Ransom Protect User Blocked

Back


Id	d5d4766b-e547-44da-9d85-48ff393db201
Rulename	Ransom Protect User Blocked
Description	Detects malicious users blocked by CTERA Ransom Protect AI engine.
Severity	High
Tactics	Impact
Techniques	T1486
Required data connectors	CTERA
Kind	NRT
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTERA/Analytic Rules/RansomwareUserBlocked.yaml
Version	1.0.2
Arm template	d5d4766b-e547-44da-9d85-48ff393db201.json

KQL

Syslog
| where SyslogMessage contains "Ransom Protect mechanism blocked"
| extend 
    Portal = extract("portal:(\\w+)", 1, SyslogMessage),
    EdgeFiler = extract("Edge Filer:(\\w+-\\d+)", 1, SyslogMessage),
    IP = extract("IP:([0-9.]+)", 1, SyslogMessage),
    User = extract("user:(\\w+)", 1, SyslogMessage),
    BlockedTime = extract("at ([^ ]+)", 1, SyslogMessage)
| project TimeGenerated, Portal, EdgeFiler, IP, User, BlockedTime

YAML

name: Ransom Protect User Blocked
incidentConfiguration:
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
  createIncident: true
query: |
  Syslog
  | where SyslogMessage contains "Ransom Protect mechanism blocked"
  | extend 
      Portal = extract("portal:(\\w+)", 1, SyslogMessage),
      EdgeFiler = extract("Edge Filer:(\\w+-\\d+)", 1, SyslogMessage),
      IP = extract("IP:([0-9.]+)", 1, SyslogMessage),
      User = extract("user:(\\w+)", 1, SyslogMessage),
      BlockedTime = extract("at ([^ ]+)", 1, SyslogMessage)
  | project TimeGenerated, Portal, EdgeFiler, IP, User, BlockedTime  
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: User
    identifier: FullName
- entityType: IP
  fieldMappings:
  - columnName: IP
    identifier: Address
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTERA/Analytic Rules/RansomwareUserBlocked.yaml
suppressionEnabled: false
tactics:
- Impact
suppressionDuration: PT5H
kind: NRT
eventGroupingSettings:
  aggregationKind: SingleAlert
version: 1.0.2
alertDetailsOverride:
  alertDescriptionFormat: CTERA Ransom Protect blocked a malicious user at {{TimeGenerated}}.
  alertnameFormat: CTERA Ransom Protect User Blocked
relevantTechniques:
- T1486
id: d5d4766b-e547-44da-9d85-48ff393db201
customDetails:
  EdgeFiler: EdgeFiler
severity: High
requiredDataConnectors:
- connectorId: CTERA
  dataTypes:
  - Syslog
status: Available
description: Detects malicious users blocked by CTERA Ransom Protect AI engine.

ARM