CiscoISE - Command executed with the highest privileges by new user

Status: available
Severity: medium
Time window: 5m
Source: github.com/Azure/Azure-Sentinel

'Detects command execution with PrivilegeLevel - 15 by user for wich there was no such activity detected earlier.'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1133` External Remote Services
Execution	`T1059` Command and Scripting Interpreter
Persistence	`T1133` External Remote Services
Privilege Escalation	`T1548` Abuse Elevation Control Mechanism

Rule body

id: e71890a2-5f61-4790-b1ed-cf1d92d3e398
name: CiscoISE - Command executed with the highest privileges by new user
description: |
  'Detects command execution with PrivilegeLevel - 15 by user for wich there was no such activity detected earlier.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: SyslogAma
    datatypes:
      - Syslog
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - Persistence
  - PrivilegeEscalation
  - DefenseEvasion
  - Execution
relevantTechniques:
  - T1133
  - T1548
  - T1059
query: |
  let lbperiod = 14d;
  let lbtime = 15m;
  let knownPrivUsers =
  CiscoISEEvent
  | where TimeGenerated between (ago(lbperiod) .. ago(lbtime))
  | where PrivilegeLevel == '15'
  | summarize makelist(DstUserName)
  ;
  CiscoISEEvent
  | where TimeGenerated > ago(lbtime)
  | where PrivilegeLevel == '15'
  | where DstUserName !in (knownPrivUsers)
  | project TimeGenerated, SrcIpAddr, DstIpAddr, DstUserName, CmdSet
  | extend AccountCustomEntity = DstUserName
  | extend IPCustomEntity = SrcIpAddr
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity
version: 1.0.4
kind: Scheduled

Stages and Predicates

Parameters

let lbperiod = 14d;
let lbtime = 15m;

Let binding: `knownPrivUsers` used in Stage 4

let knownPrivUsers = CiscoISEEvent
| where TimeGenerated between (ago(lbperiod) .. ago(lbtime))
| where PrivilegeLevel == '15'
| summarize makelist(DstUserName);

Stage 1: `source`

CiscoISEEvent

Stage 2: `where`

| where TimeGenerated > ago(lbtime)

Stage 3: `where`

| where PrivilegeLevel == '15'

Stage 4: `where`

| where DstUserName !in (knownPrivUsers)

Stage 5: `project`

| project TimeGenerated, SrcIpAddr, DstIpAddr, DstUserName, CmdSet

Stage 6: `extend`

| extend AccountCustomEntity = DstUserName

Stage 7: `extend`

| extend IPCustomEntity = SrcIpAddr

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`DstUserName`	eq	`knownPrivUsers`	`excludes:DstUserName` `field:"DstUserName" value:"knownPrivUsers"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`PrivilegeLevel`	eq	`15`	`field:"PrivilegeLevel" kind:eq value:"15"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`CmdSet`	`project`
`DstIpAddr`	`project`
`DstUserName`	`project`
`SrcIpAddr`	`project`
`TimeGenerated`	`project`
`AccountCustomEntity`	`extend`
`IPCustomEntity`	`extend`

CiscoISE - Command executed with the highest privileges by new user

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Let binding: knownPrivUsers used in Stage 4

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: project

Stage 6: extend

Stage 7: extend