Medium severity malicious activity detected

Status: available
Severity: medium
Time window: 1d
Group by: SourceIp, ThreatCategory
Source: github.com/Azure/Azure-Sentinel

Identifies medium severity malicious activity in Azure Firewall IDPS logs.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1204` User Execution
Stealth	`T1036` Masquerading
Impact	`T1496` Resource Hijacking

Rule body

id: dfbe3963-42fb-4ebe-a00c-1cc44e2aa9f0
name: Medium severity malicious activity detected
description: |
  Identifies medium severity malicious activity in Azure Firewall IDPS logs.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: AzureFirewall
    dataTypes:
      - AZFWIdpsSignature
queryFrequency: 1h
queryPeriod: 24h     
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - Execution
  - DefenseEvasion
  - Impact
relevantTechniques:
  - T1496
  - T1204
  - T1036
query: |
  let TimeWindow   = 90d;    
  let HitThreshold = 10;
  let MinSeverity  = 2;
  let EnableCategoryFilter    = true;
  let EnableDescriptionFilter = false;
  let EnableActionFilter      = false;
  let CategoriesOfInterest = dynamic([
      "Possibly Unwanted Program Detected",
      "Possible Social Engineering Attempted",
      "Crypto Currency Mining Activity Detected",
      "A suspicious filename was detected",
      "A system call was detected"
  ]);
  let DescriptionsOfInterest = dynamic([
      "pup-activity",
      "social-engineering",
      "coin-mining",
      "suspicious-filename-detect",
      "system-call-detect"
  ]);
  let MatchActions = dynamic(["Deny", "alert"]);
  AZFWIdpsSignature
  | where TimeGenerated >= ago(TimeWindow)
  | where Severity >= MinSeverity
  | where (EnableCategoryFilter == false) or (Category has_any (CategoriesOfInterest))
  | where (EnableDescriptionFilter == false) or (Description has_any (DescriptionsOfInterest))
  | where (EnableActionFilter == false) or (Action in~ (MatchActions))
  | summarize
      StartTime   = min(TimeGenerated),
      EndTime     = max(TimeGenerated),
      TotalHits   = count(),
      MaxSeverity = max(Severity),
      Actions     = make_set(Action, 5),
      Signatures  = make_set(SignatureId, 20),
      Description = make_set(substring(tostring(Description), 0, 120), 3)
      by SourceIp, ThreatCategory = Category
  | where TotalHits >= HitThreshold
  | project
      StartTime,
      EndTime,
      SourceIp,
      ThreatCategory,
      TotalHits,
      MaxSeverity,
      Actions,
      Signatures,
      Description
  | order by MaxSeverity desc, TotalHits desc
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIp
version: 1.0.1
kind: Scheduled

Stages and Predicates

Parameters

let TimeWindow = 90d;
let HitThreshold = 10;
let MinSeverity = 2;
let EnableCategoryFilter = true;
let EnableDescriptionFilter = false;
let EnableActionFilter = false;
let MatchActions = dynamic(["Deny", "alert"]);

Let binding: `CategoriesOfInterest` used in Stage 4

let CategoriesOfInterest = dynamic([
    "Possibly Unwanted Program Detected",
    "Possible Social Engineering Attempted",
    "Crypto Currency Mining Activity Detected",
    "A suspicious filename was detected",
    "A system call was detected"
]);

Let binding: `DescriptionsOfInterest` used in Stage 5

let DescriptionsOfInterest = dynamic([
    "pup-activity",
    "social-engineering",
    "coin-mining",
    "suspicious-filename-detect",
    "system-call-detect"
]);

Stage 1: `source`

AZFWIdpsSignature

Stage 2: `where`

| where TimeGenerated >= ago(TimeWindow)

Stage 3: `where`

| where Severity >= MinSeverity

Stage 4: `where`

| where (EnableCategoryFilter == false) or (Category has_any (CategoriesOfInterest))

Stage 5: `where`

| where (EnableDescriptionFilter == false) or (Description has_any (DescriptionsOfInterest))

Stage 6: `where`

| where (EnableActionFilter == false) or (Action in~ (MatchActions))

Stage 7: `summarize`

| summarize
    StartTime   = min(TimeGenerated),
    EndTime     = max(TimeGenerated),
    TotalHits   = count(),
    MaxSeverity = max(Severity),
    Actions     = make_set(Action, 5),
    Signatures  = make_set(SignatureId, 20),
    Description = make_set(substring(tostring(Description), 0, 120), 3)
    by SourceIp, ThreatCategory = Category

Stage 8: `where`

| where TotalHits >= HitThreshold

Stage 9: `project`

| project
    StartTime,
    EndTime,
    SourceIp,
    ThreatCategory,
    TotalHits,
    MaxSeverity,
    Actions,
    Signatures,
    Description

Stage 10: `sort`

| order by MaxSeverity desc, TotalHits desc

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Action`	in	`Deny` `alert`	`field:"Action" kind:in`
`Category`	match	`A suspicious filename was detected` transforms: `term` `A system call was detected` transforms: `term` `Crypto Currency Mining Activity Detected` transforms: `term` `Possible Social Engineering Attempted` transforms: `term` `Possibly Unwanted Program Detected` transforms: `term`	`field:"Category" kind:match`
`Description`	match	`coin-mining` transforms: `term` `pup-activity` transforms: `term` `social-engineering` transforms: `term` `suspicious-filename-detect` transforms: `term` `system-call-detect` transforms: `term`	`field:"Description" kind:match`
`Severity`	ge	`2`	`field:"Severity" kind:ge value:"2"`
`TotalHits`	ge	`10`	`field:"TotalHits" kind:ge value:"10"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Actions`	`project`
`Description`	`project`
`EndTime`	`project`
`MaxSeverity`	`project`
`Signatures`	`project`
`SourceIp`	`project`
`StartTime`	`project`
`ThreatCategory`	`project`
`TotalHits`	`project`

Medium severity malicious activity detected

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Let binding: CategoriesOfInterest used in Stage 4

Let binding: DescriptionsOfInterest used in Stage 5

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: where

Stage 6: where

Stage 7: summarize

Stage 8: where

Stage 9: project

Stage 10: sort

Indicators

Output fields

Let binding: `CategoriesOfInterest` used in Stage 4

Let binding: `DescriptionsOfInterest` used in Stage 5

Stage 1: `source`

Stage 2: `where`

Stage 3: `where`

Stage 4: `where`

Stage 5: `where`

Stage 6: `where`

Stage 7: `summarize`

Stage 8: `where`

Stage 9: `project`

Stage 10: `sort`