Excessive Blocked Traffic Events Generated by User

Back


Id	fa0ab69c-7124-4f62-acdd-61017cf6ce89
Rulename	Excessive Blocked Traffic Events Generated by User
Description	Creates an incident when a Symantec Endpoint Proection agent detects excessive amounts of blocked traffic generated by a single user.
Severity	Medium
Tactics	Exfiltration CommandAndControl LateralMovement
Techniques	T1041 T1132 T1001 T1021
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Symantec Endpoint Protection/Analytic Rules/ExcessiveBlockedTrafficGeneratedbyUser.yaml
Version	1.0.3
Arm template	fa0ab69c-7124-4f62-acdd-61017cf6ce89.json

KQL

let threshold = 15;
let NoteableEvents = SymantecEndpointProtection
| where LogType == "Agent Traffic Logs"
| where Action =~ "Blocked"
| summarize TotalBlockedEvents = count() by UserName
| where TotalBlockedEvents > threshold;
SymantecEndpointProtection
| where LogType =~ "Agent Traffic Logs"
| where Action =~ "Blocked"
| join kind=inner (NoteableEvents) on UserName
| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Total = count() by UserName, RuleName, ServerName, LocalHostIpAddr, LocalPortNumber, TrafficDirection, RemoteHostIpAddr, RemotePortNumber, ApplicationName

YAML

description: |
    'Creates an incident when a Symantec Endpoint Proection agent detects excessive amounts of blocked traffic generated by a single user.'
kind: Scheduled
tactics:
- Exfiltration
- CommandAndControl
- LateralMovement
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Symantec Endpoint Protection/Analytic Rules/ExcessiveBlockedTrafficGeneratedbyUser.yaml
severity: Medium
name: Excessive Blocked Traffic Events Generated by User
triggerThreshold: 0
queryPeriod: 1h
query: |
  let threshold = 15;
  let NoteableEvents = SymantecEndpointProtection
  | where LogType == "Agent Traffic Logs"
  | where Action =~ "Blocked"
  | summarize TotalBlockedEvents = count() by UserName
  | where TotalBlockedEvents > threshold;
  SymantecEndpointProtection
  | where LogType =~ "Agent Traffic Logs"
  | where Action =~ "Blocked"
  | join kind=inner (NoteableEvents) on UserName
  | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Total = count() by UserName, RuleName, ServerName, LocalHostIpAddr, LocalPortNumber, TrafficDirection, RemoteHostIpAddr, RemotePortNumber, ApplicationName  
relevantTechniques:
- T1041
- T1132
- T1001
- T1021
id: fa0ab69c-7124-4f62-acdd-61017cf6ce89
queryFrequency: 1h
status: Available
triggerOperator: gt
version: 1.0.3
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: UserName
    identifier: FullName
- entityType: IP
  fieldMappings:
  - columnName: LocalHostIpAddr
    identifier: Address
- entityType: IP
  fieldMappings:
  - columnName: RemoteHostIpAddr
    identifier: Address
- entityType: Host
  fieldMappings:
  - columnName: ServerName
    identifier: FullName

ARM