Trend Micro CAS - Multiple infected users

Back


Id	65c2a6fe-ff7b-46b0-9278-61265f77f3bc
Rulename	Trend Micro CAS - Multiple infected users
Description	Detects when same malware was detected for multiple user account.
Severity	High
Tactics	InitialAccess
Techniques	T1566
Required data connectors	TrendMicroCAS
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Cloud App Security/Analytic Rules/TrendMicroCASVAOutbreak.yaml
Version	1.0.1
Arm template	65c2a6fe-ff7b-46b0-9278-61265f77f3bc.json

KQL

TrendMicroCAS
| where EventType has_all ('virtual', 'analyzer')
| where isnotempty(VirusName)
| summarize count() by DstUserName, VirusName, bin(TimeGenerated, 15m)
| where count_ >= 2
| extend AccountCustomEntity = DstUserName, MalwareCustomEntity = VirusName

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
- entityType: Malware
  fieldMappings:
  - identifier: Name
    columnName: MalwareCustomEntity
tactics:
- InitialAccess
requiredDataConnectors:
- dataTypes:
  - TrendMicroCAS
  connectorId: TrendMicroCAS
id: 65c2a6fe-ff7b-46b0-9278-61265f77f3bc
severity: High
status: Available
query: |
  TrendMicroCAS
  | where EventType has_all ('virtual', 'analyzer')
  | where isnotempty(VirusName)
  | summarize count() by DstUserName, VirusName, bin(TimeGenerated, 15m)
  | where count_ >= 2
  | extend AccountCustomEntity = DstUserName, MalwareCustomEntity = VirusName  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Cloud App Security/Analytic Rules/TrendMicroCASVAOutbreak.yaml
kind: Scheduled
queryPeriod: 1h
version: 1.0.1
name: Trend Micro CAS - Multiple infected users
queryFrequency: 1h
triggerThreshold: 0
relevantTechniques:
- T1566
description: |
    'Detects when same malware was detected for multiple user account.'
triggerOperator: gt

ARM