Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Radiflow - Suspicious Malicious Activity Detected

Back
Idecac26b8-147d-478a-9d50-99be4bf14019
RulenameRadiflow - Suspicious Malicious Activity Detected
DescriptionGenerates an incident when malware is detected by Radiflow’s iSID.
SeverityHigh
TacticsDefenseEvasion
InhibitResponseFunction
TechniquesT0851
Required data connectorsRadiflowIsid
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Radiflow/Analytic Rules/RadiflowSuspiciousMaliciousActivityDetected.yaml
Version1.0.0
Arm templateecac26b8-147d-478a-9d50-99be4bf14019.json
Deploy To Azure
RadiflowEvent
| where DeviceProduct =~ 'iSID'
| where EventClassID in (57, 58, 59, 60, 176, 178, 181)
description: |
    'Generates an incident when malware is detected by Radiflow's iSID.'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Radiflow/Analytic Rules/RadiflowSuspiciousMaliciousActivityDetected.yaml
severity: High
status: Available
customDetails:
  DestinationType: DestinationType
  DestinationIP: DestinationIP
  SourceIP: SourceIP
  SourceHostName: SourceHostName
  Port: Port
  SourceType: SourceType
  DestinationMAC: DestinationMACAddress
  DestinationVendor: DestinationVendor
  DestinationHostName: DestinationHostName
  SourceVLAN: SourceVLAN
  SourceMAC: SourceMACAddress
  SourceVendor: SourceVendor
  Protocol: Protocol
kind: Scheduled
relevantTechniques:
- T0851
tactics:
- DefenseEvasion
- InhibitResponseFunction
eventGroupingSettings:
  aggregationKind: AlertPerResult
queryFrequency: 1h
entityMappings:
- fieldMappings:
  - columnName: SourceHostName
    identifier: HostName
  - columnName: SourceHostName
    identifier: NetBiosName
  entityType: Host
- fieldMappings:
  - columnName: DestinationHostName
    identifier: HostName
  - columnName: DestinationHostName
    identifier: NetBiosName
  entityType: Host
- fieldMappings:
  - columnName: SourceIP
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: DestinationIP
    identifier: Address
  entityType: IP
triggerThreshold: 0
queryPeriod: 1h
triggerOperator: gt
version: 1.0.0
id: ecac26b8-147d-478a-9d50-99be4bf14019
suppressionEnabled: false
suppressionDuration: 5h
alertDetailsOverride:
  alertDescriptionFormat: |-
    A possible malware has been detected in the network as specified in the details of the incident. Please verify the source of this activity.

    Message: {{EventMessage}}
    Source device: {{{SourceIP}} 
    Destination device (if any): {{DestinationIP}}    
  alertDisplayNameFormat: 'Suspicious Malicious Activity Detected: {{EventMessage}}'
  alertDynamicProperties: []
  alertSeverityColumnName: EventSeverity
name: Radiflow - Suspicious Malicious Activity Detected
query: |
  RadiflowEvent
  | where DeviceProduct =~ 'iSID'
  | where EventClassID in (57, 58, 59, 60, 176, 178, 181)  
requiredDataConnectors:
- dataTypes:
  - RadiflowEvent
  connectorId: RadiflowIsid
incidentConfiguration:
  groupingConfiguration:
    groupByAlertDetails: []
    enabled: true
    groupByEntities: []
    reopenClosedIncident: false
    groupByCustomDetails: []
    lookbackDuration: 1h
    matchingMethod: AllEntities
  createIncident: true
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/ecac26b8-147d-478a-9d50-99be4bf14019')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/ecac26b8-147d-478a-9d50-99be4bf14019')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "A possible malware has been detected in the network as specified in the details of the incident. Please verify the source of this activity.\n\nMessage: {{EventMessage}}\nSource device: {{{SourceIP}} \nDestination device (if any): {{DestinationIP}}",
          "alertDisplayNameFormat": "Suspicious Malicious Activity Detected: {{EventMessage}}",
          "alertDynamicProperties": [],
          "alertSeverityColumnName": "EventSeverity"
        },
        "alertRuleTemplateName": "ecac26b8-147d-478a-9d50-99be4bf14019",
        "customDetails": {
          "DestinationHostName": "DestinationHostName",
          "DestinationIP": "DestinationIP",
          "DestinationMAC": "DestinationMACAddress",
          "DestinationType": "DestinationType",
          "DestinationVendor": "DestinationVendor",
          "Port": "Port",
          "Protocol": "Protocol",
          "SourceHostName": "SourceHostName",
          "SourceIP": "SourceIP",
          "SourceMAC": "SourceMACAddress",
          "SourceType": "SourceType",
          "SourceVendor": "SourceVendor",
          "SourceVLAN": "SourceVLAN"
        },
        "description": "'Generates an incident when malware is detected by Radiflow's iSID.'\n",
        "displayName": "Radiflow - Suspicious Malicious Activity Detected",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "SourceHostName",
                "identifier": "HostName"
              },
              {
                "columnName": "SourceHostName",
                "identifier": "NetBiosName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "DestinationHostName",
                "identifier": "HostName"
              },
              {
                "columnName": "DestinationHostName",
                "identifier": "NetBiosName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SourceIP",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "DestinationIP",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByAlertDetails": [],
            "groupByCustomDetails": [],
            "groupByEntities": [],
            "lookbackDuration": "PT1H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Radiflow/Analytic Rules/RadiflowSuspiciousMaliciousActivityDetected.yaml",
        "query": "RadiflowEvent\n| where DeviceProduct =~ 'iSID'\n| where EventClassID in (57, 58, 59, 60, 176, 178, 181)\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion",
          "InhibitResponseFunction"
        ],
        "techniques": null,
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}