Pathlock TDnR - Critical File Integrity Changes | Microsoft Sentinel Analytic Rules

Back


Id	2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c24
Rulename	Pathlock TDnR - Critical File Integrity Changes
Description	Detects changes to checksums of critical SAP files, forwarded by Pathlock Threat Detection and Response. File integrity violations may indicate malware installation, unauthorized patching, or tampering with SAP executables and configuration files.
Severity	High
Tactics	DefenseEvasion Persistence
Techniques	T1562 T1036
Required data connectors	Pathlock_TDnR
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Pathlock_TDnR/Analytic%20Rules/Pathlock_TDnR_FILE_CHECKSUM.yaml
Version	1.0.0
Arm template	2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c24.json

KQL

Pathlock_TDnR_CL
| where DataSource == "FILE_CHECKSUM"
| project TimeGenerated, Sysid, DataSource, Eventid, Instance, Hostname, Bname,
          Tcode, Report, Area, Subid, SrcIp, DestIp, AffectedUser, LogLine,
          MsgType, MsgId, MsgNo, MessageV1, MessageV2, MessageV3, MessageV4, CentralTs

YAML

tactics:
- DefenseEvasion
- Persistence
requiredDataConnectors:
- dataTypes:
  - Pathlock_TDnR_CL
  connectorId: Pathlock_TDnR
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    groupByAlertDetails: []
    groupByEntities: []
    matchingMethod: AnyAlert
    groupByCustomDetails: []
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 5h
queryPeriod: 1h
severity: High
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Pathlock_TDnR/Analytic%20Rules/Pathlock_TDnR_FILE_CHECKSUM.yaml
queryFrequency: 1h
kind: Scheduled
description: Detects changes to checksums of critical SAP files, forwarded by Pathlock Threat Detection and Response. File integrity violations may indicate malware installation, unauthorized patching, or tampering with SAP executables and configuration files.
id: 2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c24
triggerOperator: gt
status: Available
relevantTechniques:
- T1562
- T1036
suppressionDuration: 5h
version: 1.0.0
triggerThreshold: 0
suppressionEnabled: false
name: Pathlock TDnR - Critical File Integrity Changes
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: Bname
    identifier: Name
- entityType: Host
  fieldMappings:
  - columnName: Hostname
    identifier: HostName
- entityType: IP
  fieldMappings:
  - columnName: SrcIp
    identifier: Address
query: |
  Pathlock_TDnR_CL
  | where DataSource == "FILE_CHECKSUM"
  | project TimeGenerated, Sysid, DataSource, Eventid, Instance, Hostname, Bname,
            Tcode, Report, Area, Subid, SrcIp, DestIp, AffectedUser, LogLine,
            MsgType, MsgId, MsgNo, MessageV1, MessageV2, MessageV3, MessageV4, CentralTs

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c24')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c24')]",
      "properties": {
        "alertRuleTemplateName": "2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c24",
        "customDetails": null,
        "description": "Detects changes to checksums of critical SAP files, forwarded by Pathlock Threat Detection and Response. File integrity violations may indicate malware installation, unauthorized patching, or tampering with SAP executables and configuration files.",
        "displayName": "Pathlock TDnR - Critical File Integrity Changes",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "Bname",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "Hostname",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SrcIp",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByAlertDetails": [],
            "groupByCustomDetails": [],
            "groupByEntities": [],
            "lookbackDuration": "PT5H",
            "matchingMethod": "AnyAlert",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Pathlock_TDnR/Analytic%20Rules/Pathlock_TDnR_FILE_CHECKSUM.yaml",
        "query": "Pathlock_TDnR_CL\n| where DataSource == \"FILE_CHECKSUM\"\n| project TimeGenerated, Sysid, DataSource, Eventid, Instance, Hostname, Bname,\n          Tcode, Report, Area, Subid, SrcIp, DestIp, AffectedUser, LogLine,\n          MsgType, MsgId, MsgNo, MessageV1, MessageV2, MessageV3, MessageV4, CentralTs\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion",
          "Persistence"
        ],
        "techniques": [
          "T1036",
          "T1562"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}