering, or deliberate security control evasion by adversaries.

Data Collection Measures:

  • Windows Event Logs:
    • Event ID 1074 (System Shutdown): Detects unexpected system reboots/shutdowns.
    • Event ID 6006 (Event Log Stopped): Logs when Windows event logging is stopped.
    • Event ID 16 (Sysmon): Detects configuration state changes that may indicate log tampering.
    • Event ID 12 (Windows Defender Status Change) – Detects changes in Windows Defender state.
  • Linux/macOS Monitoring:
    • /var/log/syslog, /var/log/auth.log, /var/log/kern.log
    • Journald (journalctl) for kernel and system alerts.
  • Endpoint Detection and Response (EDR) Tools:
    • Monitor agent health status, detect sensor tampering, and alert on missing telemetry.
  • Mobile Threat Intelligence Logs:
    • Samsung Knox, SafetyNet, iOS Secure Enclave provide sensor health status for mobile endpoints.
ID: DC0018
Domains: Mobile, Enterprise
Version: 2.1
Created: 20 October 2021
Last Modified: 20 April 2026

Log Sources

Name Channel
android:appops ACCESS_FINE_LOCATION|NEARBY_DEVICES|BLUETOOTH_SCAN used in close proximity to network-context queries
AndroidAttestation:SafetyNet SafetyNet attestation with CTSProfileMatch=false or BasicIntegrity=false
AndroidAttestation:VerifiedBoot Verified Boot or dm-verity reports partition hash mismatch, non-green boot state, or integrity failure
AndroidLogs:Crash Crash or abnormal restart of privileged system services (for example, system_server, mediaserver, installd) followed shortly by new privileged process activity or binder connections from a single app UID
AndroidLogs:Crash Application or system process crash/restart patterns temporally associated with remote service communications
auditd:SYSCALL firmware_update, kexec_load
AWS:CloudMetrics Autoscaling, memory/cpu alarms, or instance unhealthiness
AWS:CloudWatch Sustained spike in CPU usage on EC2 instance with web service role
AWS:CloudWatch StatusCheckFailed or StatusCheckFailed_System for burstable instances (t2/t3)
AWS:CloudWatch Sustained EC2 CPU usage above normal baseline
AWS:CloudWatch NetworkOut spike beyond baseline
AWS:CloudWatch Sudden spike in network output without a corresponding inbound request ratio
AWS:CloudWatch Unusual CPU burst or metric anomalies
esxi:hostd Powering off or restarting host
iOS:MDMLog Device risk, compliance, or security posture changes after trusted host pairing or developer-state transition
iOS:unifiedlog code signature validation failure / exec of invalidly-signed payload from sandboxed app
iOS:unifiedlog Application crash logs, watchdog terminations, or abnormal execution events associated with service communication
journald:boot Secure Boot failure, firmware version change
kubernetes:events CrashLoopBackOff, OOMKilled, container restart count exceeds threshold
linux:procfs Sustained high /proc/[pid]/stat usage
linux:syslog Out of memory killer invoked or kernel panic entries
linux:syslog Service stop or disable messages for security tools not reflected in SIEM alerts
linux:syslog system is powering down
macos:osquery interface_details
macos:syslog Hardware UUID or device list drift
macos:unifiedlog Web service process (e.g., httpd) entering crash loop or consuming excessive CPU
macos:unifiedlog Spike in CPU or memory use from non-user-initiated processes
macos:unifiedlog Termination or disabling of XProtect, Gatekeeper, or third-party AV daemons
macos:unifiedlog network stack resource exhaustion, tcp_accept queue overflow, repeated resets
macos:unifiedlog EFI firmware integrity check failed
macos:unifiedlog System Integrity Protection (SIP) state reported as disabled
macos:unifiedlog System shutdown or reboot requested
MDM:DeviceIntegrity jailbreak/root compromise indicators or integrity attestation failures enabling process visibility
networkdevice:syslog no logging host, no aaa new-model, no snmp-server, commit
networkdevice:syslog System reboot scheduled or performed
NSM:Flow TCP: possible SYN flood or backlog limit exceeded
OEMAttestation:Knox Samsung Knox attestation shows attestation_state=COMPROMISED or warranty bit set
prometheus:metrics Container CPU/Memory usage exceeding threshold
sar:network Outbound network saturation with minimal process activity
Sensor Health None
Windows:perfmon Sustained CPU/memory exhaustion by service process (e.g., w3wp.exe)
Windows:perfmon High sustained CPU usage by a single process
Windows:perfmon Sudden spike in outbound throughput without corresponding inbound traffic
Windows:perfmon Sudden spikes in CPU/Memory usage linked to specific application processes
WinEventLog:Microsoft-Windows-TCPIP Connection queue overflow or failure to allocate TCP state object
WinEventLog:Security EventCode=1166, 7045
WinEventLog:Security EventCode=1074
WinEventLog:Security EventCode=6006
WinEventLog:Sysmon EventCode=16
WinEventLog:System System shutdowns due to bugcheck (Event ID 1001) or watchdog timer expirations

Detection Strategy

ID Name Technique Detected
DET0415 Application Exhaustion Flood Detection Across Platforms T1499.003
DET0311 Detection for Spoofing Tool UI across OS Platforms T1685.003
DET0654 Detection of Boot or Logon Initialization Scripts T1398
DET0712 Detection of Compromise Client Software Binary T1645
DET0633 Detection of Credentials from Password Store T1634
DET0497 Detection of Defense Impairment through Disabled or Modified Tools across OS Platforms. T1685
DET0710 Detection of Disguise Root/Jailbreak Indicators T1630.003
DET0077 Detection of Exfiltration Over Alternate Network Interfaces T1011
DET0666 Detection of Exploitation for Initial Access T1664
DET0665 Detection of Exploitation for Privilege Escalation T1404
DET0663 Detection of Exploitation of Remote Services T1428
DET0664 Detection of Keychain T1634.001
DET0692 Detection of Process Discovery T1424
DET0691 Detection of Replication Through Removable Media T1458
DET0636 Detection of System Network Connections Discovery T1421
DET0173 Detection Strategy for Endpoint DoS via Service Exhaustion Flood T1499.002
DET0408 Detection Strategy for Reflection Amplification DoS (T1498.002) T1498.002
DET0343 Direct Network Flood Detection across IaaS, Linux, Windows, and macOS T1498.001
DET0356 Endpoint DoS via OS Exhaustion Flood Detection Strategy T1499.001
DET0208 Endpoint Resource Saturation and Crash Pattern Detection Across Platforms T1499
DET0368 Hardware Supply Chain Compromise Detection via Host Status & Boot Integrity Checks T1195.003
DET0540 Multi-Platform Behavioral Detection for Compute Hijacking T1496.001
DET0559 Multi-Platform Shutdown or Reboot Detection via Execution and Host Status Events T1529
DET0267 Resource Hijacking Detection Strategy T1496
DET0534 TCC Database Manipulation via Launchctl and Unprotected SIP T1548.006