MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | |
| Stealth |
Rule body
id: 9281b7cc-8f05-45a9-bf10-17fb29492a84
name: CyberArkEPM - Renamed Windows binary
description: |
'Detects renamed windows binaries.'
severity: High
requiredDataConnectors:
- connectorId: CyberArkEPM
dataTypes:
- CyberArkEPM
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- Execution
- DefenseEvasion
relevantTechniques:
- T1204
- T1036
query: |
CyberArkEPM
| where EventSubType != 'AttackAttempt'
| where ActingProcessName has @'\'
| where ActingProcessName !has ActingProcessFileInternalName
| project EventEndTime, EventMessage, ActorUsername, ActingProcessFileInternalName
| extend AccountCustomEntity = ActorUsername
entityMappings:
- entityType: Account
fieldMappings:
- identifier: Name
columnName: AccountCustomEntity
version: 1.0.0
kind: Scheduled
Stages and Predicates
Stage 1: source
CyberArkEPM
Stage 2: where
| where EventSubType != 'AttackAttempt'
Stage 3: where
| where ActingProcessName has @'\'
Stage 4: where
| where ActingProcessName !has ActingProcessFileInternalName
Stage 5: project
| project EventEndTime, EventMessage, ActorUsername, ActingProcessFileInternalName
Stage 6: extend
| extend AccountCustomEntity = ActorUsername
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ActingProcessName | cross_field_compare |
| field:"ParentImage" kind:cross_field_compare value:"ActingProcessFileInternalName" |
ActingProcessName | match |
| field:"ParentImage" kind:match value:"\" |
EventSubType | ne |
| field:"EventSubType" kind:ne value:"AttackAttempt" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
ActingProcessFileInternalName | project |
ActorUsername | project |
EventEndTime | project |
EventMessage | project |
AccountCustomEntity | extend |