AV detections related to Ukraine threats

Back


Id	b6685757-3ed1-4b05-a5bd-2cacadc86c2a
Rulename	AV detections related to Ukraine threats
Description	This query looks for Microsoft Defender AV detections for malware observed in relation to the war in Ukraine. Ref: https://msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity-ukraine/
Severity	High
Tactics	Impact
Techniques	T1485
Required data connectors	MicrosoftThreatProtection
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft 365 Defender/Analytic Rules/AVdetectionsrelatedtoUkrainebasedthreats.yaml
Version	1.1.1
Arm template	b6685757-3ed1-4b05-a5bd-2cacadc86c2a.json

KQL

let UA_threats = dynamic(["FoxBlade", "WhisperGate", "Lasainraw", "SonicVote"]);
  SecurityAlert
  | where ProviderName == "MDATP"
  | extend ThreatFamilyName = tostring(parse_json(ExtendedProperties).ThreatFamilyName)
  | where ThreatFamilyName in (UA_threats)

YAML

triggerOperator: gt
id: b6685757-3ed1-4b05-a5bd-2cacadc86c2a
queryFrequency: 1d
entityMappings:
- entityType: Host
  fieldMappings:
  - columnName: CompromisedEntity
    identifier: FullName
requiredDataConnectors:
- dataTypes:
  - SecurityAlert
  connectorId: MicrosoftThreatProtection
severity: High
triggerThreshold: 0
kind: Scheduled
status: Available
queryPeriod: 1d
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft 365 Defender/Analytic Rules/AVdetectionsrelatedtoUkrainebasedthreats.yaml
query: |
  let UA_threats = dynamic(["FoxBlade", "WhisperGate", "Lasainraw", "SonicVote"]);
    SecurityAlert
    | where ProviderName == "MDATP"
    | extend ThreatFamilyName = tostring(parse_json(ExtendedProperties).ThreatFamilyName)
    | where ThreatFamilyName in (UA_threats)  
description: |
  'This query looks for Microsoft Defender AV detections for malware observed in relation to the war in Ukraine.
    Ref: https://msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity-ukraine/ '  
name: AV detections related to Ukraine threats
relevantTechniques:
- T1485
tactics:
- Impact
version: 1.1.1

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/b6685757-3ed1-4b05-a5bd-2cacadc86c2a')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/b6685757-3ed1-4b05-a5bd-2cacadc86c2a')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01",
      "properties": {
        "displayName": "AV detections related to Ukraine threats",
        "description": "'This query looks for Microsoft Defender AV detections for malware observed in relation to the war in Ukraine.\n  Ref: https://msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity-ukraine/ '\n",
        "severity": "High",
        "enabled": true,
        "query": "let UA_threats = dynamic([\"FoxBlade\", \"WhisperGate\", \"Lasainraw\", \"SonicVote\"]);\n  SecurityAlert\n  | where ProviderName == \"MDATP\"\n  | extend ThreatFamilyName = tostring(parse_json(ExtendedProperties).ThreatFamilyName)\n  | where ThreatFamilyName in (UA_threats)\n",
        "queryFrequency": "P1D",
        "queryPeriod": "P1D",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1485"
        ],
        "alertRuleTemplateName": "b6685757-3ed1-4b05-a5bd-2cacadc86c2a",
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "identifier": "FullName",
                "columnName": "CompromisedEntity"
              }
            ],
            "entityType": "Host"
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft 365 Defender/Analytic Rules/AVdetectionsrelatedtoUkrainebasedthreats.yaml",
        "templateVersion": "1.1.1",
        "status": "Available"
      }
    }
  ]
}