Digital Guardian - Unexpected protocol

Back


Id	a14f2f95-bbd2-4036-ad59-e3aff132b296
Rulename	Digital Guardian - Unexpected protocol
Description	Detects RDP protocol usage for data transfer which is not common.
Severity	High
Tactics	Exfiltration
Techniques	T1048
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Digital Guardian Data Loss Prevention/Analytic Rules/DigitalGuardianUnexpectedProtocol.yaml
Version	1.0.2
Arm template	a14f2f95-bbd2-4036-ad59-e3aff132b296.json

KQL

DigitalGuardianDLPEvent
| where DstPortNumber == 3389
| extend AccountCustomEntity = SrcUserName

YAML

queryFrequency: 1h
triggerThreshold: 0
name: Digital Guardian - Unexpected protocol
relevantTechniques:
- T1048
id: a14f2f95-bbd2-4036-ad59-e3aff132b296
query: |
  DigitalGuardianDLPEvent
  | where DstPortNumber == 3389
  | extend AccountCustomEntity = SrcUserName  
severity: High
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Digital Guardian Data Loss Prevention/Analytic Rules/DigitalGuardianUnexpectedProtocol.yaml
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountCustomEntity
    identifier: Name
version: 1.0.2
queryPeriod: 1h
tactics:
- Exfiltration
triggerOperator: gt
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
status: Available
kind: Scheduled
description: |
    'Detects RDP protocol usage for data transfer which is not common.'

ARM