1. Home
  2. Data Components
  3. Host Status

Host Status

Logging, messaging, and other artifacts that highlight the health and operational state of host-based security sensors, such as Endpoint Detection and Response (EDR) agents, antivirus software, logging services, and system monitoring tools. Monitoring sensor health is essential for detecting misconfigurations, sensor failures, tampering, or deliberate security control evasion by adversaries.

Data Collection Measures:

  • Windows Event Logs:
    • Event ID 1074 (System Shutdown): Detects unexpected system reboots/shutdowns.
    • Event ID 6006 (Event Log Stopped): Logs when Windows event logging is stopped.
    • Event ID 16 (Sysmon): Detects configuration state changes that may indicate log tampering.
    • Event ID 12 (Windows Defender Status Change) – Detects changes in Windows Defender state.
  • Linux/macOS Monitoring:
    • /var/log/syslog, /var/log/auth.log, /var/log/kern.log
    • Journald (journalctl) for kernel and system alerts.
  • Endpoint Detection and Response (EDR) Tools:
    • Monitor agent health status, detect sensor tampering, and alert on missing telemetry.
  • Mobile Threat Intelligence Logs:
    • Samsung Knox, SafetyNet, iOS Secure Enclave provide sensor health status for mobile endpoints.
ID: DC0018
Domains: Mobile, Enterprise
Version: 2.0
Created: 20 October 2021
Last Modified: 21 October 2025

Log Sources

Name Channel
auditd:SYSCALL firmware_update, kexec_load
AWS:CloudWatch Sustained spike in CPU usage on EC2 instance with web service role
AWS:CloudWatch StatusCheckFailed or StatusCheckFailed_System for burstable instances (t2/t3)
AWS:CloudWatch Sudden spike in network output without a corresponding inbound request ratio
AWS:CloudWatch Unusual CPU burst or metric anomalies
CloudMetrics:InstanceHealth Autoscaling, memory/cpu alarms, or instance unhealthiness
CloudWatch:InstanceMetrics NetworkOut spike beyond baseline
CloudWatch:Metrics Sustained EC2 CPU usage above normal baseline
esxi:hostd Powering off or restarting host
journald:boot Secure Boot failure, firmware version change
kubernetes:events CrashLoopBackOff, OOMKilled, container restart count exceeds threshold
linux:procfs Sustained high /proc/[pid]/stat usage
linux:syslog Out of memory killer invoked or kernel panic entries
linux:syslog Service stop or disable messages for security tools not reflected in SIEM alerts
linux:syslog system is powering down
macos:osquery interface_details
macos:syslog Hardware UUID or device list drift
macos:unifiedlog Web service process (e.g., httpd) entering crash loop or consuming excessive CPU
macos:unifiedlog Spike in CPU or memory use from non-user-initiated processes
macos:unifiedlog Termination or disabling of XProtect, Gatekeeper, or third-party AV daemons
macos:unifiedlog network stack resource exhaustion, tcp_accept queue overflow, repeated resets
macos:unifiedlog EFI firmware integrity check failed
macos:unifiedlog System Integrity Protection (SIP) state reported as disabled
macos:unifiedlog System shutdown or reboot requested
networkdevice:syslog System reboot scheduled or performed
NSM:Flow TCP: possible SYN flood or backlog limit exceeded
prometheus:metrics Container CPU/Memory usage exceeding threshold
sar:network Outbound network saturation with minimal process activity
Sensor Health None
Windows:perfmon Sustained CPU/memory exhaustion by service process (e.g., w3wp.exe)
Windows:perfmon High sustained CPU usage by a single process
Windows:perfmon Sudden spike in outbound throughput without corresponding inbound traffic
Windows:perfmon Sudden spikes in CPU/Memory usage linked to specific application processes
WinEventLog:Microsoft-Windows-TCPIP Connection queue overflow or failure to allocate TCP state object
WinEventLog:Security EventCode=1166, 7045
WinEventLog:Security EventCode=1074
WinEventLog:Security EventCode=6006
WinEventLog:Sysmon EventCode=16
WinEventLog:System System shutdowns due to bugcheck (Event ID 1001) or watchdog timer expirations

Detection Strategy

ID Name Technique Detected
DET0415 Application Exhaustion Flood Detection Across Platforms T1499.003
DET0311 Detection for Spoofing Security Alerting across OS Platforms T1562.011
DET0654 Detection of Boot or Logon Initialization Scripts T1398
DET0712 Detection of Compromise Client Software Binary T1645
DET0604 Detection of Compromise Hardware Supply Chain T1474.002
DET0721 Detection of Compromise Software Supply Chain T1474.003
DET0633 Detection of Credentials from Password Store T1634
DET0710 Detection of Disguise Root/Jailbreak Indicators T1630.003
DET0614 Detection of Drive-By Compromise T1456
DET0077 Detection of Exfiltration Over Alternate Network Interfaces T1011
DET0666 Detection of Exploitation for Initial Access T1664
DET0665 Detection of Exploitation for Privilege Escalation T1404
DET0694 Detection of Hijack Execution Flow T1625
DET0664 Detection of Keychain T1634.001
DET0645 Detection of Lockscreen Bypass T1461
DET0691 Detection of Replication Through Removable Media T1458
DET0689 Detection of System Runtime API Hijacking T1625.001
DET0173 Detection Strategy for Endpoint DoS via Service Exhaustion Flood T1499.002
DET0239 Detection Strategy for Impair Defenses Indicator Blocking T1562.006
DET0408 Detection Strategy for Reflection Amplification DoS (T1498.002) T1498.002
DET0343 Direct Network Flood Detection across IaaS, Linux, Windows, and macOS T1498.001
DET0356 Endpoint DoS via OS Exhaustion Flood Detection Strategy T1499.001
DET0208 Endpoint Resource Saturation and Crash Pattern Detection Across Platforms T1499
DET0368 Hardware Supply Chain Compromise Detection via Host Status & Boot Integrity Checks T1195.003
DET0540 Multi-Platform Behavioral Detection for Compute Hijacking T1496.001
DET0559 Multi-Platform Shutdown or Reboot Detection via Execution and Host Status Events T1529
DET0267 Resource Hijacking Detection Strategy T1496
DET0534 TCC Database Manipulation via Launchctl and Unprotected SIP T1548.006