Excessive Blocked Traffic Events Generated by User

Back


Id	fa0ab69c-7124-4f62-acdd-61017cf6ce89
Rulename	Excessive Blocked Traffic Events Generated by User
Description	Creates an incident when a Symantec Endpoint Proection agent detects excessive amounts of blocked traffic generated by a single user.
Severity	Medium
Tactics	Exfiltration CommandAndControl LateralMovement
Techniques	T1041 T1132 T1001 T1021
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Symantec Endpoint Protection/Analytic Rules/ExcessiveBlockedTrafficGeneratedbyUser.yaml
Version	1.0.3
Arm template	fa0ab69c-7124-4f62-acdd-61017cf6ce89.json

KQL

let threshold = 15;
let NoteableEvents = SymantecEndpointProtection
| where LogType == "Agent Traffic Logs"
| where Action =~ "Blocked"
| summarize TotalBlockedEvents = count() by UserName
| where TotalBlockedEvents > threshold;
SymantecEndpointProtection
| where LogType =~ "Agent Traffic Logs"
| where Action =~ "Blocked"
| join kind=inner (NoteableEvents) on UserName
| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Total = count() by UserName, RuleName, ServerName, LocalHostIpAddr, LocalPortNumber, TrafficDirection, RemoteHostIpAddr, RemotePortNumber, ApplicationName

YAML

name: Excessive Blocked Traffic Events Generated by User
relevantTechniques:
- T1041
- T1132
- T1001
- T1021
id: fa0ab69c-7124-4f62-acdd-61017cf6ce89
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Symantec Endpoint Protection/Analytic Rules/ExcessiveBlockedTrafficGeneratedbyUser.yaml
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
version: 1.0.3
severity: Medium
triggerThreshold: 0
queryPeriod: 1h
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: UserName
  entityType: Account
- fieldMappings:
  - identifier: Address
    columnName: LocalHostIpAddr
  entityType: IP
- fieldMappings:
  - identifier: Address
    columnName: RemoteHostIpAddr
  entityType: IP
- fieldMappings:
  - identifier: FullName
    columnName: ServerName
  entityType: Host
queryFrequency: 1h
status: Available
query: |
  let threshold = 15;
  let NoteableEvents = SymantecEndpointProtection
  | where LogType == "Agent Traffic Logs"
  | where Action =~ "Blocked"
  | summarize TotalBlockedEvents = count() by UserName
  | where TotalBlockedEvents > threshold;
  SymantecEndpointProtection
  | where LogType =~ "Agent Traffic Logs"
  | where Action =~ "Blocked"
  | join kind=inner (NoteableEvents) on UserName
  | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Total = count() by UserName, RuleName, ServerName, LocalHostIpAddr, LocalPortNumber, TrafficDirection, RemoteHostIpAddr, RemotePortNumber, ApplicationName  
tactics:
- Exfiltration
- CommandAndControl
- LateralMovement
kind: Scheduled
description: |
    'Creates an incident when a Symantec Endpoint Proection agent detects excessive amounts of blocked traffic generated by a single user.'
triggerOperator: gt

ARM