RecordedFuture Threat Hunting Hash All Actors

Back


Id	6db6a8e6-2959-440b-ba57-a505875fcb37
Rulename	RecordedFuture Threat Hunting Hash All Actors
Description	Recorded Future Threat Hunting hash correlation for all actors.
Severity	Medium
Tactics	InitialAccess Execution Persistence
Techniques	T1189 T1059 T1554
Required data connectors	ThreatIntelligenceUploadIndicatorsAPI
Kind	Scheduled
Query frequency	15m
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Recorded Future/Analytic Rules/ThreatHunting/RecordedFutureThreatHuntingHashAllActors.yaml
Version	1.1.0
Arm template	6db6a8e6-2959-440b-ba57-a505875fcb37.json

KQL

let ioc_lookBack = 1d;
// The source table (imFileEvent) is a ASIM parser table, but can be replaced by any infrastructure table containing Hash data.
// The following workbook: Recorded Future - Hash Correlation will help researching available data and selecting tables and columns
imFileEvent
| where isnotempty(Hash)
| extend lowerHash=tolower(Hash)
| join kind=inner (
ThreatIntelIndicators
// Only look for IOCs
| where ObservableKey contains'file:hashes'
| where isnotempty(ObservableValue)
// Only look at Recorded Future Threat Hunt Indicators.
| where Data.description startswith "Recorded Future - Threat Hunt"
// Only work with the latest indicators
| where TimeGenerated >= ago(ioc_lookBack)
| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
| where IsActive == true and ValidUntil > now()
| extend lowerHash=tolower(ObservableValue)
) on lowerHash
// select column from the source table to match with Recorded Future ThreatIntelIndicator $left.Hash
| mv-expand RecordedFuturePortalLink=parse_json(tostring(parse_json(Tags)))['recordedfutureportallink']
// Hash and HashType is defaulted to data from Recorded Future, it can be changed to data from the infrastructure table.
| project Hash=ObservableValue, HashType=extract("file:hashes.('[^']*')", 1, ObservableKey), Description=Data.description, Type, TimeGenerated, RecordedFuturePortalLink

YAML

alertDetailsOverride:
  alertDynamicProperties:
  - alertProperty: AlertLink
    value: RecordedFuturePortalLink
  alertDescriptionFormat: '**{{Description}}**\n\nCorrelation found on {{Hash}} from the {{Type}} table.\n'
  alertDisplayNameFormat: '{{Description}}'
description: |
    'Recorded Future Threat Hunting hash correlation for all actors.'
kind: Scheduled
tactics:
- InitialAccess
- Execution
- Persistence
requiredDataConnectors:
- connectorId: ThreatIntelligenceUploadIndicatorsAPI
  dataTypes:
  - ThreatIntelIndicators
incidentConfiguration:
  groupingConfiguration:
    reopenClosedIncident: false
    lookbackDuration: 1h
    enabled: true
    matchingMethod: AllEntities
  createIncident: true
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Recorded Future/Analytic Rules/ThreatHunting/RecordedFutureThreatHuntingHashAllActors.yaml
severity: Medium
name: RecordedFuture Threat Hunting Hash All Actors
customDetails:
  ActorInformation: RecordedFuturePortalLink
triggerThreshold: 0
queryPeriod: 1d
query: |
  let ioc_lookBack = 1d;
  // The source table (imFileEvent) is a ASIM parser table, but can be replaced by any infrastructure table containing Hash data.
  // The following workbook: Recorded Future - Hash Correlation will help researching available data and selecting tables and columns
  imFileEvent
  | where isnotempty(Hash)
  | extend lowerHash=tolower(Hash)
  | join kind=inner (
  ThreatIntelIndicators
  // Only look for IOCs
  | where ObservableKey contains'file:hashes'
  | where isnotempty(ObservableValue)
  // Only look at Recorded Future Threat Hunt Indicators.
  | where Data.description startswith "Recorded Future - Threat Hunt"
  // Only work with the latest indicators
  | where TimeGenerated >= ago(ioc_lookBack)
  | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
  | where IsActive == true and ValidUntil > now()
  | extend lowerHash=tolower(ObservableValue)
  ) on lowerHash
  // select column from the source table to match with Recorded Future ThreatIntelIndicator $left.Hash
  | mv-expand RecordedFuturePortalLink=parse_json(tostring(parse_json(Tags)))['recordedfutureportallink']
  // Hash and HashType is defaulted to data from Recorded Future, it can be changed to data from the infrastructure table.
  | project Hash=ObservableValue, HashType=extract("file:hashes.('[^']*')", 1, ObservableKey), Description=Data.description, Type, TimeGenerated, RecordedFuturePortalLink  
relevantTechniques:
- T1189
- T1059
- T1554
id: 6db6a8e6-2959-440b-ba57-a505875fcb37
queryFrequency: 15m
entityMappings:
- entityType: FileHash
  fieldMappings:
  - columnName: Hash
    identifier: Value
  - columnName: HashType
    identifier: Algorithm
version: 1.1.0
triggerOperator: gt
eventGroupingSettings:
  aggregationKind: AlertPerResult

ARM