Malware Detected

Back


Id	072ee087-17e1-474d-b162-bbe38bcab9f9
Rulename	Malware Detected
Description	Creates an incident when a Symantec Endpoint Proection agent detects malware and the malware was not cleaned.
Severity	Medium
Tactics	Execution
Techniques	T1204
Required data connectors	SymantecEndpointProtection SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Symantec Endpoint Protection/Analytic Rules/MalwareDetected.yaml
Version	1.0.1
Arm template	072ee087-17e1-474d-b162-bbe38bcab9f9.json

KQL

SymantecEndpointProtection
| where LogType == "Agent Risk Logs"
| where CategorySet == "Malware"
| where ActualAction !contains "Cleaned"
| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) by SrcIpAddr, SrcHostName, UserName, FilePath, ActualAction, CategorySet, CategoryType
| extend timestamp = StartTimeUtc, IPCustomEntity = SrcIpAddr, HostCustomEntity = SrcHostName, AccountCustomEntity = UserName

YAML

relevantTechniques:
- T1204
name: Malware Detected
requiredDataConnectors:
- dataTypes:
  - Syslog
  connectorId: SymantecEndpointProtection
- datatypes:
  - Syslog
  connectorId: SyslogAma
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
  entityType: Account
- fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
  entityType: IP
- fieldMappings:
  - identifier: FullName
    columnName: HostCustomEntity
  entityType: Host
triggerThreshold: 0
id: 072ee087-17e1-474d-b162-bbe38bcab9f9
tactics:
- Execution
version: 1.0.1
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Symantec Endpoint Protection/Analytic Rules/MalwareDetected.yaml
queryPeriod: 1h
kind: Scheduled
queryFrequency: 1h
severity: Medium
status: Available
description: |
    'Creates an incident when a Symantec Endpoint Proection agent detects malware and the malware was not cleaned.'
query: |
  SymantecEndpointProtection
  | where LogType == "Agent Risk Logs"
  | where CategorySet == "Malware"
  | where ActualAction !contains "Cleaned"
  | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) by SrcIpAddr, SrcHostName, UserName, FilePath, ActualAction, CategorySet, CategoryType
  | extend timestamp = StartTimeUtc, IPCustomEntity = SrcIpAddr, HostCustomEntity = SrcHostName, AccountCustomEntity = UserName  
triggerOperator: gt

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/072ee087-17e1-474d-b162-bbe38bcab9f9')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/072ee087-17e1-474d-b162-bbe38bcab9f9')]",
      "properties": {
        "alertRuleTemplateName": "072ee087-17e1-474d-b162-bbe38bcab9f9",
        "customDetails": null,
        "description": "'Creates an incident when a Symantec Endpoint Proection agent detects malware and the malware was not cleaned.'\n",
        "displayName": "Malware Detected",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "HostCustomEntity",
                "identifier": "FullName"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Symantec Endpoint Protection/Analytic Rules/MalwareDetected.yaml",
        "query": "SymantecEndpointProtection\n| where LogType == \"Agent Risk Logs\"\n| where CategorySet == \"Malware\"\n| where ActualAction !contains \"Cleaned\"\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) by SrcIpAddr, SrcHostName, UserName, FilePath, ActualAction, CategorySet, CategoryType\n| extend timestamp = StartTimeUtc, IPCustomEntity = SrcIpAddr, HostCustomEntity = SrcHostName, AccountCustomEntity = UserName\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Execution"
        ],
        "techniques": [
          "T1204"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}