TI map File Hash to Security Event

Back


Id	a7427ed7-04b4-4e3b-b323-08b981b9b4bf
Rulename	TI map File Hash to Security Event
Description	Identifies a match in Security Event data from any File Hash IOC from TI
Severity	Medium
Tactics	Impact
Required data connectors	SecurityEvents ThreatIntelligence ThreatIntelligenceTaxii WindowsForwardedEvents WindowsSecurityEvents
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_SecurityEvent.yaml
Version	1.4.1
Arm template	a7427ed7-04b4-4e3b-b323-08b981b9b4bf.json

KQL

let dt_lookBack = 1h;
 let ioc_lookBack = 14d;
 ThreatIntelligenceIndicator
 | where TimeGenerated >= ago(ioc_lookBack) and ExpirationDateTime > now()
 | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
 | where Active == true
 | where isnotempty(FileHashValue)
 | extend FileHashValue = toupper(FileHashValue)
 // using innerunique to keep perf fast and result set low, we only need one match to indicate potential malicious activity that needs to be investigated
 | join kind=innerunique ( union isfuzzy=true
   (SecurityEvent | where TimeGenerated >= ago(dt_lookBack)
       | where EventID in ("8003","8002","8005")
       | where isnotempty(FileHash)
       | extend SecurityEvent_TimeGenerated = TimeGenerated, Event = EventID, FileHash = toupper(FileHash)
   ),
   (WindowsEvent | where TimeGenerated >= ago(dt_lookBack)
       | where EventID in ("8003","8002","8005")
       | where isnotempty(EventData.FileHash)
       | extend SecurityEvent_TimeGenerated = TimeGenerated, Event = EventID, FileHash = toupper(EventData.FileHash)
   )
 )
 on $left.FileHashValue == $right.FileHash
 | where SecurityEvent_TimeGenerated < ExpirationDateTime
 | summarize SecurityEvent_TimeGenerated = arg_max(SecurityEvent_TimeGenerated, *) by IndicatorId, FileHash
 | project SecurityEvent_TimeGenerated, Description, ActivityGroupNames, IndicatorId, ThreatType, Url, ExpirationDateTime, ConfidenceScore,
 Process, FileHash, Computer, Account, Event, FileHashValue, FileHashType
 | extend timestamp = SecurityEvent_TimeGenerated, AccountCustomEntity = Account, HostCustomEntity = Computer, URLCustomEntity = Url

YAML

version: 1.4.1
queryFrequency: 1h
requiredDataConnectors:
- connectorId: SecurityEvents
  dataTypes:
  - SecurityEvent
- connectorId: WindowsSecurityEvents
  dataTypes:
  - SecurityEvents
- connectorId: WindowsForwardedEvents
  dataTypes:
  - WindowsEvent
- connectorId: ThreatIntelligence
  dataTypes:
  - ThreatIntelligenceIndicator
- connectorId: ThreatIntelligenceTaxii
  dataTypes:
  - ThreatIntelligenceIndicator
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
  entityType: Account
- fieldMappings:
  - columnName: HostCustomEntity
    identifier: FullName
  entityType: Host
- fieldMappings:
  - columnName: URLCustomEntity
    identifier: Url
  entityType: URL
- fieldMappings:
  - columnName: FileHashValue
    identifier: Value
  - columnName: FileHashType
    identifier: Algorithm
  entityType: FileHash
kind: Scheduled
queryPeriod: 14d
severity: Medium
query: |
  let dt_lookBack = 1h;
   let ioc_lookBack = 14d;
   ThreatIntelligenceIndicator
   | where TimeGenerated >= ago(ioc_lookBack) and ExpirationDateTime > now()
   | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
   | where Active == true
   | where isnotempty(FileHashValue)
   | extend FileHashValue = toupper(FileHashValue)
   // using innerunique to keep perf fast and result set low, we only need one match to indicate potential malicious activity that needs to be investigated
   | join kind=innerunique ( union isfuzzy=true
     (SecurityEvent | where TimeGenerated >= ago(dt_lookBack)
         | where EventID in ("8003","8002","8005")
         | where isnotempty(FileHash)
         | extend SecurityEvent_TimeGenerated = TimeGenerated, Event = EventID, FileHash = toupper(FileHash)
     ),
     (WindowsEvent | where TimeGenerated >= ago(dt_lookBack)
         | where EventID in ("8003","8002","8005")
         | where isnotempty(EventData.FileHash)
         | extend SecurityEvent_TimeGenerated = TimeGenerated, Event = EventID, FileHash = toupper(EventData.FileHash)
     )
   )
   on $left.FileHashValue == $right.FileHash
   | where SecurityEvent_TimeGenerated < ExpirationDateTime
   | summarize SecurityEvent_TimeGenerated = arg_max(SecurityEvent_TimeGenerated, *) by IndicatorId, FileHash
   | project SecurityEvent_TimeGenerated, Description, ActivityGroupNames, IndicatorId, ThreatType, Url, ExpirationDateTime, ConfidenceScore,
   Process, FileHash, Computer, Account, Event, FileHashValue, FileHashType
   | extend timestamp = SecurityEvent_TimeGenerated, AccountCustomEntity = Account, HostCustomEntity = Computer, URLCustomEntity = Url  
triggerOperator: gt
id: a7427ed7-04b4-4e3b-b323-08b981b9b4bf
description: |
    'Identifies a match in Security Event data from any File Hash IOC from TI'
triggerThreshold: 0
name: TI map File Hash to Security Event
tactics:
- Impact
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_SecurityEvent.yaml

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/a7427ed7-04b4-4e3b-b323-08b981b9b4bf')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/a7427ed7-04b4-4e3b-b323-08b981b9b4bf')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01",
      "properties": {
        "displayName": "TI map File Hash to Security Event",
        "description": "'Identifies a match in Security Event data from any File Hash IOC from TI'\n",
        "severity": "Medium",
        "enabled": true,
        "query": "let dt_lookBack = 1h;\n let ioc_lookBack = 14d;\n ThreatIntelligenceIndicator\n | where TimeGenerated >= ago(ioc_lookBack) and ExpirationDateTime > now()\n | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId\n | where Active == true\n | where isnotempty(FileHashValue)\n | extend FileHashValue = toupper(FileHashValue)\n // using innerunique to keep perf fast and result set low, we only need one match to indicate potential malicious activity that needs to be investigated\n | join kind=innerunique ( union isfuzzy=true\n   (SecurityEvent | where TimeGenerated >= ago(dt_lookBack)\n       | where EventID in (\"8003\",\"8002\",\"8005\")\n       | where isnotempty(FileHash)\n       | extend SecurityEvent_TimeGenerated = TimeGenerated, Event = EventID, FileHash = toupper(FileHash)\n   ),\n   (WindowsEvent | where TimeGenerated >= ago(dt_lookBack)\n       | where EventID in (\"8003\",\"8002\",\"8005\")\n       | where isnotempty(EventData.FileHash)\n       | extend SecurityEvent_TimeGenerated = TimeGenerated, Event = EventID, FileHash = toupper(EventData.FileHash)\n   )\n )\n on $left.FileHashValue == $right.FileHash\n | where SecurityEvent_TimeGenerated < ExpirationDateTime\n | summarize SecurityEvent_TimeGenerated = arg_max(SecurityEvent_TimeGenerated, *) by IndicatorId, FileHash\n | project SecurityEvent_TimeGenerated, Description, ActivityGroupNames, IndicatorId, ThreatType, Url, ExpirationDateTime, ConfidenceScore,\n Process, FileHash, Computer, Account, Event, FileHashValue, FileHashType\n | extend timestamp = SecurityEvent_TimeGenerated, AccountCustomEntity = Account, HostCustomEntity = Computer, URLCustomEntity = Url\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P14D",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "alertRuleTemplateName": "a7427ed7-04b4-4e3b-b323-08b981b9b4bf",
        "customDetails": null,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "identifier": "FullName",
                "columnName": "AccountCustomEntity"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "identifier": "FullName",
                "columnName": "HostCustomEntity"
              }
            ]
          },
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "identifier": "Url",
                "columnName": "URLCustomEntity"
              }
            ]
          },
          {
            "entityType": "FileHash",
            "fieldMappings": [
              {
                "identifier": "Value",
                "columnName": "FileHashValue"
              },
              {
                "identifier": "Algorithm",
                "columnName": "FileHashType"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_SecurityEvent.yaml",
        "templateVersion": "1.4.1"
      }
    }
  ]
}