vArmour AppController - SMB Realm Traversal

Back


Id	a36de6c3-3198-4d37-92ae-e19e36712c2e
Rulename	vArmour AppController - SMB Realm Traversal
Description	Detects when SMB traffic crosses Production and Non-Production Realms. Possible network share discovery or lateral tool transfer across realms
Severity	Medium
Tactics	Discovery LateralMovement
Techniques	T1135 T1570
Required data connectors	CefAma vArmourAC vArmourACAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/vArmour Application Controller/Analytic Rules/vArmourApplicationControllerSMBRealmTraversal.yaml
Version	1.0.2
Arm template	a36de6c3-3198-4d37-92ae-e19e36712c2e.json

KQL

CommonSecurityLog
| where DeviceVendor == "vArmour"
| where DeviceProduct == "AC"
| where Activity == "POLICY_VIOLATION"
| extend PolicyName = extract("(SMB_REALM_TRAVERSAL\\w+{.*})", 1, DeviceCustomString1)

YAML

queryPeriod: 1h
query: |
  CommonSecurityLog
  | where DeviceVendor == "vArmour"
  | where DeviceProduct == "AC"
  | where Activity == "POLICY_VIOLATION"
  | extend PolicyName = extract("(SMB_REALM_TRAVERSAL\\w+{.*})", 1, DeviceCustomString1)  
name: vArmour AppController - SMB Realm Traversal
entityMappings:
- fieldMappings:
  - columnName: DestinationHostName
    identifier: HostName
  entityType: Host
- fieldMappings:
  - columnName: SourceIP
    identifier: Address
  entityType: IP
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/vArmour Application Controller/Analytic Rules/vArmourApplicationControllerSMBRealmTraversal.yaml
requiredDataConnectors:
- connectorId: vArmourAC
  dataTypes:
  - CommonSecurityLog
- connectorId: vArmourACAma
  dataTypes:
  - CommonSecurityLog
- connectorId: CefAma
  dataTypes:
  - CommonSecurityLog
description: |
    'Detects when SMB traffic crosses Production and Non-Production Realms. Possible network share discovery or lateral tool transfer across realms'
kind: Scheduled
version: 1.0.2
status: Available
severity: Medium
relevantTechniques:
- T1135
- T1570
triggerOperator: gt
triggerThreshold: 0
tactics:
- Discovery
- LateralMovement
id: a36de6c3-3198-4d37-92ae-e19e36712c2e

ARM