Antivirus Detected an Infected File

Status: available
Severity: high
Source: github.com/Azure/Azure-Sentinel

Monitors CTERA platform to detect files infected with viruses identified by the antivirus engine on Edge Filers.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1203` Exploitation for Client Execution

Rule body

id: 4f767afa-d666-4ed4-b453-a4f5ad35181b
name: Antivirus Detected an Infected File
description: 'Monitors CTERA platform to detect files infected with viruses identified by the antivirus engine on Edge Filers.'
severity: High
status: Available
kind: NRT
requiredDataConnectors:
  - connectorId: CTERA
    dataTypes:
      - Syslog
tactics:
  - Impact
relevantTechniques:
  - T1203
query: |
    Syslog
    | where SyslogMessage contains "found an infected file"
    | extend 
        EdgeFiler = extract("Edge filer (\\w+)", 1, SyslogMessage),
        DetectionTime = extract("found an infected file at ([^ ]+)", 1, SyslogMessage),
        Portal = extract("from portal: (\\w+)", 1, SyslogMessage),
        FilePath = extract("The file path is: ([^\\.]+)", 1, SyslogMessage),
        Virus = extract("The virus is: ([^\\.]+)", 1, SyslogMessage)
    | project TimeGenerated, EdgeFiler, DetectionTime, Portal, FilePath, Virus
suppressionDuration: PT5H
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: SingleAlert
alertDetailsOverride:
  alertnameFormat: 'Antivirus Detected an Infected File'
  alertDescriptionFormat: Antivirus detected an infected file on {{EdgeFiler}} at {{DetectionTime}}.
customDetails:
  EdgeFiler: EdgeFiler
  Portal: Portal
  FilePath: FilePath
  Virus: Virus
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: EdgeFiler
version: 1.0.0

Stages and Predicates

Stage 1: `source`

Syslog

Stage 2: `where`

| where SyslogMessage contains "found an infected file"

Stage 3: `extend`

| extend 
    EdgeFiler = extract("Edge filer (\\w+)", 1, SyslogMessage),
    DetectionTime = extract("found an infected file at ([^ ]+)", 1, SyslogMessage),
    Portal = extract("from portal: (\\w+)", 1, SyslogMessage),
    FilePath = extract("The file path is: ([^\\.]+)", 1, SyslogMessage),
    Virus = extract("The virus is: ([^\\.]+)", 1, SyslogMessage)

Stage 4: `project`

| project TimeGenerated, EdgeFiler, DetectionTime, Portal, FilePath, Virus

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`SyslogMessage`	contains	`found an infected file`	`field:"SyslogMessage" kind:contains value:"found an infected file"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`DetectionTime`	`project`
`EdgeFiler`	`project`
`FilePath`	`project`
`Portal`	`project`
`TimeGenerated`	`project`
`Virus`	`project`