Excessive Blocked Traffic Events Generated by User

Status: available
Severity: medium
Time window: 1h
Group by: ApplicationName, LocalHostIpAddr, LocalPortNumber, RemoteHostIpAddr, RemotePortNumber, RuleName, ServerName, TrafficDirection, UserName
Source: github.com/Azure/Azure-Sentinel

'Creates an incident when a Symantec Endpoint Proection agent detects excessive amounts of blocked traffic generated by a single user.'

MITRE ATT&CK coverage

Tactic	Techniques
Lateral Movement	`T1021` Remote Services
Command & Control	`T1001` Data Obfuscation `T1132` Data Encoding
Exfiltration	`T1041` Exfiltration Over C2 Channel

Rule body

id: fa0ab69c-7124-4f62-acdd-61017cf6ce89
name: Excessive Blocked Traffic Events Generated by User
description: |
  'Creates an incident when a Symantec Endpoint Proection agent detects excessive amounts of blocked traffic generated by a single user.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: SyslogAma
    datatypes:
      - Syslog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Exfiltration
  - CommandAndControl
  - LateralMovement
relevantTechniques:
  - T1041
  - T1132
  - T1001
  - T1021
query: |
  let threshold = 15;
  let NoteableEvents = SymantecEndpointProtection
  | where LogType == "Agent Traffic Logs"
  | where Action =~ "Blocked"
  | summarize TotalBlockedEvents = count() by UserName
  | where TotalBlockedEvents > threshold;
  SymantecEndpointProtection
  | where LogType =~ "Agent Traffic Logs"
  | where Action =~ "Blocked"
  | join kind=inner (NoteableEvents) on UserName
  | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Total = count() by UserName, RuleName, ServerName, LocalHostIpAddr, LocalPortNumber, TrafficDirection, RemoteHostIpAddr, RemotePortNumber, ApplicationName
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: UserName
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: LocalHostIpAddr
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: RemoteHostIpAddr
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: ServerName
version: 1.0.3
kind: Scheduled

Stages and Predicates

Parameters

let threshold = 15;

Let binding: `NoteableEvents` used in Stage 4

let NoteableEvents = SymantecEndpointProtection
| where LogType == "Agent Traffic Logs"
| where Action =~ "Blocked"
| summarize TotalBlockedEvents = count() by UserName
| where TotalBlockedEvents > threshold;

Stage 1: `source`

SymantecEndpointProtection

Stage 2: `where`

| where LogType =~ "Agent Traffic Logs"

Stage 3: `where`

| where Action =~ "Blocked"

Stage 4: `join`

| join kind=inner (NoteableEvents) on UserName

Stage 5: `summarize`

| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Total = count() by UserName, RuleName, ServerName, LocalHostIpAddr, LocalPortNumber, TrafficDirection, RemoteHostIpAddr, RemotePortNumber, ApplicationName

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Action`	eq	`Blocked`	`field:"Action" kind:eq value:"Blocked"`
`LogType`	eq	`Agent Traffic Logs`	`field:"LogType" kind:eq value:"Agent Traffic Logs"`
`TotalBlockedEvents`	gt	`15`	`field:"TotalBlockedEvents" kind:gt value:"15"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`ApplicationName`	`summarize`
`EndTimeUtc`	`summarize`
`LocalHostIpAddr`	`summarize`
`LocalPortNumber`	`summarize`
`RemoteHostIpAddr`	`summarize`
`RemotePortNumber`	`summarize`
`RuleName`	`summarize`
`ServerName`	`summarize`
`StartTimeUtc`	`summarize`
`Total`	`summarize`
`TrafficDirection`	`summarize`
`UserName`	`summarize`

Excessive Blocked Traffic Events Generated by User

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Let binding: NoteableEvents used in Stage 4

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: join

Stage 5: summarize