Vectra AI Detect - New Campaign Detected

Back


Id	a34d0338-eda0-42b5-8b93-32aae0d7a501
Rulename	Vectra AI Detect - New Campaign Detected
Description	Identifies when a new Campaign has been detected. This occurs when multiple Detections accross different Hosts are suspected to be part of the same Attack Campaign.
Severity	Medium
Tactics	LateralMovement CommandAndControl
Techniques	T1021 T1071
Required data connectors	CefAma
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vectra AI Detect/Analytic Rules/VectraDetect-NewCampaign.yaml
Version	1.2.3
Arm template	a34d0338-eda0-42b5-8b93-32aae0d7a501.json

KQL

CommonSecurityLog
| where DeviceVendor == "Vectra Networks"
| where DeviceProduct == "X Series"
| where DeviceEventClassID contains "campaign"
| where DeviceAction == "START"
| extend reason = coalesce(
                          column_ifexists("Reason", ""), 
                          extract("reason=(.+?)($|;)", 1, AdditionalExtensions),
                          ""
                      )
| project-rename vectra_URL = DeviceCustomString4
| sort by TimeGenerated

YAML

relevantTechniques:
- T1021
- T1071
entityMappings:
- entityType: DNS
  fieldMappings:
  - columnName: Activity
    identifier: DomainName
version: 1.2.3
id: a34d0338-eda0-42b5-8b93-32aae0d7a501
severity: Medium
kind: Scheduled
queryFrequency: 5m
description: |
    'Identifies when a new Campaign has been detected.  This occurs when multiple Detections accross different Hosts are suspected to be part of the same Attack Campaign.'
requiredDataConnectors:
- connectorId: CefAma
  dataTypes:
  - CommonSecurityLog
triggerOperator: gt
name: Vectra AI Detect - New Campaign Detected
tactics:
- LateralMovement
- CommandAndControl
alertDetailsOverride:
  alertDescriptionFormat: |
        A new campaign named {{Activity}} has been detected (reason is {{reason}})
  alertDynamicProperties:
  - value: vectra_URL
    alertProperty: AlertLink
  - value: DeviceProduct
    alertProperty: ProductName
  - value: DeviceVendor
    alertProperty: ProviderName
  alertDisplayNameFormat: Vectra AI - New Campaign Detected
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vectra AI Detect/Analytic Rules/VectraDetect-NewCampaign.yaml
triggerThreshold: 0
queryPeriod: 5m
query: |
  CommonSecurityLog
  | where DeviceVendor == "Vectra Networks"
  | where DeviceProduct == "X Series"
  | where DeviceEventClassID contains "campaign"
  | where DeviceAction == "START"
  | extend reason = coalesce(
                            column_ifexists("Reason", ""), 
                            extract("reason=(.+?)($|;)", 1, AdditionalExtensions),
                            ""
                        )
  | project-rename vectra_URL = DeviceCustomString4
  | sort by TimeGenerated  
status: Available
customDetails:
  CampaignName: Activity
  CampaignReason: reason
  CampaignSourceHost: SourceHostName
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    lookbackDuration: 7d
    enabled: true
    reopenClosedIncident: true
    matchingMethod: AllEntities

ARM