Sentinel One - Agent uninstalled from multiple hosts

Back


Id	4ad87e4a-d045-4c6b-9652-c9de27fcb442
Rulename	Sentinel One - Agent uninstalled from multiple hosts
Description	Detects when agent was uninstalled from multiple hosts.
Severity	High
Tactics	DefenseEvasion
Techniques	T1070
Required data connectors	SentinelOne
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SentinelOne/Analytic Rules/SentinelOneAgentUninstalled.yaml
Version	1.0.2
Arm template	4ad87e4a-d045-4c6b-9652-c9de27fcb442.json

KQL

SentinelOne
| where ActivityType == 51
| summarize count() by DataComputerName, bin(TimeGenerated, 30m)
| where count_ > 1

YAML

description: |
    'Detects when agent was uninstalled from multiple hosts.'
tactics:
- DefenseEvasion
severity: High
entityMappings:
- fieldMappings:
  - columnName: DataComputerName
    identifier: HostName
  entityType: Host
queryFrequency: 1h
triggerOperator: gt
status: Available
query: |
  SentinelOne
  | where ActivityType == 51
  | summarize count() by DataComputerName, bin(TimeGenerated, 30m)
  | where count_ > 1  
name: Sentinel One - Agent uninstalled from multiple hosts
version: 1.0.2
triggerThreshold: 0
id: 4ad87e4a-d045-4c6b-9652-c9de27fcb442
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SentinelOne/Analytic Rules/SentinelOneAgentUninstalled.yaml
relevantTechniques:
- T1070
queryPeriod: 1h
kind: Scheduled
requiredDataConnectors:
- dataTypes:
  - SentinelOne
  connectorId: SentinelOne

ARM