VTI - High Severity SHA1 Collision Detection

Back


Id	dbd9e28f-973d-47f3-a8c3-9e18da846870
Rulename	VTI - High Severity SHA1 Collision Detection
Description	This will alert when a collision is detected for DeviceFileEvents events with VTI high severity SHA1 IoCs
Severity	High
Tactics	Execution
Techniques	T1204
Required data connectors	VisaThreatIntelligence
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Visa Threat Intelligence (VTI)/Analytic Rules/VTIP_high_severity_sha1.yaml
Version	1.0.0
Arm template	dbd9e28f-973d-47f3-a8c3-9e18da846870.json

KQL

DeviceFileEvents
| join kind=inner (VisaThreatIntelligenceIOC_CL  | where IOCType == "sha1" and SourceSeverity == "High")
on $left.InitiatingProcessSHA1 == $right.Value

YAML

entityMappings:
- fieldMappings:
  - columnName: DeviceName
    identifier: HostName
  entityType: Host
- fieldMappings:
  - columnName: SHA1
    identifier: Algorithm
  - columnName: InitiatingProcessSHA1
    identifier: Value
  entityType: FileHash
triggerOperator: gt
tactics:
- Execution
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    reopenClosedIncident: false
    matchingMethod: AllEntities
    lookbackDuration: 1h
    enabled: true
suppressionDuration: 1h
eventGroupingSettings:
  aggregationKind: SingleAlert
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Visa Threat Intelligence (VTI)/Analytic Rules/VTIP_high_severity_sha1.yaml
severity: High
triggerThreshold: 0
relevantTechniques:
- T1204
queryPeriod: 1h
query: |-
  DeviceFileEvents
  | join kind=inner (VisaThreatIntelligenceIOC_CL  | where IOCType == "sha1" and SourceSeverity == "High")
  on $left.InitiatingProcessSHA1 == $right.Value  
version: 1.0.0
kind: Scheduled
name: VTI - High Severity SHA1 Collision Detection
queryFrequency: 1h
id: dbd9e28f-973d-47f3-a8c3-9e18da846870
description: This will alert when a collision is detected for DeviceFileEvents events with VTI high severity SHA1 IoCs
suppressionEnabled: false
requiredDataConnectors:
- dataTypes:
  - VisaThreatIntelligenceIOC_CL
  - DeviceFileEvents
  connectorId: VisaThreatIntelligence

ARM