CiscoISE - Command executed with the highest privileges by new user

Back


Id	e71890a2-5f61-4790-b1ed-cf1d92d3e398
Rulename	CiscoISE - Command executed with the highest privileges by new user
Description	Detects command execution with PrivilegeLevel - 15 by user for wich there was no such activity detected earlier.
Severity	Medium
Tactics	InitialAccess Persistence PrivilegeEscalation DefenseEvasion Execution
Techniques	T1133 T1548 T1059
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco ISE/Analytic Rules/CiscoISECmdExecutionWithHighestPrivilegesNewUser.yaml
Version	1.0.4
Arm template	e71890a2-5f61-4790-b1ed-cf1d92d3e398.json

KQL

let lbperiod = 14d;
let lbtime = 15m;
let knownPrivUsers =
CiscoISEEvent
| where TimeGenerated between (ago(lbperiod) .. ago(lbtime))
| where PrivilegeLevel == '15'
| summarize makelist(DstUserName)
;
CiscoISEEvent
| where TimeGenerated > ago(lbtime)
| where PrivilegeLevel == '15'
| where DstUserName !in (knownPrivUsers)
| project TimeGenerated, SrcIpAddr, DstIpAddr, DstUserName, CmdSet
| extend AccountCustomEntity = DstUserName
| extend IPCustomEntity = SrcIpAddr

YAML

requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
query: |
  let lbperiod = 14d;
  let lbtime = 15m;
  let knownPrivUsers =
  CiscoISEEvent
  | where TimeGenerated between (ago(lbperiod) .. ago(lbtime))
  | where PrivilegeLevel == '15'
  | summarize makelist(DstUserName)
  ;
  CiscoISEEvent
  | where TimeGenerated > ago(lbtime)
  | where PrivilegeLevel == '15'
  | where DstUserName !in (knownPrivUsers)
  | project TimeGenerated, SrcIpAddr, DstIpAddr, DstUserName, CmdSet
  | extend AccountCustomEntity = DstUserName
  | extend IPCustomEntity = SrcIpAddr  
triggerOperator: gt
severity: Medium
queryPeriod: 5m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco ISE/Analytic Rules/CiscoISECmdExecutionWithHighestPrivilegesNewUser.yaml
name: CiscoISE - Command executed with the highest privileges by new user
tactics:
- InitialAccess
- Persistence
- PrivilegeEscalation
- DefenseEvasion
- Execution
relevantTechniques:
- T1133
- T1548
- T1059
kind: Scheduled
status: Available
queryFrequency: 5m
id: e71890a2-5f61-4790-b1ed-cf1d92d3e398
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
version: 1.0.4
triggerThreshold: 0
description: |
    'Detects command execution with PrivilegeLevel - 15 by user for wich there was no such activity detected earlier.'

ARM