iboss - Malware Detected | Microsoft Sentinel Analytic Rules

Back


Id	cad35734-b97a-4209-9269-b98c916379eb
Rulename	iboss - Malware Detected
Description	Identifies web traffic where the iboss platform flagged malware. A populated MalwareDetected flag indicates the gateway detected a malicious file or payload associated with the request. Surfaces the destination, user, and other details to support triage.
Severity	High
Tactics	Execution
Techniques	T1204
Required data connectors	ibossAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/iboss/Analytic%20Rules/ibossMalwareDetected.yaml
Version	1.0.0
Arm template	cad35734-b97a-4209-9269-b98c916379eb.json

KQL

ibossUrlEvent
| where MalwareDetected == 1
| extend FileHashAlgorithm = "SHA256"
| project EventTime, SrcUsername, Url, Domain, SrcIpAddr, DstIpAddr, FileSHA256, FileHashAlgorithm,DvcAction, UrlCategory, HttpUserAgent

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: SrcUsername
    identifier: FullName
- entityType: IP
  fieldMappings:
  - columnName: SrcIpAddr
    identifier: Address
- entityType: URL
  fieldMappings:
  - columnName: Url
    identifier: Url
- entityType: FileHash
  fieldMappings:
  - columnName: FileHashAlgorithm
    identifier: Algorithm
  - columnName: FileSHA256
    identifier: Value
query: |
  ibossUrlEvent
  | where MalwareDetected == 1
  | extend FileHashAlgorithm = "SHA256"
  | project EventTime, SrcUsername, Url, Domain, SrcIpAddr, DstIpAddr, FileSHA256, FileHashAlgorithm,DvcAction, UrlCategory, HttpUserAgent
id: cad35734-b97a-4209-9269-b98c916379eb
queryFrequency: 1h
status: Available
version: 1.0.0
severity: High
relevantTechniques:
- T1204
name: iboss - Malware Detected
kind: Scheduled
tactics:
- Execution
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: ibossAma
description: |
  Identifies web traffic where the iboss platform flagged malware. A populated MalwareDetected flag indicates the gateway detected a malicious file or payload associated with the request. Surfaces the destination, user, and other details to support triage.
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/iboss/Analytic%20Rules/ibossMalwareDetected.yaml
triggerOperator: gt
triggerThreshold: 0
queryPeriod: 1h

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/cad35734-b97a-4209-9269-b98c916379eb')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/cad35734-b97a-4209-9269-b98c916379eb')]",
      "properties": {
        "alertRuleTemplateName": "cad35734-b97a-4209-9269-b98c916379eb",
        "customDetails": null,
        "description": "Identifies web traffic where the iboss platform flagged malware. A populated MalwareDetected flag indicates the gateway detected a malicious file or payload associated with the request. Surfaces the destination, user, and other details to support triage.\n",
        "displayName": "iboss - Malware Detected",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "SrcUsername",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SrcIpAddr",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "Url",
                "identifier": "Url"
              }
            ]
          },
          {
            "entityType": "FileHash",
            "fieldMappings": [
              {
                "columnName": "FileHashAlgorithm",
                "identifier": "Algorithm"
              },
              {
                "columnName": "FileSHA256",
                "identifier": "Value"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/iboss/Analytic%20Rules/ibossMalwareDetected.yaml",
        "query": "ibossUrlEvent\n| where MalwareDetected == 1\n| extend FileHashAlgorithm = \"SHA256\"\n| project EventTime, SrcUsername, Url, Domain, SrcIpAddr, DstIpAddr, FileSHA256, FileHashAlgorithm,DvcAction, UrlCategory, HttpUserAgent\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Execution"
        ],
        "techniques": [
          "T1204"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}