Cisco SE - Multiple malware on host | Microsoft Sentinel Analytic Rules

Back


Id	b13489d7-feb1-4ad3-9a4c-09f6d64448fd
Rulename	Cisco SE - Multiple malware on host
Description	This rule triggers when multiple malware where detected on host.
Severity	High
Tactics	InitialAccess
Techniques	T1190 T1133
Required data connectors	CiscoSecureEndpoint
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco%20Secure%20Endpoint/Analytic%20Rules/CiscoSEMultipleMalwareOnHost.yaml
Version	1.0.0
Arm template	b13489d7-feb1-4ad3-9a4c-09f6d64448fd.json

KQL

let threshold = 2;
CiscoSecureEndpoint
| where isnotempty(ThreatName)
| summarize infected = makeset(ThreatName) by DstHostname, bin(TimeGenerated, 10m)
| where array_length(infected) >= threshold
| extend HostCustomEntity = DstHostname

YAML

entityMappings:
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: HostCustomEntity
name: Cisco SE - Multiple malware on host
kind: Scheduled
triggerOperator: gt
status: Available
queryPeriod: 1h
requiredDataConnectors:
- connectorId: CiscoSecureEndpoint
  dataTypes:
  - CiscoSecureEndpoint
tactics:
- InitialAccess
query: |
  let threshold = 2;
  CiscoSecureEndpoint
  | where isnotempty(ThreatName)
  | summarize infected = makeset(ThreatName) by DstHostname, bin(TimeGenerated, 10m)
  | where array_length(infected) >= threshold
  | extend HostCustomEntity = DstHostname
description: |
  'This rule triggers when multiple malware where detected on host.'
severity: High
id: b13489d7-feb1-4ad3-9a4c-09f6d64448fd
triggerThreshold: 0
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco%20Secure%20Endpoint/Analytic%20Rules/CiscoSEMultipleMalwareOnHost.yaml
version: 1.0.0
relevantTechniques:
- T1190
- T1133

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/b13489d7-feb1-4ad3-9a4c-09f6d64448fd')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/b13489d7-feb1-4ad3-9a4c-09f6d64448fd')]",
      "properties": {
        "alertRuleTemplateName": "b13489d7-feb1-4ad3-9a4c-09f6d64448fd",
        "customDetails": null,
        "description": "'This rule triggers when multiple malware where detected on host.'\n",
        "displayName": "Cisco SE - Multiple malware on host",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "HostCustomEntity",
                "identifier": "HostName"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco%20Secure%20Endpoint/Analytic%20Rules/CiscoSEMultipleMalwareOnHost.yaml",
        "query": "let threshold = 2;\nCiscoSecureEndpoint\n| where isnotempty(ThreatName)\n| summarize infected = makeset(ThreatName) by DstHostname, bin(TimeGenerated, 10m)\n| where array_length(infected) >= threshold\n| extend HostCustomEntity = DstHostname\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1133",
          "T1190"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}