Malware Detected

Back


Id	072ee087-17e1-474d-b162-bbe38bcab9f9
Rulename	Malware Detected
Description	Creates an incident when a Symantec Endpoint Proection agent detects malware and the malware was not cleaned.
Severity	Medium
Tactics	Execution
Techniques	T1204.002
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Symantec Endpoint Protection/Analytic Rules/MalwareDetected.yaml
Version	1.0.3
Arm template	072ee087-17e1-474d-b162-bbe38bcab9f9.json

KQL

SymantecEndpointProtection
| where LogType == "Agent Risk Logs"
| where CategorySet == "Malware"
| where ActualAction !contains "Cleaned"
| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) by SrcIpAddr, SrcHostName, UserName, FilePath, ActualAction, CategorySet, CategoryType

YAML

relevantTechniques:
- T1204.002
name: Malware Detected
triggerThreshold: 0
tactics:
- Execution
severity: Medium
id: 072ee087-17e1-474d-b162-bbe38bcab9f9
status: Available
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
kind: Scheduled
query: |
  SymantecEndpointProtection
  | where LogType == "Agent Risk Logs"
  | where CategorySet == "Malware"
  | where ActualAction !contains "Cleaned"
  | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) by SrcIpAddr, SrcHostName, UserName, FilePath, ActualAction, CategorySet, CategoryType  
description: |
    'Creates an incident when a Symantec Endpoint Proection agent detects malware and the malware was not cleaned.'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Symantec Endpoint Protection/Analytic Rules/MalwareDetected.yaml
triggerOperator: gt
queryPeriod: 1h
queryFrequency: 1h
version: 1.0.3
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: UserName
    identifier: FullName
- entityType: IP
  fieldMappings:
  - columnName: SrcIpAddr
    identifier: Address
- entityType: Host
  fieldMappings:
  - columnName: SrcHostName
    identifier: FullName

ARM