Cisco SE - Dropper activity on host

Back


Id	b6df3e11-de70-4779-ac9a-276c454a9025
Rulename	Cisco SE - Dropper activity on host
Description	Detects possible dropper activity on host.
Severity	High
Tactics	Execution
Techniques	T1204.002
Required data connectors	CiscoSecureEndpoint
Kind	Scheduled
Query frequency	15m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco Secure Endpoint/Analytic Rules/CiscoSEDropperActivity.yaml
Version	1.0.0
Arm template	b6df3e11-de70-4779-ac9a-276c454a9025.json

KQL

CiscoSecureEndpoint
| where EventMessage has 'Potential Dropper Infection'
| extend HostCustomEntity = DstHostname, MalwareCustomEntity = ThreatName

YAML

version: 1.0.0
description: |
    'Detects possible dropper activity on host.'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco Secure Endpoint/Analytic Rules/CiscoSEDropperActivity.yaml
relevantTechniques:
- T1204.002
id: b6df3e11-de70-4779-ac9a-276c454a9025
triggerThreshold: 0
queryFrequency: 15m
queryPeriod: 15m
entityMappings:
- fieldMappings:
  - columnName: HostCustomEntity
    identifier: HostName
  entityType: Host
- fieldMappings:
  - columnName: MalwareCustomEntity
    identifier: Name
  entityType: Malware
triggerOperator: gt
severity: High
requiredDataConnectors:
- dataTypes:
  - CiscoSecureEndpoint
  connectorId: CiscoSecureEndpoint
query: |
  CiscoSecureEndpoint
  | where EventMessage has 'Potential Dropper Infection'
  | extend HostCustomEntity = DstHostname, MalwareCustomEntity = ThreatName  
tactics:
- Execution
status: Available
name: Cisco SE - Dropper activity on host
kind: Scheduled

ARM