Detection rules › Kusto
Server Oriented Cmdlet And User Oriented Cmdlet used
'Detect if a server oriented cmdlet and a user oriented cmdlet that are monitored are launched by the same user in the same server within a 10 minutes timeframe'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | |
| Collection | |
| Exfiltration |
Rule body
id: 7bce901b-9bc8-4948-8dfc-8f68878092d5
name: Server Oriented Cmdlet And User Oriented Cmdlet used
description: |
'Detect if a server oriented cmdlet and a user oriented cmdlet that are monitored are launched by the same user in the same server within a 10 minutes timeframe'
requiredDataConnectors:
- connectorId: ESI-ExchangeAdminAuditLogEvents
dataTypes:
- Event
severity: High
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
status: Available
tactics:
- Exfiltration
- Persistence
- Collection
relevantTechniques:
- T1020
- T1098
- T1114
query: |
let timeframe = 1d;
let spanoftime = 10m;
let threshold = 0;
ExchangeAdminAuditLogs
| where TimeGenerated > ago(2 * timeframe)
| where isempty(UserOriented)
| project serverExecutedTime = TimeGenerated,
ServerCmdlet = CmdletName,
ServerCmdletParams = CmdletParameters,
Computer,
Caller,
ServerCmdletTargetObject = TargetObject
| join kind= inner (
ExchangeAdminAuditLogs
| where TimeGenerated > ago(timeframe)
| where UserOriented =~ 'Yes'
| project userExecutedTime = TimeGenerated,
UserCmdlet = CmdletName,
UserCmdletParams = CmdletParameters,
Computer,
Caller,
UserCmdletTargetObject = TargetObject,
userPrincipalName,
objectGUID,
sAMAccountName,
IsVIP)
on Computer, Caller
| where userExecutedTime - serverExecutedTime < spanoftime
| extend TimeDelta = userExecutedTime - serverExecutedTime
| extend TimeDeltaInverse = serverExecutedTime - userExecutedTime
| where tolong(TimeDelta) >= threshold or tolong(TimeDeltaInverse) >= threshold
entityMappings:
- entityType: Mailbox
fieldMappings:
- identifier: MailboxPrimaryAddress
columnName: userPrincipalName
- identifier: Upn
columnName: userPrincipalName
- entityType: Host
fieldMappings:
- identifier: FullName
columnName: Computer
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: ServerCmdletTargetObject
- entityType: Account
fieldMappings:
- identifier: Name
columnName: Caller
- identifier: ObjectGuid
columnName: objectGUID
version: 1.2.0
kind: Scheduled
Stages and Predicates
Parameters
let timeframe = 1d;
let spanoftime = 10m;
let threshold = 0;
Stage 1: source
ExchangeAdminAuditLogs
Stage 2: where
| where TimeGenerated > ago(2 * timeframe)
Stage 3: where
| where isempty(UserOriented)
Stage 4: project
| project serverExecutedTime = TimeGenerated,
ServerCmdlet = CmdletName,
ServerCmdletParams = CmdletParameters,
Computer,
Caller,
ServerCmdletTargetObject = TargetObject
Stage 5: join
| join kind= inner (
ExchangeAdminAuditLogs
| where TimeGenerated > ago(timeframe)
| where UserOriented =~ 'Yes'
| project userExecutedTime = TimeGenerated,
UserCmdlet = CmdletName,
UserCmdletParams = CmdletParameters,
Computer,
Caller,
UserCmdletTargetObject = TargetObject,
userPrincipalName,
objectGUID,
sAMAccountName,
IsVIP)
on Computer, Caller
Stage 6: where userExecutedTime - serverExecutedTime < 10m
| where userExecutedTime - serverExecutedTime < spanoftime
Stage 7: extend
| extend TimeDelta = userExecutedTime - serverExecutedTime
Stage 8: extend
| extend TimeDeltaInverse = serverExecutedTime - userExecutedTime
Stage 9: where
| where tolong(TimeDelta) >= threshold or tolong(TimeDeltaInverse) >= threshold
Indicators
These rows show field, operator, and value matches.
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
Caller | project |
Computer | project |
ServerCmdlet | project |
ServerCmdletParams | project |
ServerCmdletTargetObject | project |
serverExecutedTime | project |
TimeDelta | extend |
TimeDeltaInverse | extend |