High severity malicious activity detected

let TimeWindow   = 90d;    // How far back to look 
let HitThreshold = 10;     // Minimum hits to alert per SourceIp + Category
let MinSeverity  = 1;      // Set Minimum Severity
let EnableCategoryFilter    = true;   // Filter 1: use CategoriesOfInterest
let EnableDescriptionFilter = false;  // Filter 2: use DescriptionsOfInterest
let EnableActionFilter      = false;  // Filter 3: use MatchActions
let CategoriesOfInterest    = dynamic([
    "Targeted Malicious Activity was Detected",
    "Exploit Kit Activity Detected",
    "Domain Observed Used for C2 Detected",
    "Successful Credential Theft Detected",
    "Malware Command and Control Activity Detected",
    "Executable code was detected",
    "A Network Trojan was detected"
]);
let DescriptionsOfInterest  = dynamic([
    "targeted-activity",
    "exploit-kit",
    "domain-c2",
    "credential-theft",
    "command-and-control",
    "shellcode-detect",
    "trojan-activity"
]);
let MatchActions = dynamic(["Deny", "alert"]);
AZFWIdpsSignature
| where TimeGenerated >= ago(TimeWindow)
| where Severity >= MinSeverity
// Filter 1: Category filter (optional)
| where (EnableCategoryFilter == false) or (Category has_any (CategoriesOfInterest))
// Filter 2: Description filter (optional)
| where (EnableDescriptionFilter == false) or (Description has_any (DescriptionsOfInterest))
// Filter 3: Action filter (optional)
| where (EnableActionFilter == false) or (Action in~ (MatchActions))
| summarize
    StartTime   = min(TimeGenerated),
    EndTime     = max(TimeGenerated),
    TotalHits   = count(),
    MaxSeverity = max(Severity),
    Actions     = make_set(Action, 5),
    Signatures  = make_set(SignatureId, 20),
    Description = make_set(substring(tostring(Description), 0, 120), 3)
    by SourceIp, ThreatCategory = Category
| where TotalHits >= HitThreshold
| project
    StartTime,
    EndTime,
    SourceIp,
    ThreatCategory,
    TotalHits,
    MaxSeverity,
    Actions,
    Signatures,
    Description
| order by MaxSeverity desc, TotalHits desc

requiredDataConnectors:
- dataTypes:
  - AZFWIdpsSignature
  connectorId: AzureFirewall
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure%20Firewall/Analytic%20Rules/Azure%20Firewall%20-%20High%20severity%20malicious%20activity%20detected.yaml
version: 1.0.1
status: Available
queryFrequency: 1h
query: |
  let TimeWindow   = 90d;    // How far back to look 
  let HitThreshold = 10;     // Minimum hits to alert per SourceIp + Category
  let MinSeverity  = 1;      // Set Minimum Severity
  let EnableCategoryFilter    = true;   // Filter 1: use CategoriesOfInterest
  let EnableDescriptionFilter = false;  // Filter 2: use DescriptionsOfInterest
  let EnableActionFilter      = false;  // Filter 3: use MatchActions
  let CategoriesOfInterest    = dynamic([
      "Targeted Malicious Activity was Detected",
      "Exploit Kit Activity Detected",
      "Domain Observed Used for C2 Detected",
      "Successful Credential Theft Detected",
      "Malware Command and Control Activity Detected",
      "Executable code was detected",
      "A Network Trojan was detected"
  ]);
  let DescriptionsOfInterest  = dynamic([
      "targeted-activity",
      "exploit-kit",
      "domain-c2",
      "credential-theft",
      "command-and-control",
      "shellcode-detect",
      "trojan-activity"
  ]);
  let MatchActions = dynamic(["Deny", "alert"]);
  AZFWIdpsSignature
  | where TimeGenerated >= ago(TimeWindow)
  | where Severity >= MinSeverity
  // Filter 1: Category filter (optional)
  | where (EnableCategoryFilter == false) or (Category has_any (CategoriesOfInterest))
  // Filter 2: Description filter (optional)
  | where (EnableDescriptionFilter == false) or (Description has_any (DescriptionsOfInterest))
  // Filter 3: Action filter (optional)
  | where (EnableActionFilter == false) or (Action in~ (MatchActions))
  | summarize
      StartTime   = min(TimeGenerated),
      EndTime     = max(TimeGenerated),
      TotalHits   = count(),
      MaxSeverity = max(Severity),
      Actions     = make_set(Action, 5),
      Signatures  = make_set(SignatureId, 20),
      Description = make_set(substring(tostring(Description), 0, 120), 3)
      by SourceIp, ThreatCategory = Category
  | where TotalHits >= HitThreshold
  | project
      StartTime,
      EndTime,
      SourceIp,
      ThreatCategory,
      TotalHits,
      MaxSeverity,
      Actions,
      Signatures,
      Description
  | order by MaxSeverity desc, TotalHits desc
tactics:
- InitialAccess
- Exfiltration
- CredentialAccess
- CommandAndControl
- Execution
relevantTechniques:
- T1190
- T1041
- T1003
- T1204
id: 504257c1-81e2-4609-8d40-b395e62f11c7
triggerThreshold: 0
triggerOperator: gt
name: High severity malicious activity detected
queryPeriod: 24h
severity: High
entityMappings:
- fieldMappings:
  - columnName: SourceIp
    identifier: Address
  entityType: IP
kind: Scheduled
description: |
  Identifies high severity malicious activity in Azure Firewall IDPS logs.

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/504257c1-81e2-4609-8d40-b395e62f11c7')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/504257c1-81e2-4609-8d40-b395e62f11c7')]",
      "properties": {
        "alertRuleTemplateName": "504257c1-81e2-4609-8d40-b395e62f11c7",
        "customDetails": null,
        "description": "Identifies high severity malicious activity in Azure Firewall IDPS logs.\n",
        "displayName": "High severity malicious activity detected",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SourceIp",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure%20Firewall/Analytic%20Rules/Azure%20Firewall%20-%20High%20severity%20malicious%20activity%20detected.yaml",
        "query": "let TimeWindow   = 90d;    // How far back to look \nlet HitThreshold = 10;     // Minimum hits to alert per SourceIp + Category\nlet MinSeverity  = 1;      // Set Minimum Severity\nlet EnableCategoryFilter    = true;   // Filter 1: use CategoriesOfInterest\nlet EnableDescriptionFilter = false;  // Filter 2: use DescriptionsOfInterest\nlet EnableActionFilter      = false;  // Filter 3: use MatchActions\nlet CategoriesOfInterest    = dynamic([\n    \"Targeted Malicious Activity was Detected\",\n    \"Exploit Kit Activity Detected\",\n    \"Domain Observed Used for C2 Detected\",\n    \"Successful Credential Theft Detected\",\n    \"Malware Command and Control Activity Detected\",\n    \"Executable code was detected\",\n    \"A Network Trojan was detected\"\n]);\nlet DescriptionsOfInterest  = dynamic([\n    \"targeted-activity\",\n    \"exploit-kit\",\n    \"domain-c2\",\n    \"credential-theft\",\n    \"command-and-control\",\n    \"shellcode-detect\",\n    \"trojan-activity\"\n]);\nlet MatchActions = dynamic([\"Deny\", \"alert\"]);\nAZFWIdpsSignature\n| where TimeGenerated >= ago(TimeWindow)\n| where Severity >= MinSeverity\n// Filter 1: Category filter (optional)\n| where (EnableCategoryFilter == false) or (Category has_any (CategoriesOfInterest))\n// Filter 2: Description filter (optional)\n| where (EnableDescriptionFilter == false) or (Description has_any (DescriptionsOfInterest))\n// Filter 3: Action filter (optional)\n| where (EnableActionFilter == false) or (Action in~ (MatchActions))\n| summarize\n    StartTime   = min(TimeGenerated),\n    EndTime     = max(TimeGenerated),\n    TotalHits   = count(),\n    MaxSeverity = max(Severity),\n    Actions     = make_set(Action, 5),\n    Signatures  = make_set(SignatureId, 20),\n    Description = make_set(substring(tostring(Description), 0, 120), 3)\n    by SourceIp, ThreatCategory = Category\n| where TotalHits >= HitThreshold\n| project\n    StartTime,\n    EndTime,\n    SourceIp,\n    ThreatCategory,\n    TotalHits,\n    MaxSeverity,\n    Actions,\n    Signatures,\n    Description\n| order by MaxSeverity desc, TotalHits desc\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT24H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CommandAndControl",
          "CredentialAccess",
          "Execution",
          "Exfiltration",
          "InitialAccess"
        ],
        "techniques": [
          "T1003",
          "T1041",
          "T1190",
          "T1204"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}