Sentinel One - Agent uninstalled from multiple hosts

Back


Id	4ad87e4a-d045-4c6b-9652-c9de27fcb442
Rulename	Sentinel One - Agent uninstalled from multiple hosts
Description	Detects when agent was uninstalled from multiple hosts.
Severity	High
Tactics	DefenseEvasion
Techniques	T1070
Required data connectors	SentinelOne
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SentinelOne/Analytic Rules/SentinelOneAgentUninstalled.yaml
Version	1.0.2
Arm template	4ad87e4a-d045-4c6b-9652-c9de27fcb442.json

KQL

SentinelOne
| where ActivityType == 51
| summarize count() by DataComputerName, bin(TimeGenerated, 30m)
| where count_ > 1

YAML

description: |
    'Detects when agent was uninstalled from multiple hosts.'
kind: Scheduled
tactics:
- DefenseEvasion
requiredDataConnectors:
- connectorId: SentinelOne
  dataTypes:
  - SentinelOne
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SentinelOne/Analytic Rules/SentinelOneAgentUninstalled.yaml
severity: High
name: Sentinel One - Agent uninstalled from multiple hosts
triggerThreshold: 0
queryPeriod: 1h
query: |
  SentinelOne
  | where ActivityType == 51
  | summarize count() by DataComputerName, bin(TimeGenerated, 30m)
  | where count_ > 1  
relevantTechniques:
- T1070
id: 4ad87e4a-d045-4c6b-9652-c9de27fcb442
queryFrequency: 1h
status: Available
triggerOperator: gt
version: 1.0.2
entityMappings:
- entityType: Host
  fieldMappings:
  - columnName: DataComputerName
    identifier: HostName

ARM