PaloAlto - Forbidden countries

Back


Id	9fcc7734-4d1b-11ec-81d3-0242ac130003
Rulename	PaloAlto - Forbidden countries
Description	Detects suspicious connections from forbidden countries.
Severity	Medium
Tactics	InitialAccess
Techniques	T1190 T1133
Required data connectors	CefAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLUnexpectedCountries.yaml
Version	1.0.4
Arm template	9fcc7734-4d1b-11ec-81d3-0242ac130003.json

KQL

let bl_countries = dynamic(['CH', 'RU']);
PaloAltoCDLEvent 
| where EventResourceId =~ 'TRAFFIC'
| where MaliciousIPCountry  in (bl_countries)
| summarize count() by DstUsername, SrcIpAddr 
| extend IPCustomEntity = SrcIpAddr, AccountCustomEntity = DstUsername

YAML

name: PaloAlto - Forbidden countries
relevantTechniques:
- T1190
- T1133
id: 9fcc7734-4d1b-11ec-81d3-0242ac130003
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLUnexpectedCountries.yaml
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma
version: 1.0.4
severity: Medium
triggerThreshold: 0
queryPeriod: 1h
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
  entityType: Account
- fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
  entityType: IP
queryFrequency: 1h
status: Available
query: |
  let bl_countries = dynamic(['CH', 'RU']);
  PaloAltoCDLEvent 
  | where EventResourceId =~ 'TRAFFIC'
  | where MaliciousIPCountry  in (bl_countries)
  | summarize count() by DstUsername, SrcIpAddr 
  | extend IPCustomEntity = SrcIpAddr, AccountCustomEntity = DstUsername  
tactics:
- InitialAccess
kind: Scheduled
description: |
    'Detects suspicious connections from forbidden countries.'
triggerOperator: gt

ARM