PaloAlto - Forbidden countries

Back


Id	9fcc7734-4d1b-11ec-81d3-0242ac130003
Rulename	PaloAlto - Forbidden countries
Description	Detects suspicious connections from forbidden countries.
Severity	Medium
Tactics	InitialAccess
Techniques	T1190 T1133
Required data connectors	CefAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLUnexpectedCountries.yaml
Version	1.0.4
Arm template	9fcc7734-4d1b-11ec-81d3-0242ac130003.json

KQL

let bl_countries = dynamic(['CH', 'RU']);
PaloAltoCDLEvent 
| where EventResourceId =~ 'TRAFFIC'
| where MaliciousIPCountry  in (bl_countries)
| summarize count() by DstUsername, SrcIpAddr 
| extend IPCustomEntity = SrcIpAddr, AccountCustomEntity = DstUsername

YAML

description: |
    'Detects suspicious connections from forbidden countries.'
kind: Scheduled
tactics:
- InitialAccess
requiredDataConnectors:
- connectorId: CefAma
  dataTypes:
  - CommonSecurityLog
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLUnexpectedCountries.yaml
severity: Medium
name: PaloAlto - Forbidden countries
triggerThreshold: 0
queryPeriod: 1h
query: |
  let bl_countries = dynamic(['CH', 'RU']);
  PaloAltoCDLEvent 
  | where EventResourceId =~ 'TRAFFIC'
  | where MaliciousIPCountry  in (bl_countries)
  | summarize count() by DstUsername, SrcIpAddr 
  | extend IPCustomEntity = SrcIpAddr, AccountCustomEntity = DstUsername  
relevantTechniques:
- T1190
- T1133
id: 9fcc7734-4d1b-11ec-81d3-0242ac130003
queryFrequency: 1h
status: Available
triggerOperator: gt
version: 1.0.4
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountCustomEntity
    identifier: Name
- entityType: IP
  fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address

ARM