CyberArkEPM - Process started from different locations

Back


Id	0d4e62da-0a64-4532-b93e-28cd2940c300
Rulename	CyberArkEPM - Process started from different locations
Description	Detects when process started from different locations on a host.
Severity	Medium
Tactics	Execution DefenseEvasion
Techniques	T1204 T1036
Required data connectors	CyberArkEPM
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CyberArkEPM/Analytic Rules/CyberArkEPMProcessChangedStartLocation.yaml
Version	1.0.0
Arm template	0d4e62da-0a64-4532-b93e-28cd2940c300.json

KQL

CyberArkEPM
| where EventSubType != 'AttackAttempt'
| extend bin_path = tolower(extract(@'\A(.*)(\\|/)', 1, ActingProcessName))
| summarize p = makeset(bin_path) by ActingProcessFileInternalName, DvcId
| where array_length(p) > 1
| extend FileCustomEntity = ActingProcessFileInternalName

YAML

name: CyberArkEPM - Process started from different locations
id: 0d4e62da-0a64-4532-b93e-28cd2940c300
description: |
    'Detects when process started from different locations on a host.'
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - columnName: FileCustomEntity
    identifier: Name
  entityType: File
version: 1.0.0
triggerOperator: gt
query: |
  CyberArkEPM
  | where EventSubType != 'AttackAttempt'
  | extend bin_path = tolower(extract(@'\A(.*)(\\|/)', 1, ActingProcessName))
  | summarize p = makeset(bin_path) by ActingProcessFileInternalName, DvcId
  | where array_length(p) > 1
  | extend FileCustomEntity = ActingProcessFileInternalName  
tactics:
- Execution
- DefenseEvasion
kind: Scheduled
queryFrequency: 1h
severity: Medium
queryPeriod: 1h
requiredDataConnectors:
- dataTypes:
  - CyberArkEPM
  connectorId: CyberArkEPM
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CyberArkEPM/Analytic Rules/CyberArkEPMProcessChangedStartLocation.yaml
relevantTechniques:
- T1204
- T1036

ARM