detection.wiki

Detection rules › Kusto

Defender Alert Evidence

Status
available
Severity
high
Time window
1h
Source
github.com/Azure/Azure-Sentinel

This analytic rule is looking for new alert evidence from Microsoft Defender for Endpoint. The intent is to create entries in the SecurityAlert table for every new alert evidence attached to an entity of type Device or User monitored by Defender for Endpoint.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1546 Event Triggered Execution

Rule body kusto

id: 8138863e-e55f-4f02-ac94-72796e203d27
name: Defender Alert Evidence
version: 1.0.0
type: Microsoft.OperationalInsights/workspaces/providers/alertRules
kind: Scheduled
status: Available
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - AlertEvidence
severity: High
description: This analytic rule is looking for new alert evidence from Microsoft Defender for Endpoint. The intent is to create entries in the SecurityAlert table for every new alert evidence attached to an entity of type Device or User monitored by Defender for Endpoint.
tactics: 
  - Persistence
relevantTechniques:
  - T1546
query: |
  AlertEvidence
  | where EntityType in ("Device", "User")
queryFrequency: 60m
queryPeriod: 60m
triggerOperator: GreaterThan
triggerThreshold: 0
suppressionDuration: PT5H
suppressionEnabled: false
incidentConfiguration:
  createIncident: false
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountName
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: LocalIP
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: DeviceName

Stages and Predicates

Stage 1: source

AlertEvidence

Stage 2: where

| where EntityType in ("Device", "User")

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EntityTypein
  • Device transforms: cased
  • User transforms: cased