Palo Alto Threat signatures from Unusual IP addresses

Status: available
Severity: medium
Time window: 7d
Group by: DeviceAction, DeviceProduct, DeviceVendor, SourceIP
Source: github.com/Azure/Azure-Sentinel

'Identifies Palo Alto Threat signatures from unusual IP addresses which are not historically seen. This detection is also leveraged and required for MDE and PAN Fusion scenario https://docs.microsoft.com/Azure/sentinel/fusion-scenario-reference#network-request-to-tor-anonymization-service-followed-by-anomalous-traffic-flagged-by-palo-alto-networks-firewall'

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1046` Network Service Discovery
Command & Control	`T1071.001` Application Layer Protocol: Web Protocols
Exfiltration	`T1030` Data Transfer Size Limits

Rule body

id: 89a86f70-615f-4a79-9621-6f68c50f365f
name: Palo Alto Threat signatures from Unusual IP addresses 
description: |
  'Identifies Palo Alto Threat signatures from unusual IP addresses which are not historically seen. 
  This detection is also leveraged and required for MDE and PAN Fusion scenario
  https://docs.microsoft.com/Azure/sentinel/fusion-scenario-reference#network-request-to-tor-anonymization-service-followed-by-anomalous-traffic-flagged-by-palo-alto-networks-firewall'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: CefAma
    dataTypes:
      - CommonSecurityLog
queryFrequency: 1h
queryPeriod: 7d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Discovery
  - Exfiltration
  - CommandAndControl
relevantTechniques:
  - T1046
  - T1030
  - T1071.001
tags:
  - Fusion
query: |
  let starttime = 7d;
  let endtime = 1d;
  let timeframe = 1h;
  let HistThreshold = 25; 
  let CurrThreshold = 10; 
  let HistoricalThreats = CommonSecurityLog
  | where isnotempty(SourceIP)
  | where TimeGenerated between (startofday(ago(starttime))..startofday(ago(endtime)))
  | where DeviceVendor =~ "Palo Alto Networks"
  | where Activity =~ "THREAT" and SimplifiedDeviceAction =~ "alert" 
  | where DeviceEventClassID in ('spyware', 'scan', 'file', 'vulnerability', 'flood', 'packet', 'virus','wildfire', 'wildfire-virus')
  | summarize TotalEvents = count(), ThreatTypes = make_set(DeviceEventClassID), DestinationIpList = make_set(DestinationIP), FirstSeen = min(TimeGenerated) , LastSeen = max(TimeGenerated) by SourceIP, DeviceAction, DeviceVendor;
  let CurrentHourThreats =  CommonSecurityLog
  | where isnotempty(SourceIP)
  | where TimeGenerated > ago(timeframe)
  | where DeviceVendor =~ "Palo Alto Networks"
  | where Activity =~ "THREAT" and SimplifiedDeviceAction =~ "alert" 
  | where DeviceEventClassID in ('spyware', 'scan', 'file', 'vulnerability', 'flood', 'packet', 'virus','wildfire', 'wildfire-virus')
  | summarize TotalEvents = count(), ThreatTypes = make_set(DeviceEventClassID), DestinationIpList = make_set(DestinationIP), FirstSeen = min(TimeGenerated) , LastSeen = max(TimeGenerated) by SourceIP, DeviceAction, DeviceProduct, DeviceVendor;
  CurrentHourThreats 
  | where TotalEvents < CurrThreshold
  | join kind = leftanti (HistoricalThreats 
  | where TotalEvents > HistThreshold) on SourceIP
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIP
version: 1.0.3
kind: Scheduled

Stages and Predicates

Parameters

let starttime = 7d;
let endtime = 1d;
let timeframe = 1h;
let HistThreshold = 25;
let CurrThreshold = 10;

let CurrentHourThreats is inlined into the numbered stages below.

Let binding: `HistoricalThreats` used in Stage 9

let HistoricalThreats = CommonSecurityLog
| where isnotempty(SourceIP)
| where TimeGenerated between (startofday(ago(starttime))..startofday(ago(endtime)))
| where DeviceVendor =~ "Palo Alto Networks"
| where Activity =~ "THREAT" and SimplifiedDeviceAction =~ "alert" 
| where DeviceEventClassID in ('spyware', 'scan', 'file', 'vulnerability', 'flood', 'packet', 'virus','wildfire', 'wildfire-virus')
| summarize TotalEvents = count(), ThreatTypes = make_set(DeviceEventClassID), DestinationIpList = make_set(DestinationIP), FirstSeen = min(TimeGenerated) , LastSeen = max(TimeGenerated) by SourceIP, DeviceAction, DeviceVendor;

Stages 1 to 7 define let CurrentHourThreats (the rule's main pipeline source); stages 8 to 9 run on it.

Stage 1: `source`

CommonSecurityLog

Stage 2: `where`

| where isnotempty(SourceIP)

Stage 3: `where`

| where TimeGenerated > ago(timeframe)

Stage 4: `where`

| where DeviceVendor =~ "Palo Alto Networks"

Stage 5: `where`

| where Activity =~ "THREAT" and SimplifiedDeviceAction =~ "alert"

Stage 6: `where`

| where DeviceEventClassID in ('spyware', 'scan', 'file', 'vulnerability', 'flood', 'packet', 'virus','wildfire', 'wildfire-virus')

Stage 7: `summarize`

| summarize TotalEvents = count(), ThreatTypes = make_set(DeviceEventClassID), DestinationIpList = make_set(DestinationIP), FirstSeen = min(TimeGenerated) , LastSeen = max(TimeGenerated) by SourceIP, DeviceAction, DeviceProduct, DeviceVendor

Stage 8: `where`

CurrentHourThreats
| where TotalEvents < CurrThreshold

Stage 9: `join` (negated)

| join kind = leftanti (HistoricalThreats 
| where TotalEvents > HistThreshold) on SourceIP

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Activity`	eq	`THREAT`	`excludes:Activity` `field:"Activity" value:"THREAT"`
`DeviceEventClassID`	in	`file`, `flood`, `packet`, `scan`, `spyware`, `virus`, `vulnerability`, `wildfire`, `wildfire-virus`	`excludes:DeviceEventClassID`
`DeviceVendor`	eq	`Palo Alto Networks`	`excludes:DeviceVendor` `field:"DeviceVendor" value:"Palo Alto Networks"`
`SimplifiedDeviceAction`	eq	`alert`	`excludes:SimplifiedDeviceAction` `field:"SimplifiedDeviceAction" value:"alert"`
`SourceIP`	is_not_null	(no value, null check)	`excludes:SourceIP`
`TotalEvents`	gt	`25`	`excludes:TotalEvents` `field:"TotalEvents" value:"25"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Activity`	eq	`THREAT`	`field:"Activity" kind:eq value:"THREAT"`
`DeviceEventClassID`	in	`file` `flood` `packet` `scan` `spyware` `virus` `vulnerability` `wildfire` `wildfire-virus`	`field:"DeviceEventClassID" kind:in`
`DeviceVendor`	eq	`Palo Alto Networks`	`field:"DeviceVendor" kind:eq value:"Palo Alto Networks"`
`SimplifiedDeviceAction`	eq	`alert`	`field:"SimplifiedDeviceAction" kind:eq value:"alert"`
`SourceIP`	is_not_null	(no value, null check)	`field:"SourceIP" kind:is_not_null`
`TotalEvents`	lt	`10`	`field:"TotalEvents" kind:lt value:"10"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`DestinationIpList`	`summarize`
`DeviceAction`	`summarize`
`DeviceProduct`	`summarize`
`DeviceVendor`	`summarize`
`FirstSeen`	`summarize`
`LastSeen`	`summarize`
`SourceIP`	`summarize`
`ThreatTypes`	`summarize`
`TotalEvents`	`summarize`

Palo Alto Threat signatures from Unusual IP addresses

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Let binding: HistoricalThreats used in Stage 9

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: where

Stage 6: where

Stage 7: summarize

Stage 8: where

Stage 9: join (negated)