Process-Level Anomaly | Microsoft Sentinel Analytic Rules

Back


Id	3fa85f64-5717-4562-b3fc-2c963f66afa6
Rulename	Process-Level Anomaly
Description	Triggers an incident when the same process name appears in 50 or more alerts across multiple devices, suggesting widespread activity.
Severity	Medium
Tactics	Execution DefenseEvasion
Techniques	T1059 T1204
Required data connectors	MorphisecCCF
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Morphisec/Analytic%20Rules/MorphisecProcessLevelAnomaly.yaml
Version	1.0.0
Arm template	3fa85f64-5717-4562-b3fc-2c963f66afa6.json

KQL

MorphisecAlerts_CL
| where threatMessageArrivalTime >= ago(24h)
| summarize 
    AlertCount = dcount(id),
    DeviceCount = dcount(hostname)
    by application
| where AlertCount >= 50 and DeviceCount > 1

YAML

incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    lookbackDuration: 5h
    reopenClosedIncident: false
    enabled: false
    matchingMethod: AllEntities
query: |
  MorphisecAlerts_CL
  | where threatMessageArrivalTime >= ago(24h)
  | summarize 
      AlertCount = dcount(id),
      DeviceCount = dcount(hostname)
      by application
  | where AlertCount >= 50 and DeviceCount > 1
suppressionEnabled: false
eventGroupingSettings:
  aggregationKind: SingleAlert
id: 3fa85f64-5717-4562-b3fc-2c963f66afa6
queryFrequency: 1d
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Morphisec/Analytic%20Rules/MorphisecProcessLevelAnomaly.yaml
suppressionDuration: 5h
version: 1.0.0
severity: Medium
relevantTechniques:
- T1059
- T1204
name: Process-Level Anomaly
kind: Scheduled
tactics:
- Execution
- DefenseEvasion
requiredDataConnectors:
- dataTypes:
  - Morphisec
  connectorId: MorphisecCCF
description: |
  'Triggers an incident when the same process name appears in 50 or more alerts across multiple devices, suggesting widespread activity.'
customDetails:
  ProcessName: application
triggerOperator: gt
triggerThreshold: 0
queryPeriod: 1d

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/3fa85f64-5717-4562-b3fc-2c963f66afa6')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/3fa85f64-5717-4562-b3fc-2c963f66afa6')]",
      "properties": {
        "alertRuleTemplateName": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
        "customDetails": {
          "ProcessName": "application"
        },
        "description": "'Triggers an incident when the same process name appears in 50 or more alerts across multiple devices, suggesting widespread activity.'\n",
        "displayName": "Process-Level Anomaly",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Morphisec/Analytic%20Rules/MorphisecProcessLevelAnomaly.yaml",
        "query": "MorphisecAlerts_CL\n| where threatMessageArrivalTime >= ago(24h)\n| summarize \n    AlertCount = dcount(id),\n    DeviceCount = dcount(hostname)\n    by application\n| where AlertCount >= 50 and DeviceCount > 1\n",
        "queryFrequency": "P1D",
        "queryPeriod": "P1D",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion",
          "Execution"
        ],
        "techniques": [
          "T1059",
          "T1204"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}