Box - Forbidden file type downloaded

Back


Id	8889e69c-2161-412a-94a6-76c1b2d9daa7
Rulename	Box - Forbidden file type downloaded
Description	Detects when new user downloads forbidden file types.
Severity	Medium
Tactics	InitialAccess
Techniques	T1189
Required data connectors	BoxDataConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Box/Analytic Rules/BoxDownloadForbiddenFiles.yaml
Version	1.0.0
Arm template	8889e69c-2161-412a-94a6-76c1b2d9daa7.json

KQL

let forbidden_files = dynamic(['ps1', 'bat', 'scr', 'sh']);
BoxEvents
| where EventType =~ 'DOWNLOAD'
| extend file_type = extract(@'\.(\w+)$', 1, SourceItemName)
| where file_type in (forbidden_files)
| extend AccountCustomEntity = SrcUserName
| extend IPCustomEntity = SrcIpAddr

YAML

description: |
    'Detects when new user downloads forbidden file types.'
version: 1.0.0
triggerThreshold: 0
tactics:
- InitialAccess
queryPeriod: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Box/Analytic Rules/BoxDownloadForbiddenFiles.yaml
triggerOperator: gt
status: Available
id: 8889e69c-2161-412a-94a6-76c1b2d9daa7
name: Box - Forbidden file type downloaded
queryFrequency: 1h
severity: Medium
kind: Scheduled
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
  entityType: Account
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
relevantTechniques:
- T1189
query: |
  let forbidden_files = dynamic(['ps1', 'bat', 'scr', 'sh']);
  BoxEvents
  | where EventType =~ 'DOWNLOAD'
  | extend file_type = extract(@'\.(\w+)$', 1, SourceItemName)
  | where file_type in (forbidden_files)
  | extend AccountCustomEntity = SrcUserName
  | extend IPCustomEntity = SrcIpAddr  
requiredDataConnectors:
- dataTypes:
  - BoxEvents_CL
  connectorId: BoxDataConnector

ARM