Claroty - Suspicious file transfer | Microsoft Sentinel Analytic Rules

Back


Id	5cf35bad-677f-4c23-8927-1611e7ff6f28
Rulename	Claroty - Suspicious file transfer
Description	Detects Claroty events where EventOriginalType or EventType contains Suspicious File Transfer and maps the destination IP as the primary entity for triage.
Severity	High
Tactics	Discovery Exfiltration
Techniques	T1018 T1020
Required data connectors	CefAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Claroty/Analytic%20Rules/ClarotySuspiciousFileTransfer.yaml
Version	1.0.4
Arm template	5cf35bad-677f-4c23-8927-1611e7ff6f28.json

KQL

ClarotyEvent
| where EventOriginalType has 'Suspicious File Transfer' or EventType has 'Suspicious File Transfer'
| project TimeGenerated, DstIpAddr, EventOriginalType, EventType
| extend IPCustomEntity = DstIpAddr
| project TimeGenerated, DstIpAddr, EventOriginalType, EventType, IPCustomEntity

YAML

status: Available
kind: Scheduled
triggerThreshold: 0
id: 5cf35bad-677f-4c23-8927-1611e7ff6f28
queryPeriod: 1h
triggerOperator: gt
description: Detects Claroty events where EventOriginalType or EventType contains Suspicious File Transfer and maps the destination IP as the primary entity for triage.
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
severity: High
requiredDataConnectors:
- connectorId: CefAma
  dataTypes:
  - CommonSecurityLog
queryFrequency: 1h
alertDetailsOverride:
  alertDisplayNameFormat: Claroty suspicious file transfer to {{DstIpAddr}}
  alertDescriptionFormat: Claroty flagged suspicious file transfer activity to {{DstIpAddr}} using event type {{EventType}}
relevantTechniques:
- T1018
- T1020
version: 1.0.4
tactics:
- Discovery
- Exfiltration
customDetails:
  EventType: EventType
  EventOriginalType: EventOriginalType
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Claroty/Analytic%20Rules/ClarotySuspiciousFileTransfer.yaml
query: |
  ClarotyEvent
  | where EventOriginalType has 'Suspicious File Transfer' or EventType has 'Suspicious File Transfer'
  | project TimeGenerated, DstIpAddr, EventOriginalType, EventType
  | extend IPCustomEntity = DstIpAddr
  | project TimeGenerated, DstIpAddr, EventOriginalType, EventType, IPCustomEntity
name: Claroty - Suspicious file transfer

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/5cf35bad-677f-4c23-8927-1611e7ff6f28')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/5cf35bad-677f-4c23-8927-1611e7ff6f28')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Claroty flagged suspicious file transfer activity to {{DstIpAddr}} using event type {{EventType}}",
          "alertDisplayNameFormat": "Claroty suspicious file transfer to {{DstIpAddr}}"
        },
        "alertRuleTemplateName": "5cf35bad-677f-4c23-8927-1611e7ff6f28",
        "customDetails": {
          "EventOriginalType": "EventOriginalType",
          "EventType": "EventType"
        },
        "description": "Detects Claroty events where EventOriginalType or EventType contains Suspicious File Transfer and maps the destination IP as the primary entity for triage.",
        "displayName": "Claroty - Suspicious file transfer",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Claroty/Analytic%20Rules/ClarotySuspiciousFileTransfer.yaml",
        "query": "ClarotyEvent\n| where EventOriginalType has 'Suspicious File Transfer' or EventType has 'Suspicious File Transfer'\n| project TimeGenerated, DstIpAddr, EventOriginalType, EventType\n| extend IPCustomEntity = DstIpAddr\n| project TimeGenerated, DstIpAddr, EventOriginalType, EventType, IPCustomEntity\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Discovery",
          "Exfiltration"
        ],
        "techniques": [
          "T1018",
          "T1020"
        ],
        "templateVersion": "1.0.4",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}