Sentinel One - Agent uninstalled from multiple hosts

Back


Id	4ad87e4a-d045-4c6b-9652-c9de27fcb442
Rulename	Sentinel One - Agent uninstalled from multiple hosts
Description	Detects when agent was uninstalled from multiple hosts.
Severity	High
Tactics	DefenseEvasion
Techniques	T1070
Required data connectors	SentinelOne
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SentinelOne/Analytic Rules/SentinelOneAgentUninstalled.yaml
Version	1.0.2
Arm template	4ad87e4a-d045-4c6b-9652-c9de27fcb442.json

KQL

SentinelOne
| where ActivityType == 51
| summarize count() by DataComputerName, bin(TimeGenerated, 30m)
| where count_ > 1

YAML

name: Sentinel One - Agent uninstalled from multiple hosts
relevantTechniques:
- T1070
id: 4ad87e4a-d045-4c6b-9652-c9de27fcb442
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SentinelOne/Analytic Rules/SentinelOneAgentUninstalled.yaml
requiredDataConnectors:
- dataTypes:
  - SentinelOne
  connectorId: SentinelOne
version: 1.0.2
severity: High
triggerThreshold: 0
queryPeriod: 1h
entityMappings:
- fieldMappings:
  - identifier: HostName
    columnName: DataComputerName
  entityType: Host
queryFrequency: 1h
status: Available
query: |
  SentinelOne
  | where ActivityType == 51
  | summarize count() by DataComputerName, bin(TimeGenerated, 30m)
  | where count_ > 1  
tactics:
- DefenseEvasion
kind: Scheduled
description: |
    'Detects when agent was uninstalled from multiple hosts.'
triggerOperator: gt

ARM