Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Antivirus Detected an Infected File

Back
Id4f767afa-d666-4ed4-b453-a4f5ad35181b
RulenameAntivirus Detected an Infected File
DescriptionMonitors CTERA platform to detect files infected with viruses identified by the antivirus engine on Edge Filers.
SeverityHigh
TacticsImpact
TechniquesT1203
Required data connectorsCTERA
KindNRT
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTERA/Analytic Rules/InfectedFileDetected.yaml
Version1.0.0
Arm template4f767afa-d666-4ed4-b453-a4f5ad35181b.json
Deploy To Azure
Syslog
| where SyslogMessage contains "found an infected file"
| extend 
    EdgeFiler = extract("Edge filer (\\w+)", 1, SyslogMessage),
    DetectionTime = extract("found an infected file at ([^ ]+)", 1, SyslogMessage),
    Portal = extract("from portal: (\\w+)", 1, SyslogMessage),
    FilePath = extract("The file path is: ([^\\.]+)", 1, SyslogMessage),
    Virus = extract("The virus is: ([^\\.]+)", 1, SyslogMessage)
| project TimeGenerated, EdgeFiler, DetectionTime, Portal, FilePath, Virus
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTERA/Analytic Rules/InfectedFileDetected.yaml
query: |
  Syslog
  | where SyslogMessage contains "found an infected file"
  | extend 
      EdgeFiler = extract("Edge filer (\\w+)", 1, SyslogMessage),
      DetectionTime = extract("found an infected file at ([^ ]+)", 1, SyslogMessage),
      Portal = extract("from portal: (\\w+)", 1, SyslogMessage),
      FilePath = extract("The file path is: ([^\\.]+)", 1, SyslogMessage),
      Virus = extract("The virus is: ([^\\.]+)", 1, SyslogMessage)
  | project TimeGenerated, EdgeFiler, DetectionTime, Portal, FilePath, Virus  
description: Monitors CTERA platform to detect files infected with viruses identified by the antivirus engine on Edge Filers.
severity: High
requiredDataConnectors:
- dataTypes:
  - Syslog
  connectorId: CTERA
entityMappings:
- entityType: Host
  fieldMappings:
  - columnName: EdgeFiler
    identifier: HostName
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: PT5H
    reopenClosedIncident: false
    enabled: false
    matchingMethod: AllEntities
  createIncident: true
eventGroupingSettings:
  aggregationKind: SingleAlert
name: Antivirus Detected an Infected File
customDetails:
  FilePath: FilePath
  EdgeFiler: EdgeFiler
  Portal: Portal
  Virus: Virus
suppressionDuration: PT5H
tactics:
- Impact
alertDetailsOverride:
  alertnameFormat: Antivirus Detected an Infected File
  alertDescriptionFormat: Antivirus detected an infected file on {{EdgeFiler}} at {{DetectionTime}}.
relevantTechniques:
- T1203
kind: NRT
id: 4f767afa-d666-4ed4-b453-a4f5ad35181b
status: Available
suppressionEnabled: false
version: 1.0.0
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/4f767afa-d666-4ed4-b453-a4f5ad35181b')]",
      "kind": "NRT",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/4f767afa-d666-4ed4-b453-a4f5ad35181b')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Antivirus detected an infected file on {{EdgeFiler}} at {{DetectionTime}}.",
          "alertnameFormat": "Antivirus Detected an Infected File"
        },
        "alertRuleTemplateName": "4f767afa-d666-4ed4-b453-a4f5ad35181b",
        "customDetails": {
          "EdgeFiler": "EdgeFiler",
          "FilePath": "FilePath",
          "Portal": "Portal",
          "Virus": "Virus"
        },
        "description": "Monitors CTERA platform to detect files infected with viruses identified by the antivirus engine on Edge Filers.",
        "displayName": "Antivirus Detected an Infected File",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "EdgeFiler",
                "identifier": "HostName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTERA/Analytic Rules/InfectedFileDetected.yaml",
        "query": "Syslog\n| where SyslogMessage contains \"found an infected file\"\n| extend \n    EdgeFiler = extract(\"Edge filer (\\\\w+)\", 1, SyslogMessage),\n    DetectionTime = extract(\"found an infected file at ([^ ]+)\", 1, SyslogMessage),\n    Portal = extract(\"from portal: (\\\\w+)\", 1, SyslogMessage),\n    FilePath = extract(\"The file path is: ([^\\\\.]+)\", 1, SyslogMessage),\n    Virus = extract(\"The virus is: ([^\\\\.]+)\", 1, SyslogMessage)\n| project TimeGenerated, EdgeFiler, DetectionTime, Portal, FilePath, Virus\n",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1203"
        ],
        "templateVersion": "1.0.0"
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}