Aqua Blizzard AV hits - Feb 2022

Back


Id	18dbdc22-b69f-4109-9e39-723d9465f45f
Rulename	Aqua Blizzard AV hits - Feb 2022
Description	Identifies a match in the Security Alert table for MDATP hits related to the Aqua Blizzard actor
Severity	High
Tactics	Persistence
Techniques	T1137
Required data connectors	MicrosoftDefenderAdvancedThreatProtection
Kind	Scheduled
Query frequency	6h
Query period	6h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/MicrosoftDefenderForEndpoint/Analytic Rules/AquaBlizzardAVHits.yaml
Version	1.0.2
Arm template	18dbdc22-b69f-4109-9e39-723d9465f45f.json

KQL

let iocs = externaldata(DateAdded:string,IoC:string,Type:string) [@"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/ActiniumIOC.csv"] with (format="csv", ignoreFirstRecord=True);
let AVHits = (iocs | where Type =~ "AVDetection"| project IoC);
SecurityAlert
| where ProviderName == 'MDATP'
| extend ThreatName_ = tostring(parse_json(ExtendedProperties).ThreatName)
| where ThreatName_ has_any (AVHits)
| extend Directory = tostring(parse_json(Entities)[0].Directory), SHA256 = tostring(parse_json(tostring(parse_json(Entities)[0].FileHashes))[2].Value), FileName = tostring(parse_json(Entities)[0].Name), Hostname = tostring(parse_json(Entities)[6].FQDN)| extend AccountName = tostring(parse_json(tostring(parse_json(Entities)[6].LoggedOnUsers))[0].AccountName)
| project TimeGenerated, AlertName, ThreatName_, ProviderName, AlertSeverity, Description, RemediationSteps, ExtendedProperties, Entities, FileName,SHA256, Directory, Hostname, AccountName
| extend FileHash = SHA256, FileHashType = "SHA256"
| extend Name = tostring(split(AccountName, "@")[0]), AccountUPNSuffix = tostring(split(AccountName, "@")[1])
| extend Host = tostring(split(Hostname, ".")[0]), DomainIndex = toint(indexof(Hostname, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(Hostname, DomainIndex + 1), Hostname)

YAML

queryPeriod: 6h
query: |
  let iocs = externaldata(DateAdded:string,IoC:string,Type:string) [@"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/ActiniumIOC.csv"] with (format="csv", ignoreFirstRecord=True);
  let AVHits = (iocs | where Type =~ "AVDetection"| project IoC);
  SecurityAlert
  | where ProviderName == 'MDATP'
  | extend ThreatName_ = tostring(parse_json(ExtendedProperties).ThreatName)
  | where ThreatName_ has_any (AVHits)
  | extend Directory = tostring(parse_json(Entities)[0].Directory), SHA256 = tostring(parse_json(tostring(parse_json(Entities)[0].FileHashes))[2].Value), FileName = tostring(parse_json(Entities)[0].Name), Hostname = tostring(parse_json(Entities)[6].FQDN)| extend AccountName = tostring(parse_json(tostring(parse_json(Entities)[6].LoggedOnUsers))[0].AccountName)
  | project TimeGenerated, AlertName, ThreatName_, ProviderName, AlertSeverity, Description, RemediationSteps, ExtendedProperties, Entities, FileName,SHA256, Directory, Hostname, AccountName
  | extend FileHash = SHA256, FileHashType = "SHA256"
  | extend Name = tostring(split(AccountName, "@")[0]), AccountUPNSuffix = tostring(split(AccountName, "@")[1])
  | extend Host = tostring(split(Hostname, ".")[0]), DomainIndex = toint(indexof(Hostname, '.'))
  | extend HostNameDomain = iff(DomainIndex != -1, substring(Hostname, DomainIndex + 1), Hostname)  
name: Aqua Blizzard AV hits - Feb 2022
entityMappings:
- fieldMappings:
  - columnName: AccountName
    identifier: FullName
  - columnName: Name
    identifier: Name
  - columnName: AccountUPNSuffix
    identifier: UPNSuffix
  entityType: Account
- fieldMappings:
  - columnName: Hostname
    identifier: FullName
  - columnName: Name
    identifier: HostName
  - columnName: HostNameDomain
    identifier: NTDomain
  entityType: Host
- fieldMappings:
  - columnName: FileHashType
    identifier: Algorithm
  - columnName: FileHash
    identifier: Value
  entityType: FileHash
queryFrequency: 6h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/MicrosoftDefenderForEndpoint/Analytic Rules/AquaBlizzardAVHits.yaml
tags:
- Aqua Blizzard
requiredDataConnectors:
- connectorId: MicrosoftDefenderAdvancedThreatProtection
  dataTypes:
  - SecurityAlert (MDATP)
description: |
    'Identifies a match in the Security Alert table for MDATP hits related to the Aqua Blizzard actor'
kind: Scheduled
version: 1.0.2
status: Available
severity: High
relevantTechniques:
- T1137
triggerOperator: gt
triggerThreshold: 0
tactics:
- Persistence
id: 18dbdc22-b69f-4109-9e39-723d9465f45f

ARM