McAfee ePO - Attempt uninstall McAfee agent

Back


Id	2eff5809-bf84-48e0-8288-768689672c37
Rulename	McAfee ePO - Attempt uninstall McAfee agent
Description	Detects attempts uninstalling McAfee agent on host.
Severity	Medium
Tactics	DefenseEvasion
Techniques	T1562 T1070
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee ePolicy Orchestrator/Analytic Rules/McAfeeEPOAttemptUninstallAgent.yaml
Version	1.0.2
Arm template	2eff5809-bf84-48e0-8288-768689672c37.json

KQL

McAfeeEPOEvent
| where EventId == '2413'
| extend IPCustomEntity = DvcIpAddr, HostCustomEntity = DvcHostname

YAML

queryFrequency: 1h
queryPeriod: 1h
id: 2eff5809-bf84-48e0-8288-768689672c37
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee ePolicy Orchestrator/Analytic Rules/McAfeeEPOAttemptUninstallAgent.yaml
tactics:
- DefenseEvasion
version: 1.0.2
severity: Medium
description: |
    'Detects attempts uninstalling McAfee agent on host.'
entityMappings:
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: HostCustomEntity
    identifier: FullName
  entityType: Host
query: |
  McAfeeEPOEvent
  | where EventId == '2413'
  | extend IPCustomEntity = DvcIpAddr, HostCustomEntity = DvcHostname  
triggerThreshold: 0
kind: Scheduled
triggerOperator: gt
relevantTechniques:
- T1562
- T1070
name: McAfee ePO - Attempt uninstall McAfee agent
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
status: Available

ARM