McAfee ePO - Multiple threats on same host | Microsoft Sentinel Analytic Rules

Back


Id	f53e5168-afdb-4fad-b29a-bb9cb71ec460
Rulename	McAfee ePO - Multiple threats on same host
Description	Rule fires when multiple threat events were detected on the same host.
Severity	Medium
Tactics	InitialAccess Persistence DefenseEvasion PrivilegeEscalation
Techniques	T1562 T1070 T1189 T1195 T1543 T1055
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee%20ePolicy%20Orchestrator/Analytic%20Rules/McAfeeEPOMultipleThreatsSameHost.yaml
Version	1.0.2
Arm template	f53e5168-afdb-4fad-b29a-bb9cb71ec460.json

KQL

McAfeeEPOEvent
| where isnotempty(ThreatName)
| where ThreatName != '_'
| summarize th_cnt = dcount(ThreatName), th_list = makeset(ThreatName) by DvcIpAddr
| where th_cnt > 1
| extend IPCustomEntity = DvcIpAddr

YAML

requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
triggerThreshold: 0
status: Available
description: |
  'Rule fires when multiple threat events were detected on the same host.'
tactics:
- InitialAccess
- Persistence
- DefenseEvasion
- PrivilegeEscalation
queryFrequency: 1h
kind: Scheduled
query: |
  McAfeeEPOEvent
  | where isnotempty(ThreatName)
  | where ThreatName != '_'
  | summarize th_cnt = dcount(ThreatName), th_list = makeset(ThreatName) by DvcIpAddr
  | where th_cnt > 1
  | extend IPCustomEntity = DvcIpAddr
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee%20ePolicy%20Orchestrator/Analytic%20Rules/McAfeeEPOMultipleThreatsSameHost.yaml
id: f53e5168-afdb-4fad-b29a-bb9cb71ec460
queryPeriod: 1h
entityMappings:
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
severity: Medium
triggerOperator: gt
relevantTechniques:
- T1562
- T1070
- T1189
- T1195
- T1543
- T1055
name: McAfee ePO - Multiple threats on same host
version: 1.0.2

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/f53e5168-afdb-4fad-b29a-bb9cb71ec460')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/f53e5168-afdb-4fad-b29a-bb9cb71ec460')]",
      "properties": {
        "alertRuleTemplateName": "f53e5168-afdb-4fad-b29a-bb9cb71ec460",
        "customDetails": null,
        "description": "'Rule fires when multiple threat events were detected on the same host.'\n",
        "displayName": "McAfee ePO - Multiple threats on same host",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee%20ePolicy%20Orchestrator/Analytic%20Rules/McAfeeEPOMultipleThreatsSameHost.yaml",
        "query": "McAfeeEPOEvent\n| where isnotempty(ThreatName)\n| where ThreatName != '_'\n| summarize th_cnt = dcount(ThreatName), th_list = makeset(ThreatName) by DvcIpAddr\n| where th_cnt > 1\n| extend IPCustomEntity = DvcIpAddr\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion",
          "InitialAccess",
          "Persistence",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1055",
          "T1070",
          "T1189",
          "T1195",
          "T1543",
          "T1562"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}