CyberArkEPM - Process started from different locations

Back


Id	0d4e62da-0a64-4532-b93e-28cd2940c300
Rulename	CyberArkEPM - Process started from different locations
Description	Detects when process started from different locations on a host.
Severity	Medium
Tactics	Execution DefenseEvasion
Techniques	T1204 T1036
Required data connectors	CyberArkEPM
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CyberArkEPM/Analytic Rules/CyberArkEPMProcessChangedStartLocation.yaml
Version	1.0.0
Arm template	0d4e62da-0a64-4532-b93e-28cd2940c300.json

KQL

CyberArkEPM
| where EventSubType != 'AttackAttempt'
| extend bin_path = tolower(extract(@'\A(.*)(\\|/)', 1, ActingProcessName))
| summarize p = makeset(bin_path) by ActingProcessFileInternalName, DvcId
| where array_length(p) > 1
| extend FileCustomEntity = ActingProcessFileInternalName

YAML

description: |
    'Detects when process started from different locations on a host.'
kind: Scheduled
tactics:
- Execution
- DefenseEvasion
requiredDataConnectors:
- connectorId: CyberArkEPM
  dataTypes:
  - CyberArkEPM
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CyberArkEPM/Analytic Rules/CyberArkEPMProcessChangedStartLocation.yaml
severity: Medium
name: CyberArkEPM - Process started from different locations
triggerThreshold: 0
queryPeriod: 1h
query: |
  CyberArkEPM
  | where EventSubType != 'AttackAttempt'
  | extend bin_path = tolower(extract(@'\A(.*)(\\|/)', 1, ActingProcessName))
  | summarize p = makeset(bin_path) by ActingProcessFileInternalName, DvcId
  | where array_length(p) > 1
  | extend FileCustomEntity = ActingProcessFileInternalName  
relevantTechniques:
- T1204
- T1036
id: 0d4e62da-0a64-4532-b93e-28cd2940c300
queryFrequency: 1h
entityMappings:
- entityType: File
  fieldMappings:
  - columnName: FileCustomEntity
    identifier: Name
triggerOperator: gt
version: 1.0.0

ARM