Detection rules › Kusto
CyberArkEPM - Unexpected executable location
'Detects program run from unexpected location.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | |
| Stealth |
Rule body
id: c1fcbbd7-74f8-4f32-8116-0a533ebd3878
name: CyberArkEPM - Unexpected executable location
description: |
'Detects program run from unexpected location.'
severity: Medium
requiredDataConnectors:
- connectorId: CyberArkEPM
dataTypes:
- CyberArkEPM
queryFrequency: 30m
queryPeriod: 30m
triggerOperator: gt
triggerThreshold: 0
tactics:
- Execution
- DefenseEvasion
relevantTechniques:
- T1204
- T1036
query: |
let susp_exe_folders = dynamic([@'\tmp\', @'\TEMP\', @'/tmp/', @'\Users\Public\', @'\$Recycle.bin', @'\Windows\Fonts\', @'$']);
CyberArkEPM
| where EventSubType != 'AttackAttempt'
| where ActingProcessName has_any (susp_exe_folders)
| project EventEndTime, EventMessage, ActorUsername, ActingProcessFileInternalName
| extend AccountCustomEntity = ActorUsername
entityMappings:
- entityType: Account
fieldMappings:
- identifier: Name
columnName: AccountCustomEntity
version: 1.0.0
kind: Scheduled
Stages and Predicates
Parameters
let susp_exe_folders = dynamic([@'\tmp\', @'\TEMP\', @'/tmp/', @'\Users\Public\', @'\$Recycle.bin', @'\Windows\Fonts\', @'$']);
Stage 1: source
CyberArkEPM
Stage 2: where
| where EventSubType != 'AttackAttempt'
Stage 3: where
| where ActingProcessName has_any (susp_exe_folders)
Stage 4: project
| project EventEndTime, EventMessage, ActorUsername, ActingProcessFileInternalName
Stage 5: extend
| extend AccountCustomEntity = ActorUsername
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ActingProcessName | match |
| field:"ParentImage" kind:match |
EventSubType | ne |
| field:"EventSubType" kind:ne value:"AttackAttempt" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
ActingProcessFileInternalName | project |
ActorUsername | project |
EventEndTime | project |
EventMessage | project |
AccountCustomEntity | extend |