Ransomware Client Blocked

Status: available
Severity: high
Time window: 5m
Source: github.com/Azure/Azure-Sentinel

Identifies malicious clients blocked by the Ransomware Protection service running on a Nasuni Edge Appliance.

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1486` Data Encrypted for Impact

Rule body

id: 0c96a5a2-d60d-427d-8399-8df7fe8e6536
name: Ransomware Client Blocked
description: 'Identifies malicious clients blocked by the Ransomware Protection service running on a Nasuni Edge Appliance.'
kind: Scheduled
severity: High
requiredDataConnectors:
  - connectorId: SyslogAma
    datatypes:
      - Syslog
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
status: Available
tactics:
- Impact
relevantTechniques:
- T1486
query: |-
  Syslog
  | project TimeGenerated, Computer, SyslogMessage
  | where SyslogMessage has "The Filer has enforced the mitigation policy on volume"
  | extend SrcIpAddr = substring(SyslogMessage, indexof(SyslogMessage, "(")+1, indexof(SyslogMessage, ")") - indexof(SyslogMessage,"(")-1)
  | extend volume_name = substring(SyslogMessage, indexof(SyslogMessage, "volume")+7, indexof(SyslogMessage,"and") - (indexof(SyslogMessage, "volume")+7))
  | sort by TimeGenerated desc
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertnameFormat: 'Nasuni: Ransomware Client Blocked'
  alertDescriptionFormat: Nasuni has blocked a client involved in a ransomware attack from accessing a Nasuni Edge Appliance at {{TimeGenerated}}
customDetails:
  VolumeName: volume_name
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SrcIpAddr
suppressionDuration: 5h
suppressionEnabled: false
version: 1.0.3

Stages and Predicates

Stage 1: `source`

Syslog

Stage 2: `project`

| project TimeGenerated, Computer, SyslogMessage

Stage 3: `where`

| where SyslogMessage has "The Filer has enforced the mitigation policy on volume"

Stage 4: `extend`

| extend SrcIpAddr = substring(SyslogMessage, indexof(SyslogMessage, "(")+1, indexof(SyslogMessage, ")") - indexof(SyslogMessage,"(")-1)

Stage 5: `extend`

| extend volume_name = substring(SyslogMessage, indexof(SyslogMessage, "volume")+7, indexof(SyslogMessage,"and") - (indexof(SyslogMessage, "volume")+7))

Stage 6: `sort`

| sort by TimeGenerated desc

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`SyslogMessage`	match	`The Filer has enforced the mitigation policy on volume` transforms: `term`	`field:"SyslogMessage" kind:match value:"The Filer has enforced the mitigation policy on volume"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Computer`	`project`
`SyslogMessage`	`project`
`TimeGenerated`	`project`
`SrcIpAddr`	`extend`
`volume_name`	`extend`

Ransomware Client Blocked

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: project

Stage 3: where

Stage 4: extend

Stage 5: extend

Stage 6: sort