ApexOne - Multiple deny or terminate actions on single IP

Back


Id	cd94e078-67b7-11ec-90d6-0242ac120003
Rulename	ApexOne - Multiple deny or terminate actions on single IP
Description	Detects multiple deny or terminate actions on single IP.
Severity	High
Tactics	InitialAccess
Techniques	T1190
Required data connectors	CefAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneMultipleDenyOrTerminateActionOnSingleIp.yaml
Version	1.0.3
Arm template	cd94e078-67b7-11ec-90d6-0242ac120003.json

KQL

let threshold = 5;
TMApexOneEvent
| where EventMessage has "Behavior Monitoring"
| where DvcAction == 2 or DvcAction == 3
| summarize count() by SrcIpAddr, bin(TimeGenerated, 10m)
| where count_ > threshold
| extend IPCustomEntity = SrcIpAddr

YAML

description: |
    'Detects multiple deny or terminate actions on single IP.'
version: 1.0.3
triggerThreshold: 0
tactics:
- InitialAccess
queryPeriod: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneMultipleDenyOrTerminateActionOnSingleIp.yaml
triggerOperator: gt
status: Available
id: cd94e078-67b7-11ec-90d6-0242ac120003
name: ApexOne - Multiple deny or terminate actions on single IP
queryFrequency: 1h
severity: High
kind: Scheduled
entityMappings:
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
relevantTechniques:
- T1190
query: |
  let threshold = 5;
  TMApexOneEvent
  | where EventMessage has "Behavior Monitoring"
  | where DvcAction == 2 or DvcAction == 3
  | summarize count() by SrcIpAddr, bin(TimeGenerated, 10m)
  | where count_ > threshold
  | extend IPCustomEntity = SrcIpAddr  
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma

ARM