Radiflow - Unauthorized Command in Operational Device
| Id | 4d90d485-6d47-417e-80ea-9cf956c1a671 |
| Rulename | Radiflow - Unauthorized Command in Operational Device |
| Description | Generates an incident when an unauthorized command is detected in the network by Radiflow’s iSID. |
| Severity | Medium |
| Tactics | Execution LateralMovement InhibitResponseFunction ImpairProcessControl |
| Techniques | T0858 T0843 T0816 T0857 T0836 T0855 |
| Required data connectors | RadiflowIsid |
| Kind | Scheduled |
| Query frequency | 1h |
| Query period | 1h |
| Trigger threshold | 0 |
| Trigger operator | gt |
| Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Radiflow/Analytic Rules/RadiflowUnauthorizedCommandinOperationalDevice.yaml |
| Version | 1.0.0 |
| Arm template | 4d90d485-6d47-417e-80ea-9cf956c1a671.json |
RadiflowEvent
| where DeviceProduct =~ 'iSID'
| where
(
EventClassID in (114, 115, 116, 117, 118, 119, 162)
or EventMessage has 'Unauthorized'
)
tactics:
- Execution
- LateralMovement
- InhibitResponseFunction
- ImpairProcessControl
id: 4d90d485-6d47-417e-80ea-9cf956c1a671
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Radiflow/Analytic Rules/RadiflowUnauthorizedCommandinOperationalDevice.yaml
suppressionEnabled: false
status: Available
description: |
'Generates an incident when an unauthorized command is detected in the network by Radiflow's iSID.'
version: 1.0.0
severity: Medium
triggerThreshold: 0
entityMappings:
- fieldMappings:
- identifier: HostName
columnName: SourceHostName
- identifier: NetBiosName
columnName: SourceHostName
entityType: Host
- fieldMappings:
- identifier: HostName
columnName: DestinationHostName
- identifier: NetBiosName
columnName: DestinationHostName
entityType: Host
- fieldMappings:
- identifier: Address
columnName: SourceIP
entityType: IP
- fieldMappings:
- identifier: Address
columnName: DestinationIP
entityType: IP
alertDetailsOverride:
alertDynamicProperties: []
alertSeverityColumnName: EventSeverity
alertDisplayNameFormat: Unauthorized Command in Operational Device
alertDescriptionFormat: "An unauthorized command has been detected. Please check the alert details for further information.\n\nMessage: {{EventMessage}}\nSource device: {{SourceIP}} \nDestination device (if any): {{DestinationIP}} "
name: Radiflow - Unauthorized Command in Operational Device
query: |
RadiflowEvent
| where DeviceProduct =~ 'iSID'
| where
(
EventClassID in (114, 115, 116, 117, 118, 119, 162)
or EventMessage has 'Unauthorized'
)
suppressionDuration: 5h
queryPeriod: 1h
eventGroupingSettings:
aggregationKind: AlertPerResult
queryFrequency: 1h
triggerOperator: gt
customDetails:
SourceMAC: SourceMACAddress
SourceVLAN: SourceVLAN
DestinationType: DestinationType
DestinationMAC: DestinationMACAddress
DestinationHostName: DestinationHostName
SourceIP: SourceIP
SourceType: SourceType
SourceHostName: SourceHostName
DestinationVendor: DestinationVendor
Protocol: Protocol
SourceVendor: SourceVendor
DestinationIP: DestinationIP
Port: Port
kind: Scheduled
incidentConfiguration:
groupingConfiguration:
matchingMethod: AllEntities
reopenClosedIncident: false
groupByEntities: []
lookbackDuration: 1h
groupByCustomDetails: []
enabled: true
groupByAlertDetails: []
createIncident: true
requiredDataConnectors:
- connectorId: RadiflowIsid
dataTypes:
- RadiflowEvent
relevantTechniques:
- T0858
- T0843
- T0816
- T0857
- T0836
- T0855