Zero Networks Segment - Rare JIT Rule Creation

Back


Id	58688058-68b2-4b39-8009-ac6dc4d81ea1
Rulename	Zero Networks Segment - Rare JIT Rule Creation
Description	Identifies when a JIT Rule connection is new or rare by a given account today based on comparison with the previous 14 days. JIT Rule creations are indicated by the Activity Type Id 20
Severity	Medium
Tactics	LateralMovement
Techniques	T1021
Required data connectors	ZeroNetworksSegmentAuditFunction ZeroNetworksSegmentAuditNativePoller
Kind	Scheduled
Query frequency	1d
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ZeroNetworks/Analytic Rules/ZNSegmentRareJITRuleCreation.yaml
Version	1.0.2
Arm template	58688058-68b2-4b39-8009-ac6dc4d81ea1.json

KQL

let starttime = 14d;
let endtime = 1d;
ZNSegmentAudit
| where TimeGenerated >= ago(endtime)
| where AuditTypeId == 20
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), ConnectionCount = count()
by PerformedByName, tostring(DestinationEntityName)
  // use left anti to exclude anything from the previous 14 days that is not rare
| join kind=leftanti (
ZNSegmentAudit
| where TimeGenerated between (ago(starttime) .. ago(endtime))
| where AuditTypeId == 20
| summarize by tostring(DestinationEntityName)
) on DestinationEntityName
| summarize StartTime = min(StartTime), EndTime = max(EndTime), ConnectionCount = sum(ConnectionCount)
by PerformedByName, DestinationEntityName
| extend TimeGenerated = StartTime

YAML

relevantTechniques:
- T1021
entityMappings:
- fieldMappings:
  - columnName: PerformedByName
    identifier: Name
  entityType: Account
- fieldMappings:
  - columnName: DestinationEntityName
    identifier: HostName
  entityType: Host
triggerThreshold: 0
description: |
  'Identifies when a JIT Rule connection is new or rare by a given account today based on comparison with the previous 14 days.
  JIT Rule creations are indicated by the Activity Type Id 20'  
requiredDataConnectors:
- connectorId: ZeroNetworksSegmentAuditFunction
  dataTypes:
  - ZNSegmentAudit_CL
- connectorId: ZeroNetworksSegmentAuditNativePoller
  dataTypes:
  - ZNSegmentAuditNativePoller_CL
triggerOperator: gt
version: 1.0.2
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ZeroNetworks/Analytic Rules/ZNSegmentRareJITRuleCreation.yaml
id: 58688058-68b2-4b39-8009-ac6dc4d81ea1
queryFrequency: 1d
query: |
  let starttime = 14d;
  let endtime = 1d;
  ZNSegmentAudit
  | where TimeGenerated >= ago(endtime)
  | where AuditTypeId == 20
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), ConnectionCount = count()
  by PerformedByName, tostring(DestinationEntityName)
    // use left anti to exclude anything from the previous 14 days that is not rare
  | join kind=leftanti (
  ZNSegmentAudit
  | where TimeGenerated between (ago(starttime) .. ago(endtime))
  | where AuditTypeId == 20
  | summarize by tostring(DestinationEntityName)
  ) on DestinationEntityName
  | summarize StartTime = min(StartTime), EndTime = max(EndTime), ConnectionCount = sum(ConnectionCount)
  by PerformedByName, DestinationEntityName
  | extend TimeGenerated = StartTime  
severity: Medium
status: Available
queryPeriod: 14d
name: Zero Networks Segment - Rare JIT Rule Creation
tactics:
- LateralMovement
kind: Scheduled

ARM