Zero Networks Segment - Rare JIT Rule Creation

Back


Id	58688058-68b2-4b39-8009-ac6dc4d81ea1
Rulename	Zero Networks Segment - Rare JIT Rule Creation
Description	Identifies when a JIT Rule connection is new or rare by a given account today based on comparison with the previous 14 days. JIT Rule creations are indicated by the Activity Type Id 20
Severity	Medium
Tactics	LateralMovement
Techniques	T1021
Required data connectors	ZeroNetworksSegmentAuditFunction ZeroNetworksSegmentAuditNativePoller
Kind	Scheduled
Query frequency	1d
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ZeroNetworks/Analytic Rules/ZNSegmentRareJITRuleCreation.yaml
Version	1.0.2
Arm template	58688058-68b2-4b39-8009-ac6dc4d81ea1.json

KQL

let starttime = 14d;
let endtime = 1d;
ZNSegmentAudit
| where TimeGenerated >= ago(endtime)
| where AuditTypeId == 20
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), ConnectionCount = count()
by PerformedByName, tostring(DestinationEntityName)
  // use left anti to exclude anything from the previous 14 days that is not rare
| join kind=leftanti (
ZNSegmentAudit
| where TimeGenerated between (ago(starttime) .. ago(endtime))
| where AuditTypeId == 20
| summarize by tostring(DestinationEntityName)
) on DestinationEntityName
| summarize StartTime = min(StartTime), EndTime = max(EndTime), ConnectionCount = sum(ConnectionCount)
by PerformedByName, DestinationEntityName
| extend TimeGenerated = StartTime

YAML

id: 58688058-68b2-4b39-8009-ac6dc4d81ea1
requiredDataConnectors:
- dataTypes:
  - ZNSegmentAudit_CL
  connectorId: ZeroNetworksSegmentAuditFunction
- dataTypes:
  - ZNSegmentAuditNativePoller_CL
  connectorId: ZeroNetworksSegmentAuditNativePoller
triggerOperator: gt
description: |
  'Identifies when a JIT Rule connection is new or rare by a given account today based on comparison with the previous 14 days.
  JIT Rule creations are indicated by the Activity Type Id 20'  
entityMappings:
- fieldMappings:
  - columnName: PerformedByName
    identifier: Name
  entityType: Account
- fieldMappings:
  - columnName: DestinationEntityName
    identifier: HostName
  entityType: Host
status: Available
relevantTechniques:
- T1021
queryPeriod: 14d
severity: Medium
query: |
  let starttime = 14d;
  let endtime = 1d;
  ZNSegmentAudit
  | where TimeGenerated >= ago(endtime)
  | where AuditTypeId == 20
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), ConnectionCount = count()
  by PerformedByName, tostring(DestinationEntityName)
    // use left anti to exclude anything from the previous 14 days that is not rare
  | join kind=leftanti (
  ZNSegmentAudit
  | where TimeGenerated between (ago(starttime) .. ago(endtime))
  | where AuditTypeId == 20
  | summarize by tostring(DestinationEntityName)
  ) on DestinationEntityName
  | summarize StartTime = min(StartTime), EndTime = max(EndTime), ConnectionCount = sum(ConnectionCount)
  by PerformedByName, DestinationEntityName
  | extend TimeGenerated = StartTime  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ZeroNetworks/Analytic Rules/ZNSegmentRareJITRuleCreation.yaml
triggerThreshold: 0
name: Zero Networks Segment - Rare JIT Rule Creation
tactics:
- LateralMovement
queryFrequency: 1d
kind: Scheduled
version: 1.0.2

ARM