detection.wiki

Detection rules › Kusto

Radiflow - Suspicious Malicious Activity Detected

Status
available
Severity
high
Time window
1h
Source
github.com/Azure/Azure-Sentinel

'Generates an incident when malware is detected by Radiflow's iSID.'

MITRE ATT&CK coverage

TacticTechniques
EvasionT0851 Rootkit
Inhibit Response FunctionT0851 Rootkit

Rule body kusto

id: ecac26b8-147d-478a-9d50-99be4bf14019
name: Radiflow - Suspicious Malicious Activity Detected
description: |
  'Generates an incident when malware is detected by Radiflow's iSID.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: RadiflowIsid
    dataTypes:
      - RadiflowEvent
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- DefenseEvasion
- InhibitResponseFunction
relevantTechniques:
- T0851
query: |
  RadiflowEvent
  | where DeviceProduct =~ 'iSID'
  | where EventClassID in (57, 58, 59, 60, 176, 178, 181)
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1h
    matchingMethod: AllEntities
    groupByEntities: []
    groupByAlertDetails: []
    groupByCustomDetails: []
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: 'Suspicious Malicious Activity Detected: {{EventMessage}}'
  alertDescriptionFormat: |-
    A possible malware has been detected in the network as specified in the details of the incident. Please verify the source of this activity.

    Message: {{EventMessage}}
    Source device: {{{SourceIP}} 
    Destination device (if any): {{DestinationIP}}
  alertSeverityColumnName: EventSeverity
  alertDynamicProperties: []
suppressionEnabled: false
suppressionDuration: 5h
customDetails:
  SourceMAC: SourceMACAddress
  SourceType: SourceType
  SourceVendor: SourceVendor
  SourceVLAN: SourceVLAN
  DestinationMAC: DestinationMACAddress
  DestinationType: DestinationType
  DestinationVendor: DestinationVendor
  Port: Port
  Protocol: Protocol
  SourceIP: SourceIP
  DestinationIP: DestinationIP
  SourceHostName: SourceHostName
  DestinationHostName: DestinationHostName
entityMappings:
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: SourceHostName
  - identifier: NetBiosName
    columnName: SourceHostName
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: DestinationHostName
  - identifier: NetBiosName
    columnName: DestinationHostName
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SourceIP
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: DestinationIP
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: source

RadiflowEvent

Stage 2: where

| where DeviceProduct =~ 'iSID'

Stage 3: where

| where EventClassID in (57, 58, 59, 60, 176, 178, 181)

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
DeviceProducteq
  • iSID
EventClassIDin
  • 176 transforms: cased
  • 178 transforms: cased
  • 181 transforms: cased
  • 57 transforms: cased
  • 58 transforms: cased
  • 59 transforms: cased
  • 60 transforms: cased