RedRays - Profile Parameters | Microsoft Sentinel Analytic Rules

Back


Id	708b461c-40b0-571a-8ec5-a3791dce23a4
Rulename	RedRays - Profile Parameters
Description	Identifies new or materially changed, actionable profile parameter checks from RedRays. Checks marked VULNERABLE raise Medium severity alerts under the integration’s policy. Initial findings raise alerts only if you enable baseline alerting in RedRays. The ATT&CK mapping describes how an adversary could abuse weakened SAP security settings, not evidence of an attack. Records outside the one-day query window do not trigger this rule.
Severity	Medium
Tactics	DefenseEvasion CredentialAccess
Techniques	T1562 T1110
Required data connectors	RedRaysSAPSecurityFindings
Kind	Scheduled
Query frequency	15m
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/RedRays%20SAP%20Security%20Findings/Analytic%20Rules/RedRaysVulnerableProfileParameters.yaml
Version	1.0.3
Arm template	708b461c-40b0-571a-8ec5-a3791dce23a4.json

KQL

// Map each ProductInstanceId to its RedRays origin to resolve relative source links.
// Example: dynamic({"<ProductInstanceId>": "https://redrays.example"})
let redRaysPortalUrls = dynamic({});
let observations = RedRaysProfileChecks_CL
| where TimeGenerated >= ago(1d)
| extend ArrivedAt = ingestion_time()
| summarize arg_min(ArrivedAt, *) by EventId;
let candidates = observations
| where IsAlertCandidate == true and ArrivedAt > ago(15m)
| project FindingKey, AlertFingerprint, AlertEventId = EventId, AlertArrivedAt = ArrivedAt
| summarize arg_min(AlertArrivedAt, *) by FindingKey, AlertFingerprint;
observations
| summarize arg_max(Revision, *) by FindingKey
| where IsActionable == true
| where SourceStatus == "VULNERABLE"
| join kind=inner candidates on FindingKey, AlertFingerprint
| extend EventId = AlertEventId
| extend EntityHost = trim_end(@"\.", trim(@"\s+", tostring(Host)))
| extend EntityIP = iff(EntityHost !contains "/" and isnotempty(parse_ipv6(EntityHost)), EntityHost, "")
| extend EntityHost = iff(isempty(EntityIP) and strlen(EntityHost) <= 253
    and EntityHost matches regex @"(?i)^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"
    and not(EntityHost matches regex @"^[0-9.]+$"), tolower(EntityHost), "")
| extend _portalOrigin = tostring(redRaysPortalUrls[tostring(ProductInstanceId)]), _sourceLink = tostring(SourceUrl)
| extend _entityUrlCandidate = case(
    _sourceLink startswith "/app/" and _portalOrigin matches regex @"(?i)^https?://[^/?#@\s\\]+/?$",
    strcat(trim_end(@"/+", _portalOrigin), _sourceLink),
    _sourceLink)
| extend _parsedEntityUrl = parse_url(_entityUrlCandidate)
| extend EntityUrl = iff(tostring(_parsedEntityUrl.Scheme) in~ ("https", "http")
    and isnotempty(tostring(_parsedEntityUrl.Host))
    and isempty(tostring(_parsedEntityUrl.Username)) and isempty(tostring(_parsedEntityUrl.Password))
    and not(_entityUrlCandidate matches regex @"[\s\\]"), _entityUrlCandidate, "")
| project-away _portalOrigin, _sourceLink, _entityUrlCandidate, _parsedEntityUrl

YAML

queryFrequency: 15m
entityMappings:
- fieldMappings:
  - columnName: EntityHost
    identifier: FullName
  entityType: Host
- fieldMappings:
  - columnName: EntityIP
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: EntityUrl
    identifier: Url
  entityType: URL
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    reopenClosedIncident: false
    matchingMethod: Selected
    lookbackDuration: PT24H
    enabled: true
    groupByCustomDetails:
    - FindingKey
triggerThreshold: 0
triggerOperator: gt
severity: Medium
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/RedRays%20SAP%20Security%20Findings/Analytic%20Rules/RedRaysVulnerableProfileParameters.yaml
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: 'RedRays: {{Title}}'
query: |-
  // Map each ProductInstanceId to its RedRays origin to resolve relative source links.
  // Example: dynamic({"<ProductInstanceId>": "https://redrays.example"})
  let redRaysPortalUrls = dynamic({});
  let observations = RedRaysProfileChecks_CL
  | where TimeGenerated >= ago(1d)
  | extend ArrivedAt = ingestion_time()
  | summarize arg_min(ArrivedAt, *) by EventId;
  let candidates = observations
  | where IsAlertCandidate == true and ArrivedAt > ago(15m)
  | project FindingKey, AlertFingerprint, AlertEventId = EventId, AlertArrivedAt = ArrivedAt
  | summarize arg_min(AlertArrivedAt, *) by FindingKey, AlertFingerprint;
  observations
  | summarize arg_max(Revision, *) by FindingKey
  | where IsActionable == true
  | where SourceStatus == "VULNERABLE"
  | join kind=inner candidates on FindingKey, AlertFingerprint
  | extend EventId = AlertEventId
  | extend EntityHost = trim_end(@"\.", trim(@"\s+", tostring(Host)))
  | extend EntityIP = iff(EntityHost !contains "/" and isnotempty(parse_ipv6(EntityHost)), EntityHost, "")
  | extend EntityHost = iff(isempty(EntityIP) and strlen(EntityHost) <= 253
      and EntityHost matches regex @"(?i)^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"
      and not(EntityHost matches regex @"^[0-9.]+$"), tolower(EntityHost), "")
  | extend _portalOrigin = tostring(redRaysPortalUrls[tostring(ProductInstanceId)]), _sourceLink = tostring(SourceUrl)
  | extend _entityUrlCandidate = case(
      _sourceLink startswith "/app/" and _portalOrigin matches regex @"(?i)^https?://[^/?#@\s\\]+/?$",
      strcat(trim_end(@"/+", _portalOrigin), _sourceLink),
      _sourceLink)
  | extend _parsedEntityUrl = parse_url(_entityUrlCandidate)
  | extend EntityUrl = iff(tostring(_parsedEntityUrl.Scheme) in~ ("https", "http")
      and isnotempty(tostring(_parsedEntityUrl.Host))
      and isempty(tostring(_parsedEntityUrl.Username)) and isempty(tostring(_parsedEntityUrl.Password))
      and not(_entityUrlCandidate matches regex @"[\s\\]"), _entityUrlCandidate, "")
  | project-away _portalOrigin, _sourceLink, _entityUrlCandidate, _parsedEntityUrl
tactics:
- DefenseEvasion
- CredentialAccess
queryPeriod: 1d
customDetails:
  SourceStatus: SourceStatus
  ProductInstanceId: ProductInstanceId
  FindingKey: FindingKey
  SourceUrl: SourceUrl
  EventId: EventId
  SourceSeverity: SourceSeverity
  SapClient: SapClient
  Module: Module
  SystemId: SystemId
relevantTechniques:
- T1562
- T1110
requiredDataConnectors:
- connectorId: RedRaysSAPSecurityFindings
  dataTypes:
  - RedRaysProfileChecks_CL
id: 708b461c-40b0-571a-8ec5-a3791dce23a4
version: 1.0.3
description: Identifies new or materially changed, actionable profile parameter checks from RedRays. Checks marked VULNERABLE raise Medium severity alerts under the integration's policy. Initial findings raise alerts only if you enable baseline alerting in RedRays. The ATT&CK mapping describes how an adversary could abuse weakened SAP security settings, not evidence of an attack. Records outside the one-day query window do not trigger this rule.
kind: Scheduled
name: RedRays - Profile Parameters
status: InPreview

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/708b461c-40b0-571a-8ec5-a3791dce23a4')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/708b461c-40b0-571a-8ec5-a3791dce23a4')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDisplayNameFormat": "RedRays: {{Title}}"
        },
        "alertRuleTemplateName": "708b461c-40b0-571a-8ec5-a3791dce23a4",
        "customDetails": {
          "EventId": "EventId",
          "FindingKey": "FindingKey",
          "Module": "Module",
          "ProductInstanceId": "ProductInstanceId",
          "SapClient": "SapClient",
          "SourceSeverity": "SourceSeverity",
          "SourceStatus": "SourceStatus",
          "SourceUrl": "SourceUrl",
          "SystemId": "SystemId"
        },
        "description": "Identifies new or materially changed, actionable profile parameter checks from RedRays. Checks marked VULNERABLE raise Medium severity alerts under the integration's policy. Initial findings raise alerts only if you enable baseline alerting in RedRays. The ATT&CK mapping describes how an adversary could abuse weakened SAP security settings, not evidence of an attack. Records outside the one-day query window do not trigger this rule.",
        "displayName": "RedRays - Profile Parameters",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "EntityHost",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "EntityIP",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "EntityUrl",
                "identifier": "Url"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByCustomDetails": [
              "FindingKey"
            ],
            "lookbackDuration": "PT24H",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/RedRays%20SAP%20Security%20Findings/Analytic%20Rules/RedRaysVulnerableProfileParameters.yaml",
        "query": "// Map each ProductInstanceId to its RedRays origin to resolve relative source links.\n// Example: dynamic({\"<ProductInstanceId>\": \"https://redrays.example\"})\nlet redRaysPortalUrls = dynamic({});\nlet observations = RedRaysProfileChecks_CL\n| where TimeGenerated >= ago(1d)\n| extend ArrivedAt = ingestion_time()\n| summarize arg_min(ArrivedAt, *) by EventId;\nlet candidates = observations\n| where IsAlertCandidate == true and ArrivedAt > ago(15m)\n| project FindingKey, AlertFingerprint, AlertEventId = EventId, AlertArrivedAt = ArrivedAt\n| summarize arg_min(AlertArrivedAt, *) by FindingKey, AlertFingerprint;\nobservations\n| summarize arg_max(Revision, *) by FindingKey\n| where IsActionable == true\n| where SourceStatus == \"VULNERABLE\"\n| join kind=inner candidates on FindingKey, AlertFingerprint\n| extend EventId = AlertEventId\n| extend EntityHost = trim_end(@\"\\.\", trim(@\"\\s+\", tostring(Host)))\n| extend EntityIP = iff(EntityHost !contains \"/\" and isnotempty(parse_ipv6(EntityHost)), EntityHost, \"\")\n| extend EntityHost = iff(isempty(EntityIP) and strlen(EntityHost) <= 253\n    and EntityHost matches regex @\"(?i)^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$\"\n    and not(EntityHost matches regex @\"^[0-9.]+$\"), tolower(EntityHost), \"\")\n| extend _portalOrigin = tostring(redRaysPortalUrls[tostring(ProductInstanceId)]), _sourceLink = tostring(SourceUrl)\n| extend _entityUrlCandidate = case(\n    _sourceLink startswith \"/app/\" and _portalOrigin matches regex @\"(?i)^https?://[^/?#@\\s\\\\]+/?$\",\n    strcat(trim_end(@\"/+\", _portalOrigin), _sourceLink),\n    _sourceLink)\n| extend _parsedEntityUrl = parse_url(_entityUrlCandidate)\n| extend EntityUrl = iff(tostring(_parsedEntityUrl.Scheme) in~ (\"https\", \"http\")\n    and isnotempty(tostring(_parsedEntityUrl.Host))\n    and isempty(tostring(_parsedEntityUrl.Username)) and isempty(tostring(_parsedEntityUrl.Password))\n    and not(_entityUrlCandidate matches regex @\"[\\s\\\\]\"), _entityUrlCandidate, \"\")\n| project-away _portalOrigin, _sourceLink, _entityUrlCandidate, _parsedEntityUrl",
        "queryFrequency": "PT15M",
        "queryPeriod": "P1D",
        "severity": "Medium",
        "status": "InPreview",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "DefenseEvasion"
        ],
        "techniques": [
          "T1110",
          "T1562"
        ],
        "templateVersion": "1.0.3",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}