Threats detected by ESET

Back


Id	64badfab-1dd8-4491-927b-3ca206fa9a17
Rulename	Threats detected by ESET
Description	Escalates threats detected by ESET.
Severity	Low
Tactics	Execution
Techniques	T1204
Required data connectors	ESETPROTECT SyslogAma
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ESETPROTECT/Analytic Rules/ESETThreatDetected.yaml
Version	1.0.3
Arm template	64badfab-1dd8-4491-927b-3ca206fa9a17.json

KQL

ESETPROTECT
| where EventType == "Threat_Event"
| extend DvcHostname, SrcUserName, DvcIpAddr, FileHashSha1, FileHashAlgo = "SHA1"

YAML

queryFrequency: 5m
tactics:
- Execution
name: Threats detected by ESET
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ESETPROTECT/Analytic Rules/ESETThreatDetected.yaml
triggerThreshold: 0
description: |
    'Escalates threats detected by ESET.'
kind: Scheduled
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: SrcUserName
- entityType: Host
  fieldMappings:
  - identifier: FullName
    columnName: DvcHostname
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: DvcIpAddr
- entityType: FileHash
  fieldMappings:
  - identifier: Algorithm
    columnName: FileHashAlgo
  - identifier: Value
    columnName: FileHashSha1
id: 64badfab-1dd8-4491-927b-3ca206fa9a17
queryPeriod: 5m
version: 1.0.3
severity: Low
relevantTechniques:
- T1204
requiredDataConnectors:
- connectorId: ESETPROTECT
  dataTypes:
  - ESETPROTECT
- connectorId: SyslogAma
  datatypes:
  - Syslog
triggerOperator: gt
query: |
  ESETPROTECT
  | where EventType == "Threat_Event"
  | extend DvcHostname, SrcUserName, DvcIpAddr, FileHashSha1, FileHashAlgo = "SHA1"

ARM