Detection rules › Kusto
CyberArkEPM - Attack attempt not blocked
'This rule triggers on attack attempt which was not blocked by CyberArkEPM.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution |
Rule body
id: 8e8978a2-9188-4187-8909-5ea00507bf16
name: CyberArkEPM - Attack attempt not blocked
description: |
'This rule triggers on attack attempt which was not blocked by CyberArkEPM.'
severity: High
requiredDataConnectors:
- connectorId: CyberArkEPM
dataTypes:
- CyberArkEPM
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics:
- Execution
relevantTechniques:
- T1204
query: |
CyberArkEPM
| where EventSubType =~ 'AttackAttempt'
| where ThreatProtectionAction =~ 'Detect'
| project EventEndTime, EventMessage, ActorUsername, ActingProcessFileInternalName, Evidences
| extend AccountCustomEntity = ActorUsername
entityMappings:
- entityType: Account
fieldMappings:
- identifier: Name
columnName: AccountCustomEntity
version: 1.0.0
kind: Scheduled
Stages and Predicates
Stage 1: source
CyberArkEPM
Stage 2: where
| where EventSubType =~ 'AttackAttempt'
Stage 3: where
| where ThreatProtectionAction =~ 'Detect'
Stage 4: project
| project EventEndTime, EventMessage, ActorUsername, ActingProcessFileInternalName, Evidences
Stage 5: extend
| extend AccountCustomEntity = ActorUsername
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventSubType | eq |
| field:"EventSubType" kind:eq value:"AttackAttempt" |
ThreatProtectionAction | eq |
| field:"ThreatProtectionAction" kind:eq value:"Detect" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
ActingProcessFileInternalName | project |
ActorUsername | project |
EventEndTime | project |
EventMessage | project |
Evidences | project |
AccountCustomEntity | extend |