Sentinel One - Same custom rule triggered on different hosts

Back


Id	5586d378-1bce-4d9b-9ac8-e7271c9d5a9a
Rulename	Sentinel One - Same custom rule triggered on different hosts
Description	Detects when same custom rule was triggered on different hosts.
Severity	High
Tactics	InitialAccess LateralMovement
Techniques	T1190 T1210
Required data connectors	SentinelOne
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SentinelOne/Analytic Rules/SentinelOneSameCustomRuleHitOnDiffHosts.yaml
Version	1.0.2
Arm template	5586d378-1bce-4d9b-9ac8-e7271c9d5a9a.json

KQL

SentinelOne
| where ActivityType == 3608
| extend RuleName = extract(@'Custom Rule:\s(.*?)\sin Group', 1, EventOriginalMessage)
| extend DstHostname = extract(@'detected on\s(\S+)\.', 1, EventOriginalMessage)
| summarize hosts = makeset(DstHostname) by RuleName, bin(TimeGenerated, 15m)
| where array_length(hosts) > 1
| extend HostCustomEntity = hosts

YAML

relevantTechniques:
- T1190
- T1210
entityMappings:
- fieldMappings:
  - columnName: HostCustomEntity
    identifier: HostName
  entityType: Host
triggerThreshold: 0
description: |
    'Detects when same custom rule was triggered on different hosts.'
requiredDataConnectors:
- connectorId: SentinelOne
  dataTypes:
  - SentinelOne
triggerOperator: gt
version: 1.0.2
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SentinelOne/Analytic Rules/SentinelOneSameCustomRuleHitOnDiffHosts.yaml
id: 5586d378-1bce-4d9b-9ac8-e7271c9d5a9a
queryFrequency: 1h
query: |
  SentinelOne
  | where ActivityType == 3608
  | extend RuleName = extract(@'Custom Rule:\s(.*?)\sin Group', 1, EventOriginalMessage)
  | extend DstHostname = extract(@'detected on\s(\S+)\.', 1, EventOriginalMessage)
  | summarize hosts = makeset(DstHostname) by RuleName, bin(TimeGenerated, 15m)
  | where array_length(hosts) > 1
  | extend HostCustomEntity = hosts  
severity: High
status: Available
queryPeriod: 1h
name: Sentinel One - Same custom rule triggered on different hosts
tactics:
- InitialAccess
- LateralMovement
kind: Scheduled

ARM