Detection rules › Kusto
CyberArkEPM - Process started from different locations
'Detects when process started from different locations on a host.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | |
| Stealth |
Rule body
id: 0d4e62da-0a64-4532-b93e-28cd2940c300
name: CyberArkEPM - Process started from different locations
description: |
'Detects when process started from different locations on a host.'
severity: Medium
requiredDataConnectors:
- connectorId: CyberArkEPM
dataTypes:
- CyberArkEPM
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- Execution
- DefenseEvasion
relevantTechniques:
- T1204
- T1036
query: |
CyberArkEPM
| where EventSubType != 'AttackAttempt'
| extend bin_path = tolower(extract(@'\A(.*)(\\|/)', 1, ActingProcessName))
| summarize p = makeset(bin_path) by ActingProcessFileInternalName, DvcId
| where array_length(p) > 1
| extend FileCustomEntity = ActingProcessFileInternalName
entityMappings:
- entityType: File
fieldMappings:
- identifier: Name
columnName: FileCustomEntity
version: 1.0.0
kind: Scheduled
Stages and Predicates
Stage 1: source
CyberArkEPM
Stage 2: where
| where EventSubType != 'AttackAttempt'
Stage 3: extend
| extend bin_path = tolower(extract(@'\A(.*)(\\|/)', 1, ActingProcessName))
Stage 4: summarize
| summarize p = makeset(bin_path) by ActingProcessFileInternalName, DvcId
Stage 5: where
| where array_length(p) > 1
Stage 6: extend
| extend FileCustomEntity = ActingProcessFileInternalName
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventSubType | ne |
| field:"EventSubType" kind:ne value:"AttackAttempt" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
ActingProcessFileInternalName | summarize |
DvcId | summarize |
p | summarize |
FileCustomEntity | extend |