CyberArkEPM - Uncommon process Internet access

Back


Id	9d0d44ab-54dc-472a-9931-53521e888932
Rulename	CyberArkEPM - Uncommon process Internet access
Description	Detects access to the Internet by uncommon processes.
Severity	High
Tactics	Execution DefenseEvasion CommandAndControl
Techniques	T1204 T1036 T1095
Required data connectors	CyberArkEPM
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CyberArkEPM/Analytic Rules/CyberArkEPMRareProcInternetAccess.yaml
Version	1.0.0
Arm template	9d0d44ab-54dc-472a-9931-53521e888932.json

KQL

let lb_period = 14d;
let q_time = 1h;
let inet_access_proc = CyberArkEPM
| where TimeGenerated between (ago(lb_period) .. ago(q_time))
| where EventSubType =~ 'DetectAccessInternet'
| where isnotempty(ActingProcessFileInternalName)
| summarize makeset(ActingProcessFileInternalName);
CyberArkEPM
| where TimeGenerated > ago(q_time)
| where EventSubType =~ 'DetectAccessInternet'
| where ActingProcessFileInternalName !in (inet_access_proc)
| extend AccountCustomEntity = ActorUsername

YAML

query: |
  let lb_period = 14d;
  let q_time = 1h;
  let inet_access_proc = CyberArkEPM
  | where TimeGenerated between (ago(lb_period) .. ago(q_time))
  | where EventSubType =~ 'DetectAccessInternet'
  | where isnotempty(ActingProcessFileInternalName)
  | summarize makeset(ActingProcessFileInternalName);
  CyberArkEPM
  | where TimeGenerated > ago(q_time)
  | where EventSubType =~ 'DetectAccessInternet'
  | where ActingProcessFileInternalName !in (inet_access_proc)
  | extend AccountCustomEntity = ActorUsername  
triggerOperator: gt
description: |
    'Detects access to the Internet by uncommon processes.'
version: 1.0.0
id: 9d0d44ab-54dc-472a-9931-53521e888932
relevantTechniques:
- T1204
- T1036
- T1095
requiredDataConnectors:
- connectorId: CyberArkEPM
  dataTypes:
  - CyberArkEPM
severity: High
tactics:
- Execution
- DefenseEvasion
- CommandAndControl
name: CyberArkEPM - Uncommon process Internet access
queryFrequency: 30m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CyberArkEPM/Analytic Rules/CyberArkEPMRareProcInternetAccess.yaml
queryPeriod: 30m
triggerThreshold: 0
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountCustomEntity
    identifier: Name
kind: Scheduled

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/9d0d44ab-54dc-472a-9931-53521e888932')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/9d0d44ab-54dc-472a-9931-53521e888932')]",
      "properties": {
        "alertRuleTemplateName": "9d0d44ab-54dc-472a-9931-53521e888932",
        "customDetails": null,
        "description": "'Detects access to the Internet by uncommon processes.'\n",
        "displayName": "CyberArkEPM - Uncommon process Internet access",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "Name"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CyberArkEPM/Analytic Rules/CyberArkEPMRareProcInternetAccess.yaml",
        "query": "let lb_period = 14d;\nlet q_time = 1h;\nlet inet_access_proc = CyberArkEPM\n| where TimeGenerated between (ago(lb_period) .. ago(q_time))\n| where EventSubType =~ 'DetectAccessInternet'\n| where isnotempty(ActingProcessFileInternalName)\n| summarize makeset(ActingProcessFileInternalName);\nCyberArkEPM\n| where TimeGenerated > ago(q_time)\n| where EventSubType =~ 'DetectAccessInternet'\n| where ActingProcessFileInternalName !in (inet_access_proc)\n| extend AccountCustomEntity = ActorUsername\n",
        "queryFrequency": "PT30M",
        "queryPeriod": "PT30M",
        "severity": "High",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CommandAndControl",
          "DefenseEvasion",
          "Execution"
        ],
        "techniques": [
          "T1036",
          "T1095",
          "T1204"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}