Kusto rules: 1f

id: fa8d692d-5b00-4a6c-99b3-30b4710efa59
name: Application Group Deleted
description: Detects when an application group is deleted from Veeam Backup & Replication.
  This might indicate unauthorized removal of critical components.
severity: Informational
status: Available
requiredDataConnectors:
- connectorId: Syslog
  dataTypes:
  - Syslog
- connectorId: SyslogAma
  dataTypes:
  - Syslog
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
eventGroupingSettings:
  aggregationKind: AlertPerResult
tactics: []
relevantTechniques: []
query: "Veeam_GetSecurityEvents\n| where instanceId == 30500\n| extend Name =  extract(\"\
  Name=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n    Date = format_datetime(TimeGenerated,\
  \ 'dd.MM.yyyy HH:mm'),\n    DataSource = original_host,\n    EventId = instanceId,\n\
  \    UserName = user,\n    [\"Application Group Name\"] = Name,\n    MessageDetails\
  \ = Description,\n    Severity = SeverityDescription"
version: 1.0.1
kind: Scheduled
customDetails:
  Date: Date
  VbrHostName: DataSource
  EventId: EventId
  MessageDetails: MessageDetails
  Severity: Severity

id: 034f62b6-df51-49f3-831f-1e4cfd3c40d2
name: Cisco Duo - Multiple user login failures
description: |
  'Detects when multiple user login failures occurs.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: CiscoDuoAuthConnectorDefinition
    dataTypes:
      - DuoAuthentication_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1078
query: |
  let threshold = 10;
  DuoAuthentication_CL
  | where Result in~ ('denied', 'failure')
  | summarize count() by UserName, bin(TimeGenerated, 10m)
  | where count_ > threshold
  | extend AccountCustomEntity = UserName
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountCustomEntity
version: 1.0.2
kind: Scheduled

id: 5cf35bad-677f-4c23-8927-1611e7ff6f28
name: Claroty - Suspicious file transfer
description: 'Detects Claroty events where EventOriginalType or EventType contains Suspicious File Transfer and maps the destination
  IP as the primary entity for triage.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: CefAma
    dataTypes:
      - CommonSecurityLog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Discovery
  - Exfiltration
relevantTechniques:
  - T1018
  - T1020
query: |
  ClarotyEvent
  | where EventOriginalType has 'Suspicious File Transfer' or EventType has 'Suspicious File Transfer'
  | project TimeGenerated, DstIpAddr, EventOriginalType, EventType
  | extend IPCustomEntity = DstIpAddr
  | project TimeGenerated, DstIpAddr, EventOriginalType, EventType, IPCustomEntity
entityMappings:
- entityType: IP
  fieldMappings:
    - identifier: Address
      columnName: IPCustomEntity
alertDetailsOverride:
  alertDisplayNameFormat: Claroty suspicious file transfer to {{DstIpAddr}}
  alertDescriptionFormat: Claroty flagged suspicious file transfer activity to {{DstIpAddr}} using event type {{EventType}}
customDetails:
  EventOriginalType: EventOriginalType
  EventType: EventType
version: 1.0.4
kind: Scheduled

id: 7313352a-09f6-4a84-88bd-6f17f1cbeb88
name: Cloudflare - Unexpected POST requests
description: |
  'Detects post requests to unusual extensions.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: CloudflareDataConnector
    dataTypes:
      - Cloudflare
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Persistence
  - CommandAndControl
relevantTechniques:
  - T1505
  - T1071
query: |
  Cloudflare
  | where HttpRequestMethod in~ ('POST', 'PUT')
  | where tostring(HttpStatusCode) startswith '2'
  | where DstBytes != 0 or SrcBytes != 0
  | extend fe = extract(@'.*(\.\w+)$', 1, ClientRequestURI)
  | where fe in~ ('.jpg', '.jpeg', '.gif', '.png', '.icon', '.ico', '.xml', '.swf', '.svg', '.ppt', '.pttx', '.doc', '.docx', '.rtf', '.pdf', '.tif', '.zip', '.mov')
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SrcIpAddr
version: 1.0.1
kind: Scheduled

id: 89a86f70-615f-4a79-9621-6f68c50f365f
name: CloudNGFW By Palo Alto Networks - Threat signatures from Unusual IP addresses 
description: |
  'Identifies Palo Alto Threat signatures from unusual IP addresses which are not historically seen. 
  This detection is also leveraged and required for MDE and PAN Fusion scenario
  https://docs.microsoft.com/Azure/sentinel/fusion-scenario-reference#network-request-to-tor-anonymization-service-followed-by-anomalous-traffic-flagged-by-palo-alto-networks-firewall'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: AzureCloudNGFWByPaloAltoNetworks
    dataTypes:
      - fluentbit_CL
queryFrequency: 1h
queryPeriod: 7d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Discovery
  - Exfiltration
  - CommandAndControl
relevantTechniques:
  - T1046
  - T1030
  - T1071.001
tags:
  - Fusion
query: |
  let starttime = 7d;
  let endtime = 1d;
  let timeframe = 1h;
  let HistThreshold = 25; 
  let CurrThreshold = 10; 
  let HistoricalThreats = fluentbit_CL
  | where ident_s == "THREAT"
  | extend message = parse_json(Message)
  | where isnotempty(message.src_ip)
  | where TimeGenerated between (startofday(ago(starttime))..startofday(ago(endtime)))
  | where message.sub_type in ('spyware', 'scan', 'file', 'vulnerability', 'flood', 'packet', 'virus','wildfire', 'wildfire-virus')
  | extend src_ip = tostring(message.src_ip)
  | summarize TotalEvents = count(), ThreatTypes = make_set(message.sub_type), DestinationIpList = make_set(message.dst), FirstSeen = min(TimeGenerated) , LastSeen = max(TimeGenerated) by src_ip, tostring(message.action), FirewallName_s;
  let CurrentHourThreats = fluentbit_CL
  | where ident_s == "THREAT"
  | extend message = parse_json(Message)
  | where isnotempty(message.src_ip)
  | where TimeGenerated > ago(timeframe)
  | where message.sub_type in ('spyware', 'scan', 'file', 'vulnerability', 'flood', 'packet', 'virus','wildfire', 'wildfire-virus')
  | extend src_ip = tostring(message.src_ip)
  | summarize TotalEvents = count(), ThreatTypes = make_set(message.sub_type), DestinationIpList = make_set(message.dst), FirstSeen = min(TimeGenerated) , LastSeen = max(TimeGenerated) by src_ip, tostring(message.action), FirewallName_s;
  CurrentHourThreats 
  | where TotalEvents < CurrThreshold
  | join kind = leftanti (HistoricalThreats 
  | where TotalEvents > HistThreshold) on src_ip
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: src_ip
version: 1.0.2
kind: Scheduled

id: 7226d37b-50ee-4e3b-9f80-5b74080d8f2c
name: Corelight - Multiple files sent over HTTP with abnormal requests
description: |
  'Detects sources sending multiple compressed files greater than 10MBs sent over HTTP in a short amount of time.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: Corelight
    dataTypes:
      - corelight_http
      - corelight_http_red
      - corelight_http2
      - corelight_http_agg
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Exfiltration
relevantTechniques:
  - T1030
query: |
  let threshold = 25;
  let fl_size_threshold = 10000000;
  union isfuzzy=true corelight_http, corelight_http_agg
  | where method in~ ('POST', 'PUT')
  | where isempty(referrer)
  | where tolong(request_body_len) > fl_size_threshold
  | summarize count() by uri, id_orig_h, bin(TimeGenerated, 15m)
  | where count_ > threshold
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: id_orig_h
version: 2.2.0
kind: Scheduled

id: 7a0f79cc-8d28-44b5-ac1e-6176565bb7b8
name: Cyble Vision Alerts Discovered Subdomain
description: |
  'Triggers when a new subdomain is detected for a monitored keyword/domain.'
severity: Low
status: Available
requiredDataConnectors:
- connectorId: CybleVisionAlerts
  dataTypes:
  - CybleVisionAlerts_CL
enabled: true
queryfrequency: 30m
queryPeriod: 30m
triggerOperator: GreaterThan
triggerThreshold: 0
eventGroupingSettings:
  aggregationKind: AlertPerResult
tactics:
- Reconnaissance
relevantTechniques:
- T1595
query: |
  Alerts_subdomains  
  | where Service == "subdomains" 
  | extend MappedSeverity = Severity
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
  alertDetailsOverride:
  alertDisplayNameFormat: New Subdomain Detected {{SD_Subdomain}}
  alertDescriptionFormat: |
    A new subdomain was discovered for monitored domain/keyword. Keyword {{SD_KeywordName}} Bucket {{SD_BucketName}} Severity {{MappedSeverity}} This may represent new attack surface exposure or infrastructure expansion.
customDetails:
  MappedSeverity: Severity
  Status: Status
  AlertID: AlertID
  Service: Service
  SD_Subdomain: SD_Subdomain
  SD_KeywordName: KeywordName
  SD_EntityID: EntityID
  SD_BucketName: BucketName
entityMappings:
- entityType: DNS
  fieldMappings:
  - identifier: DomainName
    columnName: SD_Subdomain
version: 1.0.0
kind: Scheduled

id: d82eb796-d1eb-43c8-a813-325ce3417cef
name: Dev-0530 File Extension Rename
description: |
  'Dev-0530 actors are known to encrypt the contents of the victims device as well as renaming the file extensions. This query looks for the creation of files with .h0lyenc extension or presence of ransom note.'
severity: High
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceFileEvents
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Impact
relevantTechniques:
  - T1486
tags:
  - Dev-0530
  - Schema: ASIMFileEvent
    SchemaVersion: 0.1.0
query: |
  union isfuzzy=true
      (DeviceFileEvents
      | where ActionType == "FileCreated"
      | where FileName endswith ".h0lyenc" or FolderPath == "C:\\FOR_DECRYPT.html"
      | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated)
          by
          AccountName = InitiatingProcessAccountName, AccountDomain = InitiatingProcessAccountDomain,
          DeviceName,
          Type,
          InitiatingProcessId,
          FileName,
          FolderPath,
          EventType = ActionType,
          Commandline = InitiatingProcessCommandLine,
          InitiatingProcessFileName,
          InitiatingProcessSHA256,
          FileHashCustomEntity = SHA256,
          AlgorithmCustomEntity = "SHA256"
      | extend HostName = tostring(split(DeviceName, ".")[0]), DomainIndex = toint(indexof(DeviceName, '.'))
      | extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)
      ),
      (imFileEvent
      | where EventType == "FileCreated"
      | where TargetFilePath endswith ".h0lyenc" or TargetFilePath == "C:\\FOR_DECRYPT.html"
      | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated)
          by
          ActorUsername,
          DvcHostname,
          DvcDomain,
          DvcId,
          Type,
          EventType,
          FileHashCustomEntity = TargetFileSHA256,
          Hash,
          TargetFilePath,
          Commandline = ActingProcessCommandLine,
          AlgorithmCustomEntity = "SHA256"
      | extend AccountName = tostring(split(ActorUsername, @'\')[1]), AccountDomain = tostring(split(ActorUsername, @'\')[0])
      | extend HostName = DvcHostname, HostNameDomain = DvcDomain
      | extend DeviceName = strcat(DvcHostname, ".", DvcDomain )
      )
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: ActorUserName
      - identifier: Name
        columnName: AccountName
      - identifier: NTDomain
        columnName: AccountDomain
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: DeviceName
      - identifier: HostName
        columnName: HostName
      - identifier: DnsDomain
        columnName: HostNameDomain
  - entityType: FileHash
    fieldMappings:
      - identifier: Algorithm
        columnName: AlgorithmCustomEntity
      - identifier: Value
        columnName: FileHashCustomEntity
version: 1.1.1
kind: Scheduled
metadata:
    source:
        kind: Community
    author:
        name: Microsoft Security Research
    support:
        tier: Community
    categories:
        domains: [ "Security - Others" ]

// Author: Cyb3rMonk(https://twitter.com/Cyb3rMonk, https://mergene.medium.com)
//
// Query parameters:
let HijackLibs = externaldata(DLLName:string, ExpectedLocation:string, Process: string )
[@"https://github.com/Cyb3r-Monk/Threat-Hunting-and-Detection/raw/main/Defense%20Evasion/HijackLibs.csv"]
with (format="csv", ignoreFirstRecord=True);
//
HijackLibs
| join hint.strategy=shuffle kind=rightsemi(
    DeviceImageLoadEvents
    | extend DLLDir =  case(FolderPath startswith "C:\\windows\\system32\\driverstore\\filerepository\\prnms002.inf", replace_regex(tolower(FolderPath), @'c:\\windows\\system32\\driverstore\\filerepository\\prnms002\.inf_.*\\amd64', @'%SYSTEM32%\\driverstore\\filerepository\\prnms002.inf_%VERSION%\\amd64'),
                            FolderPath has_all ('Windows Kits', 'bin', 'x86'), '%PROGRAMFILES%\\windows kits\\10\\bin\\%VERSION%\\x86',
                            FolderPath has_all ('Windows Kits', 'bin', 'x64'), '%PROGRAMFILES%\\windows kits\\10\\bin\\%VERSION%\\x64',
                            FolderPath has_all ('Windows Kits', 'bin', 'arm64'), '%PROGRAMFILES%\\Windows Kits\\10\\bin\\%VERSION%\\arm64',
                            FolderPath has_all ('Program Files', 'Edge', 'Application'),  tolower('%PROGRAMFILES%\\microsoft\\edge\\application\\%VERSION%'),
                            FolderPath has_all ('Program Files', 'Microsoft Office', 'root'),  tolower('%PROGRAMFILES%\\microsoft office\\root\\office%VERSION%'),
                            FolderPath contains '\\Microsoft Office\\Office',  tolower('%PROGRAMFILES%\\Microsoft Office\\OFFICE%VERSION%'),
                            FolderPath has_all ('ProgramData', 'Microsoft', 'Windows Defender', 'Platform'), tolower('%PROGRAMDATA%\\Microsoft\\Windows Defender\\Platform\\%VERSION%'),
                            FolderPath startswith "C:\\Program Files (x86)", tolower(replace_string(tolower(FolderPath), 'c:\\program files (x86)', '%programfiles%')),
                            FolderPath startswith "C:\\Program Files", tolower(replace_string(tolower(FolderPath), 'c:\\program files', '%programfiles%')),
                            FolderPath startswith "C:\\WINDOWS\\SysWow64", tolower(replace_string(tolower(FolderPath), 'c:\\windows\\syswow64', '%syswow64%')),
                            FolderPath startswith "C:\\WINDOWS\\System32", tolower(replace_string(tolower(FolderPath), 'c:\\windows\\system32', '%system32%')),
                            FolderPath startswith "C:\\ProgramData", tolower(replace_string(tolower(FolderPath), 'c:\\programdata', '%programdata%')),
                            FolderPath has "AppData\\Local", tolower(replace_regex(tolower(FolderPath), @'c:\\users\\.*\\appdata\\local', '%localappdata%')),
                            FolderPath has "AppData\\Roaming", tolower(replace_regex(tolower(FolderPath), @'c:\\users\\.*\\appdata\\roaming', '%appdata%')),
                            tolower(FolderPath)),
            Process = case( InitiatingProcessFolderPath has_all ('WindowsApps', 'msteams.exe'), tolower('%PROGRAMFILES%\\WindowsApps\\MicrosoftTeams%VERSION%\\msteams.exe'),
                            InitiatingProcessFolderPath has_all ('Windows Kits', 'x86', 'oleview.exe'), tolower('%PROGRAMFILES%\\Windows Kits\\10\\bin\\%VERSION%\\x86\\oleview.exe'),
                            InitiatingProcessFolderPath has_all ('Windows Kits', 'x64', 'oleview.exe'), tolower('%PROGRAMFILES%\\Windows Kits\\10\\bin\\%VERSION%\\x64\\oleview.exe'),
                            InitiatingProcessFolderPath has_all ('Windows Kits', 'arm64', 'oleview.exe'), tolower('%PROGRAMFILES%\\Windows Kits\\10\\bin\\%VERSION%\\arm64\\oleview.exe'),
                            InitiatingProcessFolderPath has_all ('Program Files', 'trend micro', 'pwmsvc.exe'), tolower('%PROGRAMFILES%\\trend micro\\passwordmanager\\pwmsvc.exe'),
                            InitiatingProcessFolderPath has_all ('Program Files', 'trend micro', 'coreserviceshell.exe'), tolower('%PROGRAMFILES%\\trend micro\\amsp\\coreserviceshell.exe'),
                            InitiatingProcessFolderPath has_all ('Program Files', 'EdgeWebView', 'Application', 'msedgewebview2.exe'),  tolower('%PROGRAMFILES%\\Microsoft\\EdgeWebView\\Application\\%VERSION%\\msedgewebview2.exe'),
                            InitiatingProcessFolderPath has_all ('Program Files', 'Microsoft Office', 'root'),  tolower(replace_regex(InitiatingProcessFolderPath, @'.*?\\Microsoft Office\\root\\Office.*\\(.*)', @'%PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\\1')),
                            InitiatingProcessFolderPath has_all ('Program Files', 'Microsoft Office', 'outlook.exe'),  tolower('%PROGRAMFILES%\\Microsoft Office\\OFFICE%VERSION%\\outlook.exe'),
                            InitiatingProcessFolderPath has_all ('Program Files', 'Microsoft', 'Windows Defender', 'MsMpEng'),   tolower('%PROGRAMDATA%\\Microsoft\\Windows Defender\\Platform\\%VERSION%\\MsMpEng.exe'),
                            InitiatingProcessFolderPath startswith "C:\\Program Files (x86)", tolower(replace_string(tolower(InitiatingProcessFolderPath), 'c:\\program files (x86)', '%programfiles%')),
                            InitiatingProcessFolderPath startswith "C:\\Program Files", tolower(replace_string(tolower(InitiatingProcessFolderPath), 'c:\\program files', '%programfiles%')),
                            InitiatingProcessFolderPath startswith "C:\\WINDOWS", tolower(replace_string(tolower(InitiatingProcessFolderPath), 'c:\\windows', '%windir%')),
                            InitiatingProcessFolderPath startswith "C:\\WINDOWS\\System32", tolower(replace_string(tolower(InitiatingProcessFolderPath), 'c:\\windows\\system32', '%system32%')),
                            InitiatingProcessFolderPath startswith "C:\\ProgramData", tolower(replace_string(tolower(InitiatingProcessFolderPath), 'c:\\programdata', '%programdata%')),
                            InitiatingProcessFolderPath has "AppData\\Local", tolower(replace_regex(tolower(InitiatingProcessFolderPath), @'c:\\users\\.*\\appdata\\local', '%localappdata%')),
                            InitiatingProcessFolderPath has "AppData\\Roaming", tolower(replace_regex(tolower(InitiatingProcessFolderPath), @'c:\\users\\.*\\appdata\\roaming', '%appdata%')),
                            tolower(InitiatingProcessFolderPath)),
            DLLName = tolower(FileName)
    )
    on Process, DLLName
    | extend DLLDir = tostring(parse_path(DLLDir).DirectoryPath)
    | join kind=leftanti HijackLibs on Process, DLLName, $left.DLLDir==$right.ExpectedLocation

id: a8130dcc-3617-41c0-a7ac-5f352bcfffaf
name: External Fabric Module XFM1 is unhealthy
version: 1.0.0
kind: NRT
description: External Fabric Module XFM1 is unhealthy
severity: High
tactics:
- Execution
relevantTechniques:
- T0871
query: |2-
  Syslog
  | where SyslogMessage has "purity.alert"
  | extend Message = replace_string(SyslogMessage, "#012", "\n")
  | extend UTCTime = extract(@"UTC Time:\s*(\d{4}\s\w{3}\s\d{1,2}\s\d{2}:\d{2}:\d{2})\sUTC", 1, SyslogMessage)
  | extend PureAlertID = extract(@"Alert ID: ([\w-]+)", 1, SyslogMessage)
  | extend PureMessage = extract(@"\(Alert ID: [\w-]+\)\s(.*?)\s\[\d+\]", 1, SyslogMessage)
  | extend PureSeverity = extract(@"\s(\w+)\s", 1, SyslogMessage)
  | extend PureAlertState = extract(@"purity\.alert:\s\w+\s(\w+)", 1, SyslogMessage)
  | extend PureObjectName = extract(@"\s(\S+):", 1, SyslogMessage)
  | extend PureProcessID = extract(@"\[(\d+)\]", 1, SyslogMessage)
  | extend PureAction = extract(@"Suggested Action:\s*(.*?)(?:\s*Knowledge Base Article:|$)", 1, SyslogMessage)
  | extend PureUrl = extract(@"Knowledge Base Article:\s*(.*)", 1, SyslogMessage)
  | project  PureMessage, TimeGenerated, PureProcessID, HostIP, Computer, PureObjectName, PureSeverity, PureAlertID, PureAlertState, PureAction, PureUrl
  | where PureMessage matches regex @"(External Fabric Module XFM1 is unhealthy)"
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: HostIP
suppressionEnabled: false
suppressionDuration: 5h
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: 5h
    matchingMethod: AllEntities
    groupByEntities: []
    groupByAlertDetails: []
    groupByCustomDetails: []
eventGroupingSettings:
  aggregationKind: SingleAlert

id: 50e0437e-912d-4cd0-ac19-fef0aebdd3d7
name: GCP IAM - Service Account Enumeration
description: |
  'Detects possible service account enumeration.'
severity: Low
status: Available
requiredDataConnectors:
  - connectorId: GCPIAMDataConnector
    dataTypes:
      - GCP_IAM
queryFrequency: 12h
queryPeriod: 12h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Discovery
relevantTechniques:
  - T1087
query: |
  let threshold = 5;
  GCP_IAM
  | where PayloadMethodname =~ 'google.iam.admin.v1.ListServiceAccounts'
  | summarize count() by PayloadAuthenticationinfoPrincipalemail, bin(TimeGenerated, 1h)
  | where count_ > threshold
  | extend AccountCustomEntity = PayloadAuthenticationinfoPrincipalemail
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
version: 1.0.0
kind: Scheduled

id: 0995ccd8-16d4-4764-83b2-511235ca4e4b
name: Global Network Traffic Rules Deleted
description: Detects when a global network traffic rule is deleted in Veeam Backup
  & Replication. This might indicate unauthorized removal of critical components.
severity: Low
status: Available
requiredDataConnectors:
- connectorId: Syslog
  dataTypes:
  - Syslog
- connectorId: SyslogAma
  dataTypes:
  - Syslog
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
eventGroupingSettings:
  aggregationKind: AlertPerResult
tactics: []
relevantTechniques: []
query: "Veeam_GetSecurityEvents\n| where instanceId == 32400\n| project\n    Date\
  \ = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n    DataSource = original_host,\n\
  \    EventId = instanceId,\n    [\"User Name\"] = user,\n  MessageDetails = Description,\n\
  \   Severity = SeverityDescription"
version: 1.0.1
kind: Scheduled
customDetails:
  Date: Date
  VbrHostName: DataSource
  EventId: EventId
  MessageDetails: MessageDetails
  Severity: Severity

// Fill in agent name or one of the Agent IDs you have found
let agent_name = "";
let some_agent_id = "";
AgentsInfo 
| where TimeGenerated > ago(1d)
| summarize arg_max(TimeGenerated, *) by AgentId
| where (isempty(some_agent_id) and Name =~ agent_name) or (isempty(agent_name) and * has some_agent_id)
// Skip local AI Agents
| where Platform != "LocalAgents"
| extend ExtractedObservabilityID = iff(
    ObservabilityID matches regex @"(\{{0,1}([0-9a-fA-F]){8}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){12}\}{0,1})",
    extract(@"(\{{0,1}([0-9a-fA-F]){8}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){12}\}{0,1})", 1, ObservabilityID),
    ObservabilityID
)
// Add fallback on titleId if ObservabilityID is empty
| extend ExtractedObservabilityID = iff(ExtractedObservabilityID == "", extract(@"(\{{0,1}([0-9a-fA-F]){8}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){12}\}{0,1})", 1, tostring(parse_json(RawAgentInfo).titleId)), ExtractedObservabilityID)
| project Name, Platform, ExtractedObservabilityID
| join kind=inner (
    CloudAppEvents
    | where TimeGenerated > ago(7d)
    | where ActionType in ("InvokeAgent","InferenceCall","ExecuteToolBySDK","ExecuteToolByGateway","ExecuteToolByMCPServer")
    // Extract the platformIDs and ObservabilityID
    | extend PlatformAgentId = tostring(parse_json(RawEventData)["PlatformAgentId"]), 
        PlatformTargetAgentId = tostring(parse_json(RawEventData)["PlatformTargetAgentId"])
    | extend PlatformId = iff(isempty(PlatformAgentId) and isnotempty(PlatformTargetAgentId), PlatformTargetAgentId, PlatformAgentId)
    | extend ObservabilityID = iff(
        PlatformId matches regex @"(\{{0,1}([0-9a-fA-F]){8}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){12}\}{0,1})", 
        extract(@"(\{{0,1}([0-9a-fA-F]){8}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){12}\}{0,1})", 1, PlatformId),
        PlatformId
    )
) on $left.ExtractedObservabilityID == $right.ObservabilityID

id: f53e5168-afdb-4fad-b29a-bb9cb71ec460
name: McAfee ePO - Multiple threats on same host
description: |
  'Rule fires when multiple threat events were detected on the same host.'
severity: Medium
requiredDataConnectors:
  - connectorId: SyslogAma
    datatypes:
      - Syslog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
status: Available
tactics:
  - InitialAccess
  - Persistence
  - DefenseEvasion
  - PrivilegeEscalation
relevantTechniques:
  - T1562
  - T1070
  - T1189
  - T1195
  - T1543
  - T1055
query: |
  McAfeeEPOEvent
  | where isnotempty(ThreatName)
  | where ThreatName != '_'
  | summarize th_cnt = dcount(ThreatName), th_list = makeset(ThreatName) by DvcIpAddr
  | where th_cnt > 1
  | extend IPCustomEntity = DvcIpAddr
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity
version: 1.0.2
kind: Scheduled

id: 77548170-5c60-42e5-bdac-b0360d0779bb
name: NetClean ProActive Incidents
description: |
  'NetClean Incident'
severity: High
requiredDataConnectors:
  - connectorId: Netclean_ProActive_Incidents
    dataTypes:
      - Netclean_ProActive_Incidents
status: Available 
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
suppressionDuration: 5h
tactics:
  - Discovery
relevantTechniques:
  - T1083
query: |
  Netclean_Incidents_CL |  where value_incidentVersion_d == 1
entityMappings:
  - entityType: FileHash
    fieldMappings:
      - identifier: Value
        columnName: value_file_calculatedHashes_sha1_s
      - identifier: Algorithm
        columnName: value_detectionHashType_s
  - entityType: DNS
    fieldMappings:
      - identifier: DomainName
        columnName: value_file_owner_computerUser_domain_s
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: value_device_machineName_s
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: value_device_networkInterfaces_s
alertDetailsOverride:
  alertDisplayNameFormat: NetClean {{value_agent_type_s}} {{type_s}}
  alertDescriptionFormat: A new NetClean {{value_agent_type_s}} {{key_type_s}} has been Created {{TimeGenerated}}
version: 1.0.2
kind: Scheduled

id: ac76d9c0-17a3-4aaa-a341-48f4c0b1c882
name: Palo Alto Prisma Cloud - IAM Group with Administrator Access Permissions
description: |
  'Detects IAM Groups with Administrator Access Permissions.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: PaloAltoPrismaCloud
    dataTypes:
      - PaloAltoPrismaCloud
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1078
query: |
  PaloAltoPrismaCloud
  | where Reason =~ 'NEW_ALERT'
  | where Status =~ 'open'
  | where AlertMessage has 'IAM Groups with Administrator Access Permissions'
  | extend AccountCustomEntity = UserName
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountCustomEntity
version: 1.0.1
kind: Scheduled