Sentinel One - Agent uninstalled from multiple hosts

Back


Id	4ad87e4a-d045-4c6b-9652-c9de27fcb442
Rulename	Sentinel One - Agent uninstalled from multiple hosts
Description	Detects when agent was uninstalled from multiple hosts.
Severity	High
Tactics	DefenseEvasion
Techniques	T1070
Required data connectors	SentinelOne
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SentinelOne/Analytic Rules/SentinelOneAgentUninstalled.yaml
Version	1.0.2
Arm template	4ad87e4a-d045-4c6b-9652-c9de27fcb442.json

KQL

SentinelOne
| where ActivityType == 51
| summarize count() by DataComputerName, bin(TimeGenerated, 30m)
| where count_ > 1

YAML

queryFrequency: 1h
id: 4ad87e4a-d045-4c6b-9652-c9de27fcb442
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SentinelOne/Analytic Rules/SentinelOneAgentUninstalled.yaml
query: |
  SentinelOne
  | where ActivityType == 51
  | summarize count() by DataComputerName, bin(TimeGenerated, 30m)
  | where count_ > 1  
queryPeriod: 1h
kind: Scheduled
status: Available
name: Sentinel One - Agent uninstalled from multiple hosts
triggerThreshold: 0
relevantTechniques:
- T1070
entityMappings:
- fieldMappings:
  - identifier: HostName
    columnName: DataComputerName
  entityType: Host
requiredDataConnectors:
- connectorId: SentinelOne
  dataTypes:
  - SentinelOne
version: 1.0.2
severity: High
description: |
    'Detects when agent was uninstalled from multiple hosts.'
tactics:
- DefenseEvasion

ARM