Detection rules › Kusto

CyberArkEPM - Process started from different locations

Severity
medium
Time window
1h
Group by
ActingProcessFileInternalName, DvcId
Source
github.com/Azure/Azure-Sentinel

'Detects when process started from different locations on a host.'

MITRE ATT&CK coverage

TacticTechniques
Execution
Stealth

Rule body

id: 0d4e62da-0a64-4532-b93e-28cd2940c300
name: CyberArkEPM - Process started from different locations
description: |
  'Detects when process started from different locations on a host.'
severity: Medium
requiredDataConnectors:
  - connectorId: CyberArkEPM
    dataTypes:
      - CyberArkEPM
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Execution
  - DefenseEvasion
relevantTechniques:
  - T1204
  - T1036
query: | 
  CyberArkEPM
  | where EventSubType != 'AttackAttempt'
  | extend bin_path = tolower(extract(@'\A(.*)(\\|/)', 1, ActingProcessName))
  | summarize p = makeset(bin_path) by ActingProcessFileInternalName, DvcId
  | where array_length(p) > 1
  | extend FileCustomEntity = ActingProcessFileInternalName
entityMappings:
  - entityType: File
    fieldMappings:
      - identifier: Name
        columnName: FileCustomEntity
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: source

CyberArkEPM

Stage 2: where

| where EventSubType != 'AttackAttempt'

Stage 3: extend

| extend bin_path = tolower(extract(@'\A(.*)(\\|/)', 1, ActingProcessName))

Stage 4: summarize

| summarize p = makeset(bin_path) by ActingProcessFileInternalName, DvcId

Stage 5: where

| where array_length(p) > 1

Stage 6: extend

| extend FileCustomEntity = ActingProcessFileInternalName

Indicators

These rows show field, operator, and value matches.

Output fields

These fields are emitted when the rule matches.

FieldSource
ActingProcessFileInternalNamesummarize
DvcIdsummarize
psummarize
FileCustomEntityextend