Detection rules › Kusto
CyberArkEPM - Multiple attack types
'This rule triggers on multiple attack attemts triggered by same user.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution |
Rule body
id: c02f96b4-057b-4e63-87af-6376ef7a081b
name: CyberArkEPM - Multiple attack types
description: |
'This rule triggers on multiple attack attemts triggered by same user.'
severity: High
requiredDataConnectors:
- connectorId: CyberArkEPM
dataTypes:
- CyberArkEPM
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics:
- Execution
relevantTechniques:
- T1204
query: |
CyberArkEPM
| where EventSubType =~ 'AttackAttempt'
| summarize LatestAttackTime=max(EventEndTime), att=makeset(EventMessage) by ActorUsername
| where array_length(att) > 1
| extend AccountCustomEntity = ActorUsername
entityMappings:
- entityType: Account
fieldMappings:
- identifier: Name
columnName: AccountCustomEntity
version: 1.0.0
kind: Scheduled
Stages and Predicates
Stage 1: source
CyberArkEPM
Stage 2: where
| where EventSubType =~ 'AttackAttempt'
Stage 3: summarize
| summarize LatestAttackTime=max(EventEndTime), att=makeset(EventMessage) by ActorUsername
Stage 4: where
| where array_length(att) > 1
Stage 5: extend
| extend AccountCustomEntity = ActorUsername
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventSubType | eq |
| field:"EventSubType" kind:eq value:"AttackAttempt" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
ActorUsername | summarize |
LatestAttackTime | summarize |
att | summarize |
AccountCustomEntity | extend |