CyberArkEPM - Unexpected executable extension

Severity: medium
Time window: 30m
Source: github.com/Azure/Azure-Sentinel

'Detects Windows executable with unexpected extension.'

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1204` User Execution
Stealth	`T1036` Masquerading

Rule body

id: 911d5b75-a1ce-4f13-a839-9c2474768696
name: CyberArkEPM - Unexpected executable extension
description: |
  'Detects Windows executable with unexpected extension.'
severity: Medium
requiredDataConnectors:
  - connectorId: CyberArkEPM
    dataTypes:
      - CyberArkEPM
queryFrequency: 30m
queryPeriod: 30m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Execution
  - DefenseEvasion
relevantTechniques:
  - T1204
  - T1036
query: | 
  CyberArkEPM
  | where EventSubType != 'AttackAttempt'
  | where ActingProcessName has @'\'
  | where ActingProcessName !endswith '.exe'
  | project EventEndTime, EventMessage, ActorUsername, ActingProcessFileInternalName
  | extend AccountCustomEntity = ActorUsername
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountCustomEntity
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

CyberArkEPM

Stage 2: `where`

| where EventSubType != 'AttackAttempt'

Stage 3: `where`

| where ActingProcessName has @'\'

Stage 4: `where`

| where ActingProcessName !endswith '.exe'

Stage 5: `project`

| project EventEndTime, EventMessage, ActorUsername, ActingProcessFileInternalName

Stage 6: `extend`

| extend AccountCustomEntity = ActorUsername

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`ActingProcessName`	ends_with	`.exe`	`excludes:ActingProcessName` `field:"ActingProcessName" value:".exe"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ActingProcessName`	match	`\` transforms: `term`	`field:"ParentImage" kind:match value:"\"`
`EventSubType`	ne	`AttackAttempt`	`field:"EventSubType" kind:ne value:"AttackAttempt"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`ActingProcessFileInternalName`	`project`
`ActorUsername`	`project`
`EventEndTime`	`project`
`EventMessage`	`project`
`AccountCustomEntity`	`extend`

CyberArkEPM - Unexpected executable extension

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: project

Stage 6: extend

Exclusions

Indicators

Output fields

Stage 1: `source`

Stage 2: `where`

Stage 3: `where`

Stage 4: `where`

Stage 5: `project`

Stage 6: `extend`