Solorigate Domains Found in VM Insights
| Id | ab4b6944-a20d-42ab-8b63-238426525801 |
| Rulename | Solorigate Domains Found in VM Insights |
| Description | Identifies connections to Solorigate-related DNS records based on VM insights data |
| Severity | High |
| Tactics | CommandAndControl |
| Techniques | T1102 |
| Required data connectors | AzureMonitor(VMInsights) |
| Kind | Scheduled |
| Query frequency | 1h |
| Query period | 1h |
| Trigger threshold | 0 |
| Trigger operator | gt |
| Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Legacy IOC based Threat Protection/Analytic Rules/Solorigate-VM-Network.yaml |
| Version | 1.0.1 |
| Arm template | ab4b6944-a20d-42ab-8b63-238426525801.json |
let domains = dynamic(["incomeupdate.com","zupertech.com","databasegalore.com","panhardware.com","avsvmcloud.com","digitalcollege.org","freescanonline.com","deftsecurity.com","thedoccloud.com","virtualdataserver.com","lcomputers.com","webcodez.com","globalnetworkissues.com","kubecloud.com","seobundlekit.com","solartrackingsystem.net","virtualwebdata.com"]);
let timeframe = 1h;
let connections = VMConnection
| where TimeGenerated >= ago(timeframe)
| extend DNSName = set_union(todynamic(RemoteDnsCanonicalNames),todynamic(RemoteDnsQuestions))
| mv-expand DNSName
| where isnotempty(DNSName)
| where DNSName has_any (domains)
| extend IPCustomEntity = RemoteIp
| summarize TimeGenerated = arg_min(TimeGenerated, *), requests = count() by IPCustomEntity, DNSName = tostring(DNSName), AgentId, Machine, Process;
let processes = VMProcess
| where TimeGenerated >= ago(timeframe)
| project AgentId, Machine, Process, UserName, UserDomain, ExecutablePath, CommandLine, FirstPid
| extend exePathArr = split(ExecutablePath, "\\")
| extend DirectoryName = array_strcat(array_slice(exePathArr, 0, array_length(exePathArr) - 2), "\\")
| extend Filename = array_strcat(array_slice(exePathArr, array_length(exePathArr) - 1, array_length(exePathArr)), "\\")
| project-away exePathArr;
let computers = VMComputer
| where TimeGenerated >= ago(timeframe)
| project HostCustomEntity = HostName, AzureResourceId = _ResourceId, AgentId, Machine;
connections | join kind = inner (processes) on AgentId, Machine, Process
| join kind = inner (computers) on AgentId, Machine
tactics:
- CommandAndControl
severity: High
requiredDataConnectors:
- connectorId: AzureMonitor(VMInsights)
dataTypes:
- VMConnection
- connectorId: AzureMonitor(VMInsights)
dataTypes:
- VMProcess
- connectorId: AzureMonitor(VMInsights)
dataTypes:
- VMComputer
triggerOperator: gt
tags:
- Solorigate
- NOBELIUM
query: "\nlet domains = dynamic([\"incomeupdate.com\",\"zupertech.com\",\"databasegalore.com\",\"panhardware.com\",\"avsvmcloud.com\",\"digitalcollege.org\",\"freescanonline.com\",\"deftsecurity.com\",\"thedoccloud.com\",\"virtualdataserver.com\",\"lcomputers.com\",\"webcodez.com\",\"globalnetworkissues.com\",\"kubecloud.com\",\"seobundlekit.com\",\"solartrackingsystem.net\",\"virtualwebdata.com\"]);\nlet timeframe = 1h;\nlet connections = VMConnection \n | where TimeGenerated >= ago(timeframe)\n | extend DNSName = set_union(todynamic(RemoteDnsCanonicalNames),todynamic(RemoteDnsQuestions))\n | mv-expand DNSName\n | where isnotempty(DNSName)\n | where DNSName has_any (domains)\n | extend IPCustomEntity = RemoteIp\n | summarize TimeGenerated = arg_min(TimeGenerated, *), requests = count() by IPCustomEntity, DNSName = tostring(DNSName), AgentId, Machine, Process;\nlet processes = VMProcess\n | where TimeGenerated >= ago(timeframe)\n | project AgentId, Machine, Process, UserName, UserDomain, ExecutablePath, CommandLine, FirstPid\n | extend exePathArr = split(ExecutablePath, \"\\\\\")\n | extend DirectoryName = array_strcat(array_slice(exePathArr, 0, array_length(exePathArr) - 2), \"\\\\\")\n | extend Filename = array_strcat(array_slice(exePathArr, array_length(exePathArr) - 1, array_length(exePathArr)), \"\\\\\")\n | project-away exePathArr;\nlet computers = VMComputer\n | where TimeGenerated >= ago(timeframe)\n | project HostCustomEntity = HostName, AzureResourceId = _ResourceId, AgentId, Machine;\nconnections | join kind = inner (processes) on AgentId, Machine, Process\n | join kind = inner (computers) on AgentId, Machine\n \n"
triggerThreshold: 0
name: Solorigate Domains Found in VM Insights
kind: Scheduled
version: 1.0.1
relevantTechniques:
- T1102
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Legacy IOC based Threat Protection/Analytic Rules/Solorigate-VM-Network.yaml
description: |
'Identifies connections to Solorigate-related DNS records based on VM insights data'
status: Available
queryFrequency: 1h
queryPeriod: 1h
entityMappings:
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: HostCustomEntity
- entityType: IP
fieldMappings:
- identifier: Address
columnName: IPCustomEntity
- entityType: DNS
fieldMappings:
- identifier: DomainName
columnName: DNSName
- entityType: Process
fieldMappings:
- identifier: ProcessId
columnName: FirstPid
- identifier: CommandLine
columnName: CommandLine
- entityType: File
fieldMappings:
- identifier: Directory
columnName: DirectoryName
- identifier: Name
columnName: Filename
id: ab4b6944-a20d-42ab-8b63-238426525801
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/ab4b6944-a20d-42ab-8b63-238426525801')]",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/ab4b6944-a20d-42ab-8b63-238426525801')]",
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
"kind": "Scheduled",
"apiVersion": "2022-11-01",
"properties": {
"displayName": "Solorigate Domains Found in VM Insights",
"description": "'Identifies connections to Solorigate-related DNS records based on VM insights data'\n",
"severity": "High",
"enabled": true,
"query": "\nlet domains = dynamic([\"incomeupdate.com\",\"zupertech.com\",\"databasegalore.com\",\"panhardware.com\",\"avsvmcloud.com\",\"digitalcollege.org\",\"freescanonline.com\",\"deftsecurity.com\",\"thedoccloud.com\",\"virtualdataserver.com\",\"lcomputers.com\",\"webcodez.com\",\"globalnetworkissues.com\",\"kubecloud.com\",\"seobundlekit.com\",\"solartrackingsystem.net\",\"virtualwebdata.com\"]);\nlet timeframe = 1h;\nlet connections = VMConnection \n | where TimeGenerated >= ago(timeframe)\n | extend DNSName = set_union(todynamic(RemoteDnsCanonicalNames),todynamic(RemoteDnsQuestions))\n | mv-expand DNSName\n | where isnotempty(DNSName)\n | where DNSName has_any (domains)\n | extend IPCustomEntity = RemoteIp\n | summarize TimeGenerated = arg_min(TimeGenerated, *), requests = count() by IPCustomEntity, DNSName = tostring(DNSName), AgentId, Machine, Process;\nlet processes = VMProcess\n | where TimeGenerated >= ago(timeframe)\n | project AgentId, Machine, Process, UserName, UserDomain, ExecutablePath, CommandLine, FirstPid\n | extend exePathArr = split(ExecutablePath, \"\\\\\")\n | extend DirectoryName = array_strcat(array_slice(exePathArr, 0, array_length(exePathArr) - 2), \"\\\\\")\n | extend Filename = array_strcat(array_slice(exePathArr, array_length(exePathArr) - 1, array_length(exePathArr)), \"\\\\\")\n | project-away exePathArr;\nlet computers = VMComputer\n | where TimeGenerated >= ago(timeframe)\n | project HostCustomEntity = HostName, AzureResourceId = _ResourceId, AgentId, Machine;\nconnections | join kind = inner (processes) on AgentId, Machine, Process\n | join kind = inner (computers) on AgentId, Machine\n \n",
"queryFrequency": "PT1H",
"queryPeriod": "PT1H",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0,
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"CommandAndControl"
],
"techniques": [
"T1102"
],
"alertRuleTemplateName": "ab4b6944-a20d-42ab-8b63-238426525801",
"customDetails": null,
"entityMappings": [
{
"fieldMappings": [
{
"columnName": "HostCustomEntity",
"identifier": "HostName"
}
],
"entityType": "Host"
},
{
"fieldMappings": [
{
"columnName": "IPCustomEntity",
"identifier": "Address"
}
],
"entityType": "IP"
},
{
"fieldMappings": [
{
"columnName": "DNSName",
"identifier": "DomainName"
}
],
"entityType": "DNS"
},
{
"fieldMappings": [
{
"columnName": "FirstPid",
"identifier": "ProcessId"
},
{
"columnName": "CommandLine",
"identifier": "CommandLine"
}
],
"entityType": "Process"
},
{
"fieldMappings": [
{
"columnName": "DirectoryName",
"identifier": "Directory"
},
{
"columnName": "Filename",
"identifier": "Name"
}
],
"entityType": "File"
}
],
"tags": [
"Solorigate",
"NOBELIUM"
],
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Legacy IOC based Threat Protection/Analytic Rules/Solorigate-VM-Network.yaml",
"templateVersion": "1.0.1",
"status": "Available"
}
}
]
}