detection.wiki

Detection rules › Kusto

Rubrik Threat Monitoring

Status
available
Severity
medium
Time window
10m
Group by
count_, custom_details_objectId_g, eventname
Source
github.com/Azure/Azure-Sentinel

'Rubrik Threat Monitoring matches Event Name and if match found then generate the incident for each object.'

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1546 Event Triggered Execution

Rule body kusto

id: 0083cbc4-776e-42ca-8694-6950fd605df9
name: Rubrik Threat Monitoring
version: 1.0.0
kind: Scheduled
description: |
  'Rubrik Threat Monitoring matches Event Name and if match found then generate the incident for each object.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: RubrikSecurityCloudAzureFunctions
    dataTypes: 
      - RubrikEventsData
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics: 
  - Persistence
relevantTechniques:
  - T1546
query: |
       Rubrik_Events_Data_CL
       | where custom_details_eventName_s endswith "AnalysisMatchesFound" or custom_details_eventName_s contains "ThreatMonitoringHashCatalogAnalysisFailed" or custom_details_eventName_s contains "ThreatMonitoringHashMatchesFound" or custom_details_eventName_s contains "ThreatMonitoringYaraMatchesFound"
       | extend hashMatchCount = toint(extract("Found ([0-9]+) hash matches",1, summary_s)),    yaraMatchCount = toint(extract("Found ([0-9]+) YARA rule matches", 1, summary_s)),    fileHashMatchCount = toint(extract("Found file hash matches for ([0-9]+) files", 1, summary_s))
       | extend count_ = coalesce(hashMatchCount,yaraMatchCount, fileHashMatchCount), eventname = substring(custom_details_eventName_s,16, strlen(custom_details_eventName_s) - 28)
       | where count_ > 0
       | summarize arg_max(TimeGenerated,*) by eventname, custom_details_objectId_g, count_
incidentConfiguration:
      createIncident: true
      groupingConfiguration:
        enabled: true
        reopenClosedIncident: false
        lookbackDuration: P7D
        matchingMethod: Selected
        groupByCustomDetails:
        - ObjectName
        - ObjectId
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: ThreatMonitoring Found {{count_}} {{eventname}} Matches for {{custom_details_objectName_s}}
customDetails:
  EventName: custom_details_eventName_s
  Summary: summary_s
  ClusterIdentifier: custom_details_clusterId_g
  ObjectId: custom_details_objectId_g
  ObjectName: custom_details_objectName_s
  ObjectType: custom_details_objectType_s
  Url: custom_details_url_s

Stages and Predicates

Stage 1: source

Rubrik_Events_Data_CL

Stage 2: where

| where custom_details_eventName_s endswith "AnalysisMatchesFound" or custom_details_eventName_s contains "ThreatMonitoringHashCatalogAnalysisFailed" or custom_details_eventName_s contains "ThreatMonitoringHashMatchesFound" or custom_details_eventName_s contains "ThreatMonitoringYaraMatchesFound"

Stage 3: extend

| extend hashMatchCount = toint(extract("Found ([0-9]+) hash matches",1, summary_s)),    yaraMatchCount = toint(extract("Found ([0-9]+) YARA rule matches", 1, summary_s)),    fileHashMatchCount = toint(extract("Found file hash matches for ([0-9]+) files", 1, summary_s))

Stage 4: extend

| extend count_ = coalesce(hashMatchCount,yaraMatchCount, fileHashMatchCount), eventname = substring(custom_details_eventName_s,16, strlen(custom_details_eventName_s) - 28)

Stage 5: where

| where count_ > 0

Stage 6: summarize

| summarize arg_max(TimeGenerated,*) by eventname, custom_details_objectId_g, count_

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
count_gt
  • 0 transforms: cased
custom_details_eventName_scontains
  • ThreatMonitoringHashCatalogAnalysisFailed
  • ThreatMonitoringHashMatchesFound
  • ThreatMonitoringYaraMatchesFound
custom_details_eventName_sends_with
  • AnalysisMatchesFound

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
count_summarize
custom_details_objectId_gsummarize
eventnamesummarize