Silverfort - Remote service installation | Microsoft Sentinel Analytic Rules

Back


Id	30df57e3-043a-5a71-9d78-dc328ecbd42b
Rulename	Silverfort - Remote service installation
Description	Identifies Silverfort incidents involving creation of new system services on a host. This behavior may indicate remote code execution using tools such as PsExec or PAExec.
Severity	High
Tactics	Execution Persistence PrivilegeEscalation
Techniques	T1569.002 T1543.003
Required data connectors	SilverfortAma
Kind	Scheduled
Query frequency	15m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Silverfort/Analytic%20Rules/RemoteServiceInstallation.yaml
Version	1.0.0
Arm template	30df57e3-043a-5a71-9d78-dc328ecbd42b.json

KQL

CommonSecurityLog
| where DeviceVendor has 'Silverfort'
| where DeviceProduct has 'Admin Console'
| where DeviceEventClassID == "NewIncident"
| where Message has "RemoteServiceInstallation"
| extend IncidentData = parse_json(replace('^""|""$', '', Message))
| extend IncidentKind = coalesce(tostring(IncidentData.data.kind), tostring(IncidentData.kind))
| extend IncidentId = tostring(coalesce(IncidentData.data.id, IncidentData.id))
| extend IncidentSummary = tostring(coalesce(IncidentData.data.summary, IncidentData.summary))
| extend UserName = coalesce(
    tostring(IncidentData.data.users[0].samAccountName),
    tostring(IncidentData.data.users[0].upn),
    tostring(IncidentData.data.users[0].displayName),
    tostring(IncidentData.users[0].displayName)
)
| extend SourceHost = coalesce(
    tostring(IncidentData.data.sources[0].displayName),
    tostring(IncidentData.sources[0].displayName)
)
| extend DestinationHost = coalesce(
    tostring(IncidentData.data.destinations[0].displayName),
    tostring(IncidentData.destinations[0].displayName)
)

YAML

triggerThreshold: 0
customDetails:
  IncidentReference: IncidentId
  IncidentSummary: IncidentSummary
  IncidentKind: IncidentKind
tactics:
- Execution
- Persistence
- PrivilegeEscalation
status: Available
queryPeriod: 15m
queryFrequency: 15m
requiredDataConnectors:
- connectorId: SilverfortAma
  dataTypes:
  - CommonSecurityLog
query: |-
  CommonSecurityLog
  | where DeviceVendor has 'Silverfort'
  | where DeviceProduct has 'Admin Console'
  | where DeviceEventClassID == "NewIncident"
  | where Message has "RemoteServiceInstallation"
  | extend IncidentData = parse_json(replace('^""|""$', '', Message))
  | extend IncidentKind = coalesce(tostring(IncidentData.data.kind), tostring(IncidentData.kind))
  | extend IncidentId = tostring(coalesce(IncidentData.data.id, IncidentData.id))
  | extend IncidentSummary = tostring(coalesce(IncidentData.data.summary, IncidentData.summary))
  | extend UserName = coalesce(
      tostring(IncidentData.data.users[0].samAccountName),
      tostring(IncidentData.data.users[0].upn),
      tostring(IncidentData.data.users[0].displayName),
      tostring(IncidentData.users[0].displayName)
  )
  | extend SourceHost = coalesce(
      tostring(IncidentData.data.sources[0].displayName),
      tostring(IncidentData.sources[0].displayName)
  )
  | extend DestinationHost = coalesce(
      tostring(IncidentData.data.destinations[0].displayName),
      tostring(IncidentData.destinations[0].displayName)
  )
relevantTechniques:
- T1569.002
- T1543.003
name: Silverfort - Remote service installation
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Silverfort/Analytic%20Rules/RemoteServiceInstallation.yaml
severity: High
description: |
  Identifies Silverfort incidents involving creation of new system services on a host. This behavior may indicate remote code execution using tools such as PsExec or PAExec.
triggerOperator: gt
id: 30df57e3-043a-5a71-9d78-dc328ecbd42b
version: 1.0.0
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: UserName
    identifier: Name
- entityType: Host
  fieldMappings:
  - columnName: SourceHost
    identifier: HostName
- entityType: Host
  fieldMappings:
  - columnName: DestinationHost
    identifier: HostName

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/30df57e3-043a-5a71-9d78-dc328ecbd42b')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/30df57e3-043a-5a71-9d78-dc328ecbd42b')]",
      "properties": {
        "alertRuleTemplateName": "30df57e3-043a-5a71-9d78-dc328ecbd42b",
        "customDetails": {
          "IncidentKind": "IncidentKind",
          "IncidentReference": "IncidentId",
          "IncidentSummary": "IncidentSummary"
        },
        "description": "Identifies Silverfort incidents involving creation of new system services on a host. This behavior may indicate remote code execution using tools such as PsExec or PAExec.\n",
        "displayName": "Silverfort - Remote service installation",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "UserName",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "SourceHost",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "DestinationHost",
                "identifier": "HostName"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Silverfort/Analytic%20Rules/RemoteServiceInstallation.yaml",
        "query": "CommonSecurityLog\n| where DeviceVendor has 'Silverfort'\n| where DeviceProduct has 'Admin Console'\n| where DeviceEventClassID == \"NewIncident\"\n| where Message has \"RemoteServiceInstallation\"\n| extend IncidentData = parse_json(replace('^\"\"|\"\"$', '', Message))\n| extend IncidentKind = coalesce(tostring(IncidentData.data.kind), tostring(IncidentData.kind))\n| extend IncidentId = tostring(coalesce(IncidentData.data.id, IncidentData.id))\n| extend IncidentSummary = tostring(coalesce(IncidentData.data.summary, IncidentData.summary))\n| extend UserName = coalesce(\n    tostring(IncidentData.data.users[0].samAccountName),\n    tostring(IncidentData.data.users[0].upn),\n    tostring(IncidentData.data.users[0].displayName),\n    tostring(IncidentData.users[0].displayName)\n)\n| extend SourceHost = coalesce(\n    tostring(IncidentData.data.sources[0].displayName),\n    tostring(IncidentData.sources[0].displayName)\n)\n| extend DestinationHost = coalesce(\n    tostring(IncidentData.data.destinations[0].displayName),\n    tostring(IncidentData.destinations[0].displayName)\n)",
        "queryFrequency": "PT15M",
        "queryPeriod": "PT15M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [
          "T1569.002",
          "T1543.003"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Execution",
          "Persistence",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1543",
          "T1569"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}