PaloAlto - Possible attack without response

Back


Id	b6d54840-51d3-11ec-bf63-0242ac130002
Rulename	PaloAlto - Possible attack without response
Description	Detects possible attack without response.
Severity	High
Tactics	InitialAccess
Techniques	T1190 T1133
Required data connectors	CefAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPossibleAttackWithoutResponse.yaml
Version	1.0.4
Arm template	b6d54840-51d3-11ec-bf63-0242ac130002.json

KQL

PaloAltoCDLEvent
| where EventResourceId =~ 'THREAT'
| where DvcAction !has "block" or DvcAction !has "override" or DvcAction !has "deny"
| extend AccountCustomEntity = DstUsername, IPCustomEntity = SrcIpAddr, UrlCustomEntity = Url

YAML

description: |
    'Detects possible attack without response.'
version: 1.0.4
triggerThreshold: 0
tactics:
- InitialAccess
queryPeriod: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPossibleAttackWithoutResponse.yaml
triggerOperator: gt
status: Available
id: b6d54840-51d3-11ec-bf63-0242ac130002
name: PaloAlto - Possible attack without response
queryFrequency: 1h
severity: High
kind: Scheduled
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: Name
  entityType: Account
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: UrlCustomEntity
    identifier: Url
  entityType: URL
relevantTechniques:
- T1190
- T1133
query: |
  PaloAltoCDLEvent
  | where EventResourceId =~ 'THREAT'
  | where DvcAction !has "block" or DvcAction !has "override" or DvcAction !has "deny"
  | extend AccountCustomEntity = DstUsername, IPCustomEntity = SrcIpAddr, UrlCustomEntity = Url  
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma

ARM