PaloAlto - Possible attack without response

Back


Id	b6d54840-51d3-11ec-bf63-0242ac130002
Rulename	PaloAlto - Possible attack without response
Description	Detects possible attack without response.
Severity	High
Tactics	InitialAccess
Techniques	T1190 T1133
Required data connectors	CefAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPossibleAttackWithoutResponse.yaml
Version	1.0.4
Arm template	b6d54840-51d3-11ec-bf63-0242ac130002.json

KQL

PaloAltoCDLEvent
| where EventResourceId =~ 'THREAT'
| where DvcAction !has "block" or DvcAction !has "override" or DvcAction !has "deny"
| extend AccountCustomEntity = DstUsername, IPCustomEntity = SrcIpAddr, UrlCustomEntity = Url

YAML

name: PaloAlto - Possible attack without response
query: |
  PaloAltoCDLEvent
  | where EventResourceId =~ 'THREAT'
  | where DvcAction !has "block" or DvcAction !has "override" or DvcAction !has "deny"
  | extend AccountCustomEntity = DstUsername, IPCustomEntity = SrcIpAddr, UrlCustomEntity = Url  
queryFrequency: 1h
triggerOperator: gt
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma
status: Available
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: UrlCustomEntity
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPossibleAttackWithoutResponse.yaml
description: |
    'Detects possible attack without response.'
version: 1.0.4
id: b6d54840-51d3-11ec-bf63-0242ac130002
kind: Scheduled
relevantTechniques:
- T1190
- T1133
severity: High
tactics:
- InitialAccess
queryPeriod: 1h

ARM