Sentinel One - Agent uninstalled from multiple hosts

Back


Id	4ad87e4a-d045-4c6b-9652-c9de27fcb442
Rulename	Sentinel One - Agent uninstalled from multiple hosts
Description	Detects when agent was uninstalled from multiple hosts.
Severity	High
Tactics	DefenseEvasion
Techniques	T1070
Required data connectors	SentinelOne
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SentinelOne/Analytic Rules/SentinelOneAgentUninstalled.yaml
Version	1.0.2
Arm template	4ad87e4a-d045-4c6b-9652-c9de27fcb442.json

KQL

SentinelOne
| where ActivityType == 51
| summarize count() by DataComputerName, bin(TimeGenerated, 30m)
| where count_ > 1

YAML

relevantTechniques:
- T1070
entityMappings:
- fieldMappings:
  - columnName: DataComputerName
    identifier: HostName
  entityType: Host
triggerThreshold: 0
description: |
    'Detects when agent was uninstalled from multiple hosts.'
requiredDataConnectors:
- connectorId: SentinelOne
  dataTypes:
  - SentinelOne
triggerOperator: gt
version: 1.0.2
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SentinelOne/Analytic Rules/SentinelOneAgentUninstalled.yaml
id: 4ad87e4a-d045-4c6b-9652-c9de27fcb442
queryFrequency: 1h
query: |
  SentinelOne
  | where ActivityType == 51
  | summarize count() by DataComputerName, bin(TimeGenerated, 30m)
  | where count_ > 1  
severity: High
status: Available
queryPeriod: 1h
name: Sentinel One - Agent uninstalled from multiple hosts
tactics:
- DefenseEvasion
kind: Scheduled

ARM