Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

vArmour AppController - SMB Realm Traversal

Back
Ida36de6c3-3198-4d37-92ae-e19e36712c2e
RulenamevArmour AppController - SMB Realm Traversal
DescriptionDetects when SMB traffic crosses Production and Non-Production Realms. Possible network share discovery or lateral tool transfer across realms
SeverityMedium
TacticsDiscovery
LateralMovement
TechniquesT1135
T1570
Required data connectorsvArmourAC
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/vArmour Application Controller/Analytic Rules/vArmourApplicationControllerSMBRealmTraversal.yaml
Version1.0.0
Arm templatea36de6c3-3198-4d37-92ae-e19e36712c2e.json
Deploy To Azure
CommonSecurityLog
| where DeviceVendor == "vArmour"
| where DeviceProduct == "AC"
| where Activity == "POLICY_VIOLATION"
| extend PolicyName = extract("(SMB_REALM_TRAVERSAL\\w+{.*})", 1, DeviceCustomString1)
severity: Medium
triggerThreshold: 0
query: |
  CommonSecurityLog
  | where DeviceVendor == "vArmour"
  | where DeviceProduct == "AC"
  | where Activity == "POLICY_VIOLATION"
  | extend PolicyName = extract("(SMB_REALM_TRAVERSAL\\w+{.*})", 1, DeviceCustomString1)  
queryFrequency: 1h
requiredDataConnectors:
- connectorId: vArmourAC
  dataTypes:
  - CommonSecurityLog
id: a36de6c3-3198-4d37-92ae-e19e36712c2e
version: 1.0.0
name: vArmour AppController - SMB Realm Traversal
kind: Scheduled
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/vArmour Application Controller/Analytic Rules/vArmourApplicationControllerSMBRealmTraversal.yaml
queryPeriod: 1h
relevantTechniques:
- T1135
- T1570
triggerOperator: gt
tactics:
- Discovery
- LateralMovement
description: |
    'Detects when SMB traffic crosses Production and Non-Production Realms. Possible network share discovery or lateral tool transfer across realms'
entityMappings:
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: DestinationHostName
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SourceIP
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/a36de6c3-3198-4d37-92ae-e19e36712c2e')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/a36de6c3-3198-4d37-92ae-e19e36712c2e')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01",
      "properties": {
        "displayName": "vArmour AppController - SMB Realm Traversal",
        "description": "'Detects when SMB traffic crosses Production and Non-Production Realms. Possible network share discovery or lateral tool transfer across realms'\n",
        "severity": "Medium",
        "enabled": true,
        "query": "CommonSecurityLog\n| where DeviceVendor == \"vArmour\"\n| where DeviceProduct == \"AC\"\n| where Activity == \"POLICY_VIOLATION\"\n| extend PolicyName = extract(\"(SMB_REALM_TRAVERSAL\\\\w+{.*})\", 1, DeviceCustomString1)\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Discovery",
          "LateralMovement"
        ],
        "techniques": [
          "T1135",
          "T1570"
        ],
        "alertRuleTemplateName": "a36de6c3-3198-4d37-92ae-e19e36712c2e",
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "columnName": "DestinationHostName",
                "identifier": "HostName"
              }
            ],
            "entityType": "Host"
          },
          {
            "fieldMappings": [
              {
                "columnName": "SourceIP",
                "identifier": "Address"
              }
            ],
            "entityType": "IP"
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/vArmour Application Controller/Analytic Rules/vArmourApplicationControllerSMBRealmTraversal.yaml",
        "templateVersion": "1.0.0",
        "status": "Available"
      }
    }
  ]
}