Antivirus Detected an Infected File

Back


Id	4f767afa-d666-4ed4-b453-a4f5ad35181b
Rulename	Antivirus Detected an Infected File
Description	Monitors CTERA platform to detect files infected with viruses identified by the antivirus engine on Edge Filers.
Severity	High
Tactics	Impact
Techniques	T1203
Required data connectors	CTERA
Kind	NRT
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTERA/Analytic Rules/InfectedFileDetected.yaml
Version	1.0.0
Arm template	4f767afa-d666-4ed4-b453-a4f5ad35181b.json

KQL

Syslog
| where SyslogMessage contains "found an infected file"
| extend 
    EdgeFiler = extract("Edge filer (\\w+)", 1, SyslogMessage),
    DetectionTime = extract("found an infected file at ([^ ]+)", 1, SyslogMessage),
    Portal = extract("from portal: (\\w+)", 1, SyslogMessage),
    FilePath = extract("The file path is: ([^\\.]+)", 1, SyslogMessage),
    Virus = extract("The virus is: ([^\\.]+)", 1, SyslogMessage)
| project TimeGenerated, EdgeFiler, DetectionTime, Portal, FilePath, Virus

YAML

alertDetailsOverride:
  alertnameFormat: Antivirus Detected an Infected File
  alertDescriptionFormat: Antivirus detected an infected file on {{EdgeFiler}} at {{DetectionTime}}.
requiredDataConnectors:
- connectorId: CTERA
  dataTypes:
  - Syslog
tactics:
- Impact
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
    reopenClosedIncident: false
description: Monitors CTERA platform to detect files infected with viruses identified by the antivirus engine on Edge Filers.
query: |
  Syslog
  | where SyslogMessage contains "found an infected file"
  | extend 
      EdgeFiler = extract("Edge filer (\\w+)", 1, SyslogMessage),
      DetectionTime = extract("found an infected file at ([^ ]+)", 1, SyslogMessage),
      Portal = extract("from portal: (\\w+)", 1, SyslogMessage),
      FilePath = extract("The file path is: ([^\\.]+)", 1, SyslogMessage),
      Virus = extract("The virus is: ([^\\.]+)", 1, SyslogMessage)
  | project TimeGenerated, EdgeFiler, DetectionTime, Portal, FilePath, Virus  
id: 4f767afa-d666-4ed4-b453-a4f5ad35181b
customDetails:
  Virus: Virus
  EdgeFiler: EdgeFiler
  Portal: Portal
  FilePath: FilePath
eventGroupingSettings:
  aggregationKind: SingleAlert
relevantTechniques:
- T1203
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTERA/Analytic Rules/InfectedFileDetected.yaml
severity: High
entityMappings:
- fieldMappings:
  - columnName: EdgeFiler
    identifier: HostName
  entityType: Host
name: Antivirus Detected an Infected File
suppressionDuration: PT5H
kind: NRT
suppressionEnabled: false
version: 1.0.0
status: Available

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/4f767afa-d666-4ed4-b453-a4f5ad35181b')]",
      "kind": "NRT",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/4f767afa-d666-4ed4-b453-a4f5ad35181b')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Antivirus detected an infected file on {{EdgeFiler}} at {{DetectionTime}}.",
          "alertnameFormat": "Antivirus Detected an Infected File"
        },
        "alertRuleTemplateName": "4f767afa-d666-4ed4-b453-a4f5ad35181b",
        "customDetails": {
          "EdgeFiler": "EdgeFiler",
          "FilePath": "FilePath",
          "Portal": "Portal",
          "Virus": "Virus"
        },
        "description": "Monitors CTERA platform to detect files infected with viruses identified by the antivirus engine on Edge Filers.",
        "displayName": "Antivirus Detected an Infected File",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "EdgeFiler",
                "identifier": "HostName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTERA/Analytic Rules/InfectedFileDetected.yaml",
        "query": "Syslog\n| where SyslogMessage contains \"found an infected file\"\n| extend \n    EdgeFiler = extract(\"Edge filer (\\\\w+)\", 1, SyslogMessage),\n    DetectionTime = extract(\"found an infected file at ([^ ]+)\", 1, SyslogMessage),\n    Portal = extract(\"from portal: (\\\\w+)\", 1, SyslogMessage),\n    FilePath = extract(\"The file path is: ([^\\\\.]+)\", 1, SyslogMessage),\n    Virus = extract(\"The virus is: ([^\\\\.]+)\", 1, SyslogMessage)\n| project TimeGenerated, EdgeFiler, DetectionTime, Portal, FilePath, Virus\n",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1203"
        ],
        "templateVersion": "1.0.0"
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}