Trend Micro CAS - Infected user

Back


Id	3649dfb8-a5ca-47dd-8965-cd2f633ca533
Rulename	Trend Micro CAS - Infected user
Description	Detects when malware was detected for user account.
Severity	High
Tactics	InitialAccess
Techniques	T1566
Required data connectors	TrendMicroCAS
Kind	Scheduled
Query frequency	10m
Query period	10m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Cloud App Security/Analytic Rules/TrendMicroCASVAInfectedUser.yaml
Version	1.0.1
Arm template	3649dfb8-a5ca-47dd-8965-cd2f633ca533.json

KQL

TrendMicroCAS
| where EventType has_all ('virtual', 'analyzer')
| where isnotempty(VirusName)
| extend AccountCustomEntity = DstUserName, MalwareCustomEntity = VirusName

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Cloud App Security/Analytic Rules/TrendMicroCASVAInfectedUser.yaml
query: |
  TrendMicroCAS
  | where EventType has_all ('virtual', 'analyzer')
  | where isnotempty(VirusName)
  | extend AccountCustomEntity = DstUserName, MalwareCustomEntity = VirusName  
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
- entityType: Malware
  fieldMappings:
  - identifier: Name
    columnName: MalwareCustomEntity
kind: Scheduled
triggerOperator: gt
requiredDataConnectors:
- dataTypes:
  - TrendMicroCAS
  connectorId: TrendMicroCAS
tactics:
- InitialAccess
triggerThreshold: 0
description: |
    'Detects when malware was detected for user account.'
queryPeriod: 10m
version: 1.0.1
queryFrequency: 10m
severity: High
name: Trend Micro CAS - Infected user
id: 3649dfb8-a5ca-47dd-8965-cd2f633ca533
status: Available
relevantTechniques:
- T1566

ARM