MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access |
Rule body
id: 9150ad68-51c8-11ec-bf63-0242ac130002
name: PaloAlto - File type changed
description: |
'Detects when file type changed.'
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: CefAma
dataTypes:
- CommonSecurityLog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
relevantTechniques:
- T1190
- T1133
query: |
PaloAltoCDLEvent
| where EventResourceId =~ 'THREAT'
| where EventResult =~ 'file'
| where FileType != OldFileType
| extend FileCustomEntity = SrcFileName, AccountCustomEntity = DstUsername
entityMappings:
- entityType: Account
fieldMappings:
- identifier: Name
columnName: AccountCustomEntity
- entityType: File
fieldMappings:
- identifier: Name
columnName: FileCustomEntity
version: 1.0.3
kind: Scheduled
Stages and Predicates
Stage 1: source
PaloAltoCDLEvent
Stage 2: where
| where EventResourceId =~ 'THREAT'
Stage 3: where
| where EventResult =~ 'file'
Stage 4: where
| where FileType != OldFileType
Stage 5: extend
| extend FileCustomEntity = SrcFileName, AccountCustomEntity = DstUsername
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventResourceId | eq |
| field:"EventResourceId" kind:eq value:"THREAT" |
EventResult | eq |
| field:"EventResult" kind:eq value:"file" |
FileType | cross_field_compare |
| field:"FileType" kind:cross_field_compare value:"OldFileType" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
AccountCustomEntity | extend |
FileCustomEntity | extend |