Detection rules › Kusto
Cisco SE - Unexpected binary file
'Detects binary files in uncommon locations.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access |
Rule body
id: eabb9c20-7b0b-4a77-81e8-b06944f351c6
name: Cisco SE - Unexpected binary file
description: |
'Detects binary files in uncommon locations.'
severity: Medium
requiredDataConnectors:
- connectorId: CiscoSecureEndpoint
dataTypes:
- CiscoSecureEndpoint
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
status: Available
tactics:
- InitialAccess
relevantTechniques:
- T1190
- T1133
query: |
CiscoSecureEndpoint
| where isnotempty(SrcFileName)
| where SrcFilePath contains @'AppData\Local\Temp' or SrcFilePath contains @'OUTLOOK_TEMP'
| extend ext = extract(@"(.*\/)?(.*)", 2, tostring(SrcFilePath))
| where ext contains 'dll' or ext contains @'ps1' or ext contains @'exe'
| extend HostCustomEntity = DstHostname
entityMappings:
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: HostCustomEntity
version: 1.0.0
kind: Scheduled
Stages and Predicates
Stage 1: source
CiscoSecureEndpoint
Stage 2: where
| where isnotempty(SrcFileName)
Stage 3: where
| where SrcFilePath contains @'AppData\Local\Temp' or SrcFilePath contains @'OUTLOOK_TEMP'
Stage 4: extend
| extend ext = extract(@"(.*\/)?(.*)", 2, tostring(SrcFilePath))
Stage 5: where
| where ext contains 'dll' or ext contains @'ps1' or ext contains @'exe'
Stage 6: extend
| extend HostCustomEntity = DstHostname
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
SrcFileName | is_not_null | field:"SrcFileName" kind:is_not_null | |
SrcFilePath | contains |
| field:"SrcFilePath" kind:contains |
ext | contains |
| field:"ext" kind:contains |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
ext | extend |
HostCustomEntity | extend |