CyberArkEPM - Process started from different locations

Back


Id	0d4e62da-0a64-4532-b93e-28cd2940c300
Rulename	CyberArkEPM - Process started from different locations
Description	Detects when process started from different locations on a host.
Severity	Medium
Tactics	Execution DefenseEvasion
Techniques	T1204 T1036
Required data connectors	CyberArkEPM
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CyberArkEPM/Analytic Rules/CyberArkEPMProcessChangedStartLocation.yaml
Version	1.0.0
Arm template	0d4e62da-0a64-4532-b93e-28cd2940c300.json

KQL

CyberArkEPM
| where EventSubType != 'AttackAttempt'
| extend bin_path = tolower(extract(@'\A(.*)(\\|/)', 1, ActingProcessName))
| summarize p = makeset(bin_path) by ActingProcessFileInternalName, DvcId
| where array_length(p) > 1
| extend FileCustomEntity = ActingProcessFileInternalName

YAML

kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CyberArkEPM/Analytic Rules/CyberArkEPMProcessChangedStartLocation.yaml
query: |
  CyberArkEPM
  | where EventSubType != 'AttackAttempt'
  | extend bin_path = tolower(extract(@'\A(.*)(\\|/)', 1, ActingProcessName))
  | summarize p = makeset(bin_path) by ActingProcessFileInternalName, DvcId
  | where array_length(p) > 1
  | extend FileCustomEntity = ActingProcessFileInternalName  
requiredDataConnectors:
- dataTypes:
  - CyberArkEPM
  connectorId: CyberArkEPM
tactics:
- Execution
- DefenseEvasion
name: CyberArkEPM - Process started from different locations
relevantTechniques:
- T1204
- T1036
severity: Medium
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: FileCustomEntity
  entityType: File
queryFrequency: 1h
description: |
    'Detects when process started from different locations on a host.'
triggerThreshold: 0
triggerOperator: gt
version: 1.0.0
queryPeriod: 1h
id: 0d4e62da-0a64-4532-b93e-28cd2940c300

ARM