Analytic rule catalog
Red Canary Threat Detection
Back
| Id | 6d263abb-6445-45cc-93e9-c593d3d77b89 |
| Rulename | Red Canary Threat Detection |
| Description | Triggers Incidents using detection data assembled by Red Canary. |
| Severity | High |
| Tactics | Collection CommandAndControl CredentialAccess DefenseEvasion Discovery Execution Exfiltration Impact InitialAccess LateralMovement Persistence PrivilegeEscalation |
| Techniques | T1566 T1059 T1547 T1548 T1562 T1003 T1087 T1021 T1119 T1071 T1041 T1499 |
| Required data connectors | RedCanary_ConnectorDefinition |
| Kind | Scheduled |
| Query frequency | 5m |
| Query period | 1d |
| Trigger threshold | 0 |
| Trigger operator | gt |
| Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Red%20Canary/Analytic%20Rules/RedCanaryThreatDetection.yaml |
| Version | 1.0.2 |
| Arm template | 6d263abb-6445-45cc-93e9-c593d3d77b89.json |
let detectionLookback = 1d;
let newDetectionWindow = 5m;
RedCanaryDetections_CL
| where TimeGenerated >= ago(detectionLookback)
| where isnotempty(detection_id_s)
| summarize FirstSeen = min(TimeGenerated), arg_max(TimeGenerated, *) by detection_id_s
| where FirstSeen >= ago(newDetectionWindow)
| extend process_iocs_raw = column_ifexists('process_iocs_s', '[]'),
child_process_iocs_raw = column_ifexists('child_process_iocs_s', '[]'),
cross_process_iocs_raw = column_ifexists('cross_process_iocs_s', '[]'),
file_modification_iocs_raw = column_ifexists('file_modification_iocs_s', '[]'),
identities_raw = column_ifexists('identities_s', '[]')
| extend process_ioc_array = todynamic(iff(isempty(process_iocs_raw), '[]', process_iocs_raw)),
child_process_ioc_array = todynamic(iff(isempty(child_process_iocs_raw), '[]', child_process_iocs_raw)),
cross_process_ioc_array = todynamic(iff(isempty(cross_process_iocs_raw), '[]', cross_process_iocs_raw)),
file_mod_ioc_array = todynamic(iff(isempty(file_modification_iocs_raw), '[]', file_modification_iocs_raw)),
identities_array = todynamic(iff(isempty(identities_raw), '[]', identities_raw))
| extend evidence_array = array_concat(process_ioc_array, child_process_ioc_array, cross_process_ioc_array, file_mod_ioc_array)
| extend evidence = todynamic(evidence_array[0]),
identity = todynamic(identities_array[0])
| extend file_hash_array = todynamic(evidence.file_hashes)
| extend file_hash = todynamic(file_hash_array[0])
| project detection_id_s,
detection_url_s = column_ifexists('detection_url_s', ''),
detection_headline_s = column_ifexists('detection_headline_s', ''),
detection_details_s = column_ifexists('detection_details_s', ''),
detection_severity_s = column_ifexists('detection_severity_s', ''),
host_name_s = column_ifexists('host_name_s', ''),
host_full_name_s = column_ifexists('host_full_name_s', ''),
host_os_family_s = column_ifexists('host_os_family_s', ''),
host_os_version_s = column_ifexists('host_os_version_s', ''),
tactics_s = column_ifexists('tactics_s', ''),
process_id = tostring(evidence.process_id),
process_command_line = tostring(evidence.process_command_line),
process_creation_time_utc = tostring(evidence.process_creation_time_utc),
file_hash_algorithm = tostring(file_hash.algorithm),
file_hash_value = tostring(file_hash.value),
file_directory = tostring(evidence.file_directory),
file_name = tostring(evidence.file_name),
user_name = tostring(identity.user_name),
user_uid = tostring(identity.user_uid)
incidentConfiguration:
groupingConfiguration:
groupByAlertDetails: []
lookbackDuration: 7d
reopenClosedIncident: false
groupByCustomDetails:
- detection_id
groupByEntities: []
matchingMethod: Selected
enabled: true
createIncident: true
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Red%20Canary/Analytic%20Rules/RedCanaryThreatDetection.yaml
triggerThreshold: 0
id: 6d263abb-6445-45cc-93e9-c593d3d77b89
kind: Scheduled
queryPeriod: 1d
version: 1.0.2
eventGroupingSettings:
aggregationKind: AlertPerResult
tactics:
- Collection
- CommandAndControl
- CredentialAccess
- DefenseEvasion
- Discovery
- Execution
- Exfiltration
- Impact
- InitialAccess
- LateralMovement
- Persistence
- PrivilegeEscalation
queryFrequency: 5m
alertDetailsOverride:
alertTacticsColumnName: tactics_s
alertDescriptionFormat: |
Red Canary has published a {{detection_severity_s}} severity detection with details:
{{detection_details_s}}
View the Detection at: {{detection_url_s}}
alertSeverityColumnName: detection_severity_s
alertDisplayNameFormat: Red Canary has published Detection-{{detection_id_s}}
severity: High
name: Red Canary Threat Detection
customDetails:
detection_id: detection_id_s
requiredDataConnectors:
- connectorId: RedCanary_ConnectorDefinition
dataTypes:
- RedCanaryDetections_CL
description: Triggers Incidents using detection data assembled by Red Canary.
relevantTechniques:
- T1566
- T1059
- T1547
- T1548
- T1562
- T1003
- T1087
- T1021
- T1119
- T1071
- T1041
- T1499
entityMappings:
- entityType: Process
fieldMappings:
- identifier: ProcessId
columnName: process_id
- identifier: CommandLine
columnName: process_command_line
- identifier: CreationTimeUtc
columnName: process_creation_time_utc
- entityType: Account
fieldMappings:
- identifier: FullName
columnName: user_name
- identifier: Sid
columnName: user_uid
- identifier: Name
columnName: user_name
- entityType: File
fieldMappings:
- identifier: Directory
columnName: file_directory
- identifier: Name
columnName: file_name
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: host_name_s
- identifier: FullName
columnName: host_full_name_s
- identifier: OSFamily
columnName: host_os_family_s
- entityType: FileHash
fieldMappings:
- identifier: Algorithm
columnName: file_hash_algorithm
- identifier: Value
columnName: file_hash_value
query: |
let detectionLookback = 1d;
let newDetectionWindow = 5m;
RedCanaryDetections_CL
| where TimeGenerated >= ago(detectionLookback)
| where isnotempty(detection_id_s)
| summarize FirstSeen = min(TimeGenerated), arg_max(TimeGenerated, *) by detection_id_s
| where FirstSeen >= ago(newDetectionWindow)
| extend process_iocs_raw = column_ifexists('process_iocs_s', '[]'),
child_process_iocs_raw = column_ifexists('child_process_iocs_s', '[]'),
cross_process_iocs_raw = column_ifexists('cross_process_iocs_s', '[]'),
file_modification_iocs_raw = column_ifexists('file_modification_iocs_s', '[]'),
identities_raw = column_ifexists('identities_s', '[]')
| extend process_ioc_array = todynamic(iff(isempty(process_iocs_raw), '[]', process_iocs_raw)),
child_process_ioc_array = todynamic(iff(isempty(child_process_iocs_raw), '[]', child_process_iocs_raw)),
cross_process_ioc_array = todynamic(iff(isempty(cross_process_iocs_raw), '[]', cross_process_iocs_raw)),
file_mod_ioc_array = todynamic(iff(isempty(file_modification_iocs_raw), '[]', file_modification_iocs_raw)),
identities_array = todynamic(iff(isempty(identities_raw), '[]', identities_raw))
| extend evidence_array = array_concat(process_ioc_array, child_process_ioc_array, cross_process_ioc_array, file_mod_ioc_array)
| extend evidence = todynamic(evidence_array[0]),
identity = todynamic(identities_array[0])
| extend file_hash_array = todynamic(evidence.file_hashes)
| extend file_hash = todynamic(file_hash_array[0])
| project detection_id_s,
detection_url_s = column_ifexists('detection_url_s', ''),
detection_headline_s = column_ifexists('detection_headline_s', ''),
detection_details_s = column_ifexists('detection_details_s', ''),
detection_severity_s = column_ifexists('detection_severity_s', ''),
host_name_s = column_ifexists('host_name_s', ''),
host_full_name_s = column_ifexists('host_full_name_s', ''),
host_os_family_s = column_ifexists('host_os_family_s', ''),
host_os_version_s = column_ifexists('host_os_version_s', ''),
tactics_s = column_ifexists('tactics_s', ''),
process_id = tostring(evidence.process_id),
process_command_line = tostring(evidence.process_command_line),
process_creation_time_utc = tostring(evidence.process_creation_time_utc),
file_hash_algorithm = tostring(file_hash.algorithm),
file_hash_value = tostring(file_hash.value),
file_directory = tostring(evidence.file_directory),
file_name = tostring(evidence.file_name),
user_name = tostring(identity.user_name),
user_uid = tostring(identity.user_uid)
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/6d263abb-6445-45cc-93e9-c593d3d77b89')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/6d263abb-6445-45cc-93e9-c593d3d77b89')]",
"properties": {
"alertDetailsOverride": {
"alertDescriptionFormat": "Red Canary has published a {{detection_severity_s}} severity detection with details:\n\n{{detection_details_s}}\n\nView the Detection at: {{detection_url_s}}\n",
"alertDisplayNameFormat": "Red Canary has published Detection-{{detection_id_s}}",
"alertSeverityColumnName": "detection_severity_s",
"alertTacticsColumnName": "tactics_s"
},
"alertRuleTemplateName": "6d263abb-6445-45cc-93e9-c593d3d77b89",
"customDetails": {
"detection_id": "detection_id_s"
},
"description": "Triggers Incidents using detection data assembled by Red Canary.",
"displayName": "Red Canary Threat Detection",
"enabled": true,
"entityMappings": [
{
"entityType": "Process",
"fieldMappings": [
{
"columnName": "process_id",
"identifier": "ProcessId"
},
{
"columnName": "process_command_line",
"identifier": "CommandLine"
},
{
"columnName": "process_creation_time_utc",
"identifier": "CreationTimeUtc"
}
]
},
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "user_name",
"identifier": "FullName"
},
{
"columnName": "user_uid",
"identifier": "Sid"
},
{
"columnName": "user_name",
"identifier": "Name"
}
]
},
{
"entityType": "File",
"fieldMappings": [
{
"columnName": "file_directory",
"identifier": "Directory"
},
{
"columnName": "file_name",
"identifier": "Name"
}
]
},
{
"entityType": "Host",
"fieldMappings": [
{
"columnName": "host_name_s",
"identifier": "HostName"
},
{
"columnName": "host_full_name_s",
"identifier": "FullName"
},
{
"columnName": "host_os_family_s",
"identifier": "OSFamily"
}
]
},
{
"entityType": "FileHash",
"fieldMappings": [
{
"columnName": "file_hash_algorithm",
"identifier": "Algorithm"
},
{
"columnName": "file_hash_value",
"identifier": "Value"
}
]
}
],
"eventGroupingSettings": {
"aggregationKind": "AlertPerResult"
},
"incidentConfiguration": {
"createIncident": true,
"groupingConfiguration": {
"enabled": true,
"groupByAlertDetails": [],
"groupByCustomDetails": [
"detection_id"
],
"groupByEntities": [],
"lookbackDuration": "P7D",
"matchingMethod": "Selected",
"reopenClosedIncident": false
}
},
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Red%20Canary/Analytic%20Rules/RedCanaryThreatDetection.yaml",
"query": "let detectionLookback = 1d;\nlet newDetectionWindow = 5m;\nRedCanaryDetections_CL\n| where TimeGenerated >= ago(detectionLookback)\n| where isnotempty(detection_id_s)\n| summarize FirstSeen = min(TimeGenerated), arg_max(TimeGenerated, *) by detection_id_s\n| where FirstSeen >= ago(newDetectionWindow)\n| extend process_iocs_raw = column_ifexists('process_iocs_s', '[]'),\n child_process_iocs_raw = column_ifexists('child_process_iocs_s', '[]'),\n cross_process_iocs_raw = column_ifexists('cross_process_iocs_s', '[]'),\n file_modification_iocs_raw = column_ifexists('file_modification_iocs_s', '[]'),\n identities_raw = column_ifexists('identities_s', '[]')\n| extend process_ioc_array = todynamic(iff(isempty(process_iocs_raw), '[]', process_iocs_raw)),\n child_process_ioc_array = todynamic(iff(isempty(child_process_iocs_raw), '[]', child_process_iocs_raw)),\n cross_process_ioc_array = todynamic(iff(isempty(cross_process_iocs_raw), '[]', cross_process_iocs_raw)),\n file_mod_ioc_array = todynamic(iff(isempty(file_modification_iocs_raw), '[]', file_modification_iocs_raw)),\n identities_array = todynamic(iff(isempty(identities_raw), '[]', identities_raw))\n| extend evidence_array = array_concat(process_ioc_array, child_process_ioc_array, cross_process_ioc_array, file_mod_ioc_array)\n| extend evidence = todynamic(evidence_array[0]),\n identity = todynamic(identities_array[0])\n| extend file_hash_array = todynamic(evidence.file_hashes)\n| extend file_hash = todynamic(file_hash_array[0])\n| project detection_id_s,\n detection_url_s = column_ifexists('detection_url_s', ''),\n detection_headline_s = column_ifexists('detection_headline_s', ''),\n detection_details_s = column_ifexists('detection_details_s', ''),\n detection_severity_s = column_ifexists('detection_severity_s', ''),\n host_name_s = column_ifexists('host_name_s', ''),\n host_full_name_s = column_ifexists('host_full_name_s', ''),\n host_os_family_s = column_ifexists('host_os_family_s', ''),\n host_os_version_s = column_ifexists('host_os_version_s', ''),\n tactics_s = column_ifexists('tactics_s', ''),\n process_id = tostring(evidence.process_id),\n process_command_line = tostring(evidence.process_command_line),\n process_creation_time_utc = tostring(evidence.process_creation_time_utc),\n file_hash_algorithm = tostring(file_hash.algorithm),\n file_hash_value = tostring(file_hash.value),\n file_directory = tostring(evidence.file_directory),\n file_name = tostring(evidence.file_name),\n user_name = tostring(identity.user_name),\n user_uid = tostring(identity.user_uid)\n",
"queryFrequency": "PT5M",
"queryPeriod": "P1D",
"severity": "High",
"subTechniques": [],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"Collection",
"CommandAndControl",
"CredentialAccess",
"DefenseEvasion",
"Discovery",
"Execution",
"Exfiltration",
"Impact",
"InitialAccess",
"LateralMovement",
"Persistence",
"PrivilegeEscalation"
],
"techniques": [
"T1003",
"T1021",
"T1041",
"T1059",
"T1071",
"T1087",
"T1119",
"T1499",
"T1547",
"T1548",
"T1562",
"T1566"
],
"templateVersion": "1.0.2",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}