Box - Forbidden file type downloaded

Back


Id	8889e69c-2161-412a-94a6-76c1b2d9daa7
Rulename	Box - Forbidden file type downloaded
Description	Detects when new user downloads forbidden file types.
Severity	Medium
Tactics	InitialAccess
Techniques	T1189
Required data connectors	BoxDataConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Box/Analytic Rules/BoxDownloadForbiddenFiles.yaml
Version	1.0.0
Arm template	8889e69c-2161-412a-94a6-76c1b2d9daa7.json

KQL

let forbidden_files = dynamic(['ps1', 'bat', 'scr', 'sh']);
BoxEvents
| where EventType =~ 'DOWNLOAD'
| extend file_type = extract(@'\.(\w+)$', 1, SourceItemName)
| where file_type in (forbidden_files)
| extend AccountCustomEntity = SrcUserName
| extend IPCustomEntity = SrcIpAddr

YAML

description: |
    'Detects when new user downloads forbidden file types.'
tactics:
- InitialAccess
severity: Medium
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
  entityType: Account
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
queryFrequency: 1h
triggerOperator: gt
status: Available
query: |
  let forbidden_files = dynamic(['ps1', 'bat', 'scr', 'sh']);
  BoxEvents
  | where EventType =~ 'DOWNLOAD'
  | extend file_type = extract(@'\.(\w+)$', 1, SourceItemName)
  | where file_type in (forbidden_files)
  | extend AccountCustomEntity = SrcUserName
  | extend IPCustomEntity = SrcIpAddr  
name: Box - Forbidden file type downloaded
version: 1.0.0
triggerThreshold: 0
id: 8889e69c-2161-412a-94a6-76c1b2d9daa7
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Box/Analytic Rules/BoxDownloadForbiddenFiles.yaml
relevantTechniques:
- T1189
queryPeriod: 1h
kind: Scheduled
requiredDataConnectors:
- dataTypes:
  - BoxEvents_CL
  connectorId: BoxDataConnector

ARM