Detection rules › Kusto
McAfee ePO - Multiple threats on same host
'Rule fires when multiple threat events were detected on the same host.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | |
| Persistence | |
| Privilege Escalation | |
| Stealth | |
| Defense Impairment |
Rule body
id: f53e5168-afdb-4fad-b29a-bb9cb71ec460
name: McAfee ePO - Multiple threats on same host
description: |
'Rule fires when multiple threat events were detected on the same host.'
severity: Medium
requiredDataConnectors:
- connectorId: SyslogAma
datatypes:
- Syslog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
status: Available
tactics:
- InitialAccess
- Persistence
- DefenseEvasion
- PrivilegeEscalation
relevantTechniques:
- T1562
- T1070
- T1189
- T1195
- T1543
- T1055
query: |
McAfeeEPOEvent
| where isnotempty(ThreatName)
| where ThreatName != '_'
| summarize th_cnt = dcount(ThreatName), th_list = makeset(ThreatName) by DvcIpAddr
| where th_cnt > 1
| extend IPCustomEntity = DvcIpAddr
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: IPCustomEntity
version: 1.0.2
kind: Scheduled
Stages and Predicates
Stage 1: source
McAfeeEPOEvent
Stage 2: where
| where isnotempty(ThreatName)
Stage 3: where
| where ThreatName != '_'
Stage 4: summarize
| summarize th_cnt = dcount(ThreatName), th_list = makeset(ThreatName) by DvcIpAddr
Stage 5: where
| where th_cnt > 1
Stage 6: extend
| extend IPCustomEntity = DvcIpAddr
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ThreatName | is_not_null | field:"ThreatName" kind:is_not_null | |
ThreatName | ne |
| field:"ThreatName" kind:ne value:"_" |
th_cnt | gt |
| field:"th_cnt" kind:gt value:"1" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
DvcIpAddr | summarize |
th_cnt | summarize |
th_list | summarize |
IPCustomEntity | extend |