Samsung Knox - Mobile Device Boot Compromise Events

Back


Id	fae7e371-aee8-4d3f-8311-2255a45a30b3
Rulename	Samsung Knox - Mobile Device Boot Compromise Events
Description	When a Knox device boot binary is at risk of compromise.
Severity	High
Tactics	Persistence
Techniques	T1645
Required data connectors	SamsungDCDefinition
Kind	NRT
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxMobileDeviceBootCompromise.yaml
Version	1.0.2
Arm template	fae7e371-aee8-4d3f-8311-2255a45a30b3.json

KQL

Samsung_Knox_System_CL 
| where Name == "BOOT_COMPROMISED_SOFTWARE_BINARY"
and MitreTtp has "T1645"

YAML

kind: NRT
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    matchingMethod: AllEntities
    reopenClosedIncident: false
    lookbackDuration: PT5H
    enabled: false
id: fae7e371-aee8-4d3f-8311-2255a45a30b3
requiredDataConnectors:
- connectorId: SamsungDCDefinition
  dataTypes:
  - Samsung_Knox_System_CL
severity: High
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxMobileDeviceBootCompromise.yaml
query: |
  Samsung_Knox_System_CL 
  | where Name == "BOOT_COMPROMISED_SOFTWARE_BINARY"
  and MitreTtp has "T1645"  
relevantTechniques:
- T1645
description: When a Knox device boot binary is at risk of compromise.
eventGroupingSettings:
  aggregationKind: SingleAlert
version: 1.0.2
suppressionDuration: PT5H
tactics:
- Persistence
status: Available
name: Samsung Knox - Mobile Device Boot Compromise Events
suppressionEnabled: false

ARM