BTP - Malware detected in BAS dev space

Back


Id	31997e9a-7447-47f3-8208-4f5d7efe497c
Rulename	BTP - Malware detected in BAS dev space
Description	Identifies instances of malware detected using SAP internal malware agent within Business Application Studio dev spaces.
Severity	Medium
Tactics	ResourceDevelopment Execution Persistence
Techniques	T1584 T1072 T0873
Required data connectors	SAPBTPAuditEvents
Kind	Scheduled
Query frequency	15m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP BTP/Analytic Rules/BTP - Malware detected in BAS dev space.yaml
Version	3.0.7
Arm template	31997e9a-7447-47f3-8208-4f5d7efe497c.json

KQL

SAPBTPAuditLog_CL
| where Message has "malware"
| extend MessageData = parse_json(tostring(Message.data))
| extend
    ClusterID = tostring(MessageData.clusterID),
    WorkspaceID = tostring(MessageData.wsID),
    Message = tostring(MessageData.message)
| parse Message with * 'user: ' User '.The following issues were detected: ' Malware ',' *
| extend
    AccountName = tostring(split(User, '@')[0]),
    UPNSuffix = tostring(split(User, '@')[1])
| project
    UpdatedOn,
    ClusterID,
    WorkspaceID,
    Message,
    User,
    Malware,
    Tenant,
    SpaceId,
    Category,
    CloudApp = "SAP BTP",
    AccountName,
    UPNSuffix

YAML

alertDetailsOverride:
  alertDisplayNameFormat: BTP - Malware detected in Business Apps Studio dev space
  alertDescriptionFormat: 'Malware was found in the following subaccount: {{Tenant}}'
requiredDataConnectors:
- connectorId: SAPBTPAuditEvents
  dataTypes:
  - SAPBTPAuditLog_CL
tactics:
- ResourceDevelopment
- Execution
- Persistence
description: Identifies instances of malware detected using SAP internal malware agent within Business Application Studio dev spaces.
query: |
  SAPBTPAuditLog_CL
  | where Message has "malware"
  | extend MessageData = parse_json(tostring(Message.data))
  | extend
      ClusterID = tostring(MessageData.clusterID),
      WorkspaceID = tostring(MessageData.wsID),
      Message = tostring(MessageData.message)
  | parse Message with * 'user: ' User '.The following issues were detected: ' Malware ',' *
  | extend
      AccountName = tostring(split(User, '@')[0]),
      UPNSuffix = tostring(split(User, '@')[1])
  | project
      UpdatedOn,
      ClusterID,
      WorkspaceID,
      Message,
      User,
      Malware,
      Tenant,
      SpaceId,
      Category,
      CloudApp = "SAP BTP",
      AccountName,
      UPNSuffix  
id: 31997e9a-7447-47f3-8208-4f5d7efe497c
triggerOperator: gt
eventGroupingSettings:
  aggregationKind: SingleAlert
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP BTP/Analytic Rules/BTP - Malware detected in BAS dev space.yaml
queryFrequency: 15m
severity: Medium
entityMappings:
- fieldMappings:
  - columnName: CloudApp
    identifier: Name
  entityType: CloudApplication
- fieldMappings:
  - columnName: AccountName
    identifier: Name
  - columnName: UPNSuffix
    identifier: UPNSuffix
  entityType: Account
- fieldMappings:
  - columnName: Malware
    identifier: Name
  entityType: Malware
name: BTP - Malware detected in BAS dev space
queryPeriod: 15m
relevantTechniques:
- T1584
- T1072
- T0873
kind: Scheduled
triggerThreshold: 0
version: 3.0.7

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/31997e9a-7447-47f3-8208-4f5d7efe497c')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/31997e9a-7447-47f3-8208-4f5d7efe497c')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Malware was found in the following subaccount: {{Tenant}}",
          "alertDisplayNameFormat": "BTP - Malware detected in Business Apps Studio dev space"
        },
        "alertRuleTemplateName": "31997e9a-7447-47f3-8208-4f5d7efe497c",
        "customDetails": null,
        "description": "Identifies instances of malware detected using SAP internal malware agent within Business Application Studio dev spaces.",
        "displayName": "BTP - Malware detected in BAS dev space",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "CloudApp",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountName",
                "identifier": "Name"
              },
              {
                "columnName": "UPNSuffix",
                "identifier": "UPNSuffix"
              }
            ]
          },
          {
            "entityType": "Malware",
            "fieldMappings": [
              {
                "columnName": "Malware",
                "identifier": "Name"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP BTP/Analytic Rules/BTP - Malware detected in BAS dev space.yaml",
        "query": "SAPBTPAuditLog_CL\n| where Message has \"malware\"\n| extend MessageData = parse_json(tostring(Message.data))\n| extend\n    ClusterID = tostring(MessageData.clusterID),\n    WorkspaceID = tostring(MessageData.wsID),\n    Message = tostring(MessageData.message)\n| parse Message with * 'user: ' User '.The following issues were detected: ' Malware ',' *\n| extend\n    AccountName = tostring(split(User, '@')[0]),\n    UPNSuffix = tostring(split(User, '@')[1])\n| project\n    UpdatedOn,\n    ClusterID,\n    WorkspaceID,\n    Message,\n    User,\n    Malware,\n    Tenant,\n    SpaceId,\n    Category,\n    CloudApp = \"SAP BTP\",\n    AccountName,\n    UPNSuffix\n",
        "queryFrequency": "PT15M",
        "queryPeriod": "PT15M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Execution",
          "Persistence",
          "ResourceDevelopment"
        ],
        "techniques": [
          "T1072",
          "T1584"
        ],
        "templateVersion": "3.0.7",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}