detection.wiki

Detection rules › Kusto

CyberArkEPM - Uncommon process Internet access

Severity
high
Time window
30m
Source
github.com/Azure/Azure-Sentinel

'Detects access to the Internet by uncommon processes.'

MITRE ATT&CK coverage

TacticTechniques
Execution
Stealth
Command & Control

Rule body

id: 9d0d44ab-54dc-472a-9931-53521e888932
name: CyberArkEPM - Uncommon process Internet access
description: |
  'Detects access to the Internet by uncommon processes.'
severity: High
requiredDataConnectors:
  - connectorId: CyberArkEPM
    dataTypes:
      - CyberArkEPM
queryFrequency: 30m
queryPeriod: 30m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Execution
  - DefenseEvasion
  - CommandAndControl
relevantTechniques:
  - T1204
  - T1036
  - T1095
query: | 
  let lb_period = 14d;
  let q_time = 1h;
  let inet_access_proc = CyberArkEPM
  | where TimeGenerated between (ago(lb_period) .. ago(q_time))
  | where EventSubType =~ 'DetectAccessInternet'
  | where isnotempty(ActingProcessFileInternalName)
  | summarize makeset(ActingProcessFileInternalName);
  CyberArkEPM
  | where TimeGenerated > ago(q_time)
  | where EventSubType =~ 'DetectAccessInternet'
  | where ActingProcessFileInternalName !in (inet_access_proc)
  | extend AccountCustomEntity = ActorUsername
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountCustomEntity
version: 1.0.0
kind: Scheduled

Stages and Predicates

Parameters

let lb_period = 14d;
let q_time = 1h;

Let binding: inet_access_proc used in Stage 4

let inet_access_proc = CyberArkEPM
| where TimeGenerated between (ago(lb_period) .. ago(q_time))
| where EventSubType =~ 'DetectAccessInternet'
| where isnotempty(ActingProcessFileInternalName)
| summarize makeset(ActingProcessFileInternalName);

Stage 1: source

CyberArkEPM

Stage 2: where

| where TimeGenerated > ago(q_time)

Stage 3: where

| where EventSubType =~ 'DetectAccessInternet'

Stage 4: where

| where ActingProcessFileInternalName !in (inet_access_proc)

Stage 5: extend

| extend AccountCustomEntity = ActorUsername

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
ActingProcessFileInternalNameeqinet_access_procexcludes:ActingProcessFileInternalName field:"ActingProcessFileInternalName" value:"inet_access_proc"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
EventSubTypeeq
  • DetectAccessInternet
field:"EventSubType" kind:eq value:"DetectAccessInternet"

Output fields

These fields are emitted when the rule matches.

FieldSource
AccountCustomEntityextend