After the Security Center agent is installed on your servers, Security Center collaborates with Alibaba Cloud to protect your servers. Security Center provides a wide array of features, including alerting, vulnerability management, antivirus, baseline checks, and attack analysis.

This topic describes the collection scope of Security Center.
Note Changes to the following information will be posted on the Alibaba Cloud official website. If you do not accept the changes, you can stop using Security Center. In this case, you can uninstall the agent from your servers. For more information, see Uninstall the Security Center agent. If you continue to use Security Center, you are deemed to have accepted these changes.

Information about suspicious files

Security Center can detect suspicious files on your servers. After Security Center detects a suspicious file, information about the file is uploaded to Alibaba Cloud for further verification. The file information includes but is not limited to the file path, MD5 hash value, and creation time. If the suspicious file is determined as a malicious file, Security Center sends you an alert notification.

Information about suspicious processes

Security Center can detect suspicious processes on your servers. After Security Center detects a suspicious process, information about the process is uploaded to Alibaba Cloud for further verification. The process information includes but is not limited to the process name, parameters used to start the process, file path of the process, and start time of the process. If the suspicious process is determined as a malicious process, Security Center sends you an alert notification.

Information about accounts

Security Center provides features such as logon audit, suspicious account alerting, and brute-force attack prevention. Security Center regularly analyzes and uploads account and logon information about protected servers. The account information includes but is not limited to the usernames and user permissions. The logon information includes but is not limited to the usernames and IP addresses that are used for logons. If a logon is determined as an unusual logon, Security Center sends you an alert notification.

Information about suspicious connections

Security Center detects suspicious network connections to your servers. After Security Center detects a suspicious network connection, information about the connection is uploaded to Alibaba Cloud for further verification. The connection information includes but is not limited to the source IP address, source port, destination IP address, and destination port. If the suspicious network connection is determined as a malicious connection, Security Center sends you an alert notification.

Information about servers

Security Center supports server management. Security Center regularly collects information about servers. The server information includes but is not limited to the software information, port listening information, and information about the websites running on your servers. You can log on to the Security Center console and view the information on the Assets page.

Images

Security Center provides the feature of container image scan. Security Center regularly scans containers to check whether vulnerabilities and malicious files exist in your images. You can log on to the Security Center console and view detected vulnerabilities and malicious files on the Image Security page.

Container security in runtime

To ensure container security in runtime, Security Center dynamically detects threats, including viruses, malicious programs, intrusions, container escapes, and high-risk operations in the runtime of containers. If threats are detected in the runtime of containers, Security Center sends you an alert notification.

Vulnerabilities

Note The following symbols are used in the table:
  • ×: This edition does not support this check item.
  • √: This edition supports this check item.
  • 〇: The Basic and Anti-virus editions of Security Center support only the automatic detection of vulnerabilities. These editions do not support quick scan for vulnerabilities or fixing of vulnerabilities. Before you can use Security Center to run manual scan tasks, you must upgrade Security Center to the Advanced, Enterprise, or Ultimate edition. If you want to use Security Center to fix detected vulnerabilities, you must upgrade Security Center to the Advanced, Enterprise, or Ultimate edition.
Vulnerabilities Basic Anti-virus Advanced Enterprise Ultimate
Linux software vulnerabilities
Windows system vulnerabilities
Web-CMS vulnerabilities
Application vulnerabilities × × ×
Urgent vulnerabilities

Alerts

Alert Description
Webpage Tampering Security Center monitors web directories in real time and restores tampered files or directories by using the backup files. This protects websites from malicious modifications, trojans, hidden links, and uploads of violent or illicit content. Security Center can detect the following suspicious activities:
  • File adding
  • File modification
  • File deletion
Note Web tamper proofing is a value-added feature that is provided by Security Center. To use the feature, you must purchase and enable the feature. Security Center Anti-virus, Advanced, Enterprise, and Ultimate support web tamper proofing. Security Center Basic does not support web tamper proofing. For more information, see Overview of web tamper proofing.
Suspicious Process Security Center can detect the following suspicious processes:
  • Write operations on the configuration files of scheduled tasks in Linux.
  • Modification to the files of scheduled tasks in Linux.
  • Execution of suspicious commands in Linux.
  • Reverse shells. For more information, see Detect reverse shells from multiple dimensions.
  • Execution of suspicious commands in Python applications.
  • Malicious code loading by using Windows system files.
  • The Windows mshta.exe utility called to execute commands that insert JavaScript into an HTML page.
  • Creation of suspicious scheduled tasks in Windows.
  • Execution of suspicious commands in Windows regsvr32.exe.
  • Access to malicious download sources.
  • Suspicious modification of registry configurations.
  • Suspicious calls of system tools.
  • Execution of malicious commands.
  • Containers started in privileged mode.
  • Suspicious modification of auto-startup items.
Webshell Security Center uses engines developed by Alibaba Cloud to scan for common webshell files. Security Center supports scheduled scan tasks, provides real-time protection, and quarantines webshell files.
  • Security Center scans the entire web directory early in the morning on a daily basis. If a file in the web directory changes, Security Center immediately scans for webshells.
  • You can specify the assets on which Security Center scans for webshells.
  • You can quarantine, restore, or ignore the detected trojan files.
Note Security Center Basic detects only some types of webshells. If you want to detect all types of webshells, we recommend that you upgrade Security Center Basic to the Anti-virus, Advanced, Enterprise, or Ultimate edition. For more information, see Upgrade and downgrade Security Center.
Unusual Login Security Center detects unusual logons to your servers. You can configure approved logon IP addresses, time periods, and accounts. Logons from unapproved IP addresses, accounts, or time periods trigger alerts. You can manually add approved logon locations or configure the system to automatically update approved logon locations. You can also specify the assets on which alerts are triggered when unusual logon locations are detected.

Security Center can detect the following logon events:

  • Logons to Elastic Compute Service (ECS) instances from unapproved IP addresses
  • Logons to ECS instances from unapproved locations
  • Execution of unusual commands after logons to ECS instances by using Secure Shell (SSH)
  • Passwords of ECS instances cracked due to brute-force attacks based on the SSH protocol
For more information, see How can I detect unusual logons and receive alerts in the Security Center console?
Suspicious Event Security Center detects suspicious activities.
Sensitive File Tampering Security Center checks whether the sensitive files on your servers are tampered with. The sensitive files include pre-loaded configuration files in the shared libraries of Linux.
Malicious Process Security Center uses an agent to scan your servers in real time. If viruses are detected, Security Center generates alerts. You can handle the detected viruses in the Security Center console.

Security Center can detect the following malicious activities and processes:

  • Access to malicious IP addresses
  • Mining programs
  • Self-mutating trojans
  • Malicious programs
  • Trojans
For more information, see Cloud threat detection.
Unusual Network Connection Security Center detects unusual network connections and disconnections.

Security Center can detect the following suspicious network activities:

  • Proactive connections to malicious download sources.
  • Access to malicious domains.
  • Communication activities with mining pools.
  • Suspicious outbound connections.
  • Outbound connections of reverse shells. For more information, see Detect reverse shells from multiple dimensions.
  • Unusual connections in Windows.
  • Lateral movement attacks.
  • Suspicious scans on sensitive ports such as ports 22, 80, 443, and 3389.
Other Security Center detects unusual disconnections of the Security Center agent and network intrusions such as DDoS attacks.
Suspicious Account Security Center detects unapproved accounts that attempt to log on to your assets.
Application intrusion event Security Center detects intrusions that use system application components.
Cloud threat detection Security Center detects whether threats exist in the other Alibaba Cloud services that you have purchased. The threats include suspicious deletion of ECS security group rules.
Precise defense The antivirus feature provides precise protection against common ransomware, DDoS trojans, mining programs, trojans, malicious processes, webshells, and computer worms. For more information about how to enable the feature, see Use proactive defense.
Application Whitelist You can create a whitelist policy for servers that require reinforced protection. If the suspicious or malicious processes that are identified by the policy are not added to the whitelist, Security Center generates alerts.
Persistence Security Center detects suspicious scheduled tasks on servers. If persistent threats against the servers are detected, Security Center generates alerts.
Web Application Threat Detection Security Center detects intrusions that use web applications.
Malicious scripts Security Center detects whether the system services of your assets are attacked or modified by malicious scripts. If potential script attacks are detected, Security Center generates alerts.

Malicious scripts are classified into file-based scripts and fileless scripts. After an attacker gains control over a server, the attacker uses scripts for additional attacks. For example, the attacker may insert mining programs and webshells, or add administrator accounts to your system. Programming languages of malicious scripts include Bash, Python, Perl, PowerShell, Batch, and VBScript.

Threat intelligence Security Center uses the threat intelligence library developed by Alibaba Cloud to perform correlation analysis on access traffic and logs. Security Center also detects threat events, including access to malicious domains, malicious download sources, and malicious IP addresses.
Malicious Network Activity Security Center identifies unusual network behavior based on log data, such as packet content and server behavior. Unusual network behavior includes intrusions into servers by using network services and unusual behavior of compromised servers.
K8s Abnormal Behavior Security Center monitors the security status of running containers in a Kubernetes cluster. This allows you to detect security risks and intrusions at the earliest opportunity.

Log on to the Security Center console and click Settings in the left-side navigation pane. In the K8s Threat Detection section of the General tab, you can turn on Threat Detection to allow Security Center to detect the exceptions to Kubernetes clusters. For more information, see Use threat detection on Kubernetes containers.

Trusted exception Security Center detects whether your system processes have been modified and whether exceptions occur when you start the system.