SCC detection of commands on OS level

[nc2]

Is SCC able to detect remote commands / commands on an OS on a kernel level.

[andras · Accepted solution]

SCC does have a feature which can possibly cover some but possibly not the 100% of this use case. 

Virtual Machine Threat Detection, a built-in service of Security Command Center Premium and Enterprise, provides threat detection through hypervisor-level instrumentation and persistent disk analysis. VM Threat Detection detects potentially malicious applications, such as cryptocurrency mining software, kernel-mode rootkits, and malware running in compromised cloud environments.

For malware detection VM Threat Detection takes short-lived clones of your VM's persistent disk, without disrupting your workloads, and scans the disk clones. This service analyzes executable files on the VM to determine whether any files match known malware signatures. The generated finding contains information about the file and the malware signatures detected.

For memory scanning, VM Threat Detection scans each VM instance immediately after the instance is created. In addition, VM Threat Detection scans each VM instance every 30 minutes.

If you need more than this for use cases then you would need to consider some additional tools on the host OS to gather relevant logs.