vArmour AppController - SMB Realm Traversal

Back


Id	a36de6c3-3198-4d37-92ae-e19e36712c2e
Rulename	vArmour AppController - SMB Realm Traversal
Description	Detects when SMB traffic crosses Production and Non-Production Realms. Possible network share discovery or lateral tool transfer across realms
Severity	Medium
Tactics	Discovery LateralMovement
Techniques	T1135 T1570
Required data connectors	CefAma vArmourAC vArmourACAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/vArmour Application Controller/Analytic Rules/vArmourApplicationControllerSMBRealmTraversal.yaml
Version	1.0.2
Arm template	a36de6c3-3198-4d37-92ae-e19e36712c2e.json

KQL

CommonSecurityLog
| where DeviceVendor == "vArmour"
| where DeviceProduct == "AC"
| where Activity == "POLICY_VIOLATION"
| extend PolicyName = extract("(SMB_REALM_TRAVERSAL\\w+{.*})", 1, DeviceCustomString1)

YAML

status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/vArmour Application Controller/Analytic Rules/vArmourApplicationControllerSMBRealmTraversal.yaml
query: |
  CommonSecurityLog
  | where DeviceVendor == "vArmour"
  | where DeviceProduct == "AC"
  | where Activity == "POLICY_VIOLATION"
  | extend PolicyName = extract("(SMB_REALM_TRAVERSAL\\w+{.*})", 1, DeviceCustomString1)  
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: vArmourAC
- dataTypes:
  - CommonSecurityLog
  connectorId: vArmourACAma
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma
tactics:
- Discovery
- LateralMovement
name: vArmour AppController - SMB Realm Traversal
relevantTechniques:
- T1135
- T1570
severity: Medium
entityMappings:
- fieldMappings:
  - identifier: HostName
    columnName: DestinationHostName
  entityType: Host
- fieldMappings:
  - identifier: Address
    columnName: SourceIP
  entityType: IP
kind: Scheduled
queryFrequency: 1h
description: |
    'Detects when SMB traffic crosses Production and Non-Production Realms. Possible network share discovery or lateral tool transfer across realms'
triggerThreshold: 0
triggerOperator: gt
version: 1.0.2
queryPeriod: 1h
id: a36de6c3-3198-4d37-92ae-e19e36712c2e

ARM