Sentinel One - Same custom rule triggered on different hosts

Back


Id	5586d378-1bce-4d9b-9ac8-e7271c9d5a9a
Rulename	Sentinel One - Same custom rule triggered on different hosts
Description	Detects when same custom rule was triggered on different hosts.
Severity	High
Tactics	InitialAccess LateralMovement
Techniques	T1190 T1210
Required data connectors	SentinelOne
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SentinelOne/Analytic Rules/SentinelOneSameCustomRuleHitOnDiffHosts.yaml
Version	1.0.2
Arm template	5586d378-1bce-4d9b-9ac8-e7271c9d5a9a.json

KQL

SentinelOne
| where ActivityType == 3608
| extend RuleName = extract(@'Custom Rule:\s(.*?)\sin Group', 1, EventOriginalMessage)
| extend DstHostname = extract(@'detected on\s(\S+)\.', 1, EventOriginalMessage)
| summarize hosts = makeset(DstHostname) by RuleName, bin(TimeGenerated, 15m)
| where array_length(hosts) > 1
| extend HostCustomEntity = hosts

YAML

description: |
    'Detects when same custom rule was triggered on different hosts.'
kind: Scheduled
tactics:
- InitialAccess
- LateralMovement
requiredDataConnectors:
- connectorId: SentinelOne
  dataTypes:
  - SentinelOne
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SentinelOne/Analytic Rules/SentinelOneSameCustomRuleHitOnDiffHosts.yaml
severity: High
name: Sentinel One - Same custom rule triggered on different hosts
triggerThreshold: 0
queryPeriod: 1h
query: |
  SentinelOne
  | where ActivityType == 3608
  | extend RuleName = extract(@'Custom Rule:\s(.*?)\sin Group', 1, EventOriginalMessage)
  | extend DstHostname = extract(@'detected on\s(\S+)\.', 1, EventOriginalMessage)
  | summarize hosts = makeset(DstHostname) by RuleName, bin(TimeGenerated, 15m)
  | where array_length(hosts) > 1
  | extend HostCustomEntity = hosts  
relevantTechniques:
- T1190
- T1210
id: 5586d378-1bce-4d9b-9ac8-e7271c9d5a9a
queryFrequency: 1h
status: Available
triggerOperator: gt
version: 1.0.2
entityMappings:
- entityType: Host
  fieldMappings:
  - columnName: HostCustomEntity
    identifier: HostName

ARM