Quokka - Malicious Results Detected

Status: available
Severity: medium
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

'Detects if there are any malicious results in the app events coming from organization devices.'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1474` Supply Chain Compromise
Execution	`T1623` Command and Scripting Interpreter
Persistence	`T1541` Foreground Persistence `T1624` Event Triggered Execution `T1625` Hijack Execution Flow
Privilege Escalation	`T1631` Process Injection
Defense Evasion	`T1406` Obfuscated Files or Information `T1516` Input Injection `T1541` Foreground Persistence `T1617` Hooking `T1627` Execution Guardrails `T1628` Hide Artifacts `T1629` Impair Defenses `T1630` Indicator Removal on Host `T1631` Process Injection `T1633` Virtualization/Sandbox Evasion
Credential Access	`T1414` Clipboard Data `T1417` Input Capture `T1517` Access Notifications `T1634` Credentials from Password Store `T1635` Steal Application Access Token
Discovery	`T1418` Software Discovery `T1422` System Network Configuration Discovery `T1424` Process Discovery `T1430` Location Tracking
Collection	`T1409` Stored Application Data `T1414` Clipboard Data `T1417` Input Capture `T1429` Audio Capture `T1430` Location Tracking `T1512` Video Capture `T1513` Screen Capture `T1517` Access Notifications `T1532` Archive Collected Data `T1616` Call Control `T1636` Protected User Data `T1638` Adversary-in-the-Middle
Command and Control	`T1481` Web Service `T1509` Non-Standard Port `T1544` Ingress Tool Transfer `T1616` Call Control
Impact	`T1471` Data Encrypted for Impact `T1516` Input Injection `T1582` SMS Control `T1616` Call Control `T1640` Account Access Removal `T1641` Data Manipulation `T1642` Endpoint Denial of Service `T1643` Generate Traffic from Victim

Rule body

id: 97ad71ed-e4c0-4f7a-b1a2-683108bece4f
name: Quokka - Malicious Results Detected
description: |
  'Detects if there are any malicious results in the app events coming from organization devices.'
severity: Medium
status : Available
requiredDataConnectors:
  - connectorId: QscoutAppEventsCCFDefinition
    dataTypes:
      - QscoutAppEvents_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - Execution
  - Persistence
  - PrivilegeEscalation
  - DefenseEvasion
  - CredentialAccess
  - Discovery
  - Collection
  - CommandAndControl
  - Impact
relevantTechniques:
  - T1406
  - T1409
  - T1414
  - T1417
  - T1418
  - T1422
  - T1424
  - T1429
  - T1430
  - T1471
  - T1474
  - T1481
  - T1509
  - T1512
  - T1513
  - T1516
  - T1517
  - T1532
  - T1541
  - T1544
  - T1582
  - T1616
  - T1617
  - T1623
  - T1624
  - T1625
  - T1627
  - T1628
  - T1629
  - T1630
  - T1631
  - T1633
  - T1634
  - T1635
  - T1636
  - T1638
  - T1640
  - T1641
  - T1642
  - T1643
query: |
  let timeRange = 1h;
  let appEventsWithMaliciousResults = QscoutAppEvents_CL
  | extend AccountCustomEntity = tostring(org_id)
  | where TimeGenerated >= ago(timeRange)
  | where result_type == 'maliciousness'
  | where isnotempty(results.entries);
  appEventsWithMaliciousResults
  | mv-expand entry = results.entries
  | project
      TimeGenerated,
      AccountCustomEntity,
      app_id,
      mdm_source,
      mdm_device_id,
      package,
      platform,
      version,
      rule_id = tostring(entry.ruleId),
      desription = tostring(entry.description),
      threat_level = toint(entry.threatLevel),
      threat_types = tostring(entry.threatTypes)
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountCustomEntity
version: 1.0.0
kind: Scheduled

Stages and Predicates

Parameters

let timeRange = 1h;

let appEventsWithMaliciousResults is inlined into the numbered stages below.

Stages 1 to 5 define let appEventsWithMaliciousResults (the rule's main pipeline source); stages 6 to 7 run on it.

Stage 1: `source`

QscoutAppEvents_CL

Stage 2: `extend`

| extend AccountCustomEntity = tostring(org_id)

Stage 3: `where`

| where TimeGenerated >= ago(timeRange)

Stage 4: `where`

| where result_type == 'maliciousness'

Stage 5: `where`

| where isnotempty(results.entries)

Stage 6: `mv-expand`

appEventsWithMaliciousResults
| mv-expand entry = results.entries

Stage 7: `project`

| project
    TimeGenerated,
    AccountCustomEntity,
    app_id,
    mdm_source,
    mdm_device_id,
    package,
    platform,
    version,
    rule_id = tostring(entry.ruleId),
    desription = tostring(entry.description),
    threat_level = toint(entry.threatLevel),
    threat_types = tostring(entry.threatTypes)

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`entries`	is_not_null	(no value, null check)	`field:"entries" kind:is_not_null`
`result_type`	eq	`maliciousness`	`field:"result_type" kind:eq value:"maliciousness"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AccountCustomEntity`	`project`
`TimeGenerated`	`project`
`app_id`	`project`
`desription`	`project`
`mdm_device_id`	`project`
`mdm_source`	`project`
`package`	`project`
`platform`	`project`
`rule_id`	`project`
`threat_level`	`project`
`threat_types`	`project`
`version`	`project`

Quokka - Malicious Results Detected

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Stage 1: source

Stage 2: extend

Stage 3: where

Stage 4: where

Stage 5: where

Stage 6: mv-expand

Stage 7: project