Detection rules › Kusto

VMware ESXi - Low temp directory space

Status
available
Severity
medium
Time window
1h
Source
github.com/Azure/Azure-Sentinel

'This rule is triggered when temp directory space is detected.'

MITRE ATT&CK coverage

TacticTechniques
ImpactT1529 System Shutdown/Reboot

Rule body kusto

id: 2ee727f7-b7c2-4034-b6c9-d245d5a29343
name: VMware ESXi - Low temp directory space
description: |
  'This rule is triggered when temp directory space is detected.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: SyslogAma
    datatypes:
      - Syslog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Impact
relevantTechniques:
  - T1529
query: |
  let threshold = 10;
  VMwareESXi
  | where SyslogMessage has_all ('Temp directory', 'free space')
  | extend sp = toreal(extract(@'free space is:\s(\d+)', 1, SyslogMessage)) / 1000000000
  | where sp < threshold
  | extend h = 'Hypervisor'
  | extend HostCustomEntity = h
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: HostCustomEntity
version: 1.0.2
kind: Scheduled

Stages and Predicates

Parameters

let threshold = 10;

Stage 1: source

VMwareESXi

Stage 2: where

| where SyslogMessage has_all ('Temp directory', 'free space')

Stage 3: extend

| extend sp = toreal(extract(@'free space is:\s(\d+)', 1, SyslogMessage)) / 1000000000

Stage 4: where

| where sp < threshold

Stage 5: extend

| extend h = 'Hypervisor'

Stage 6: extend

| extend HostCustomEntity = h

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
SyslogMessagematch
  • Temp directory
  • free space
splt
  • 10 transforms: cased

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
spextend
hextend
HostCustomEntityextend