Detection rules › Kusto

Server Oriented Cmdlet And User Oriented Cmdlet used

Status
available
Severity
high
Time window
1d
Group by
Caller, Computer
Source
github.com/Azure/Azure-Sentinel

'Detect if a server oriented cmdlet and a user oriented cmdlet that are monitored are launched by the same user in the same server within a 10 minutes timeframe'

MITRE ATT&CK coverage

Rule body

id: 7bce901b-9bc8-4948-8dfc-8f68878092d5
name: Server Oriented Cmdlet And User Oriented Cmdlet used
description: |
  'Detect if a server oriented cmdlet and a user oriented cmdlet that are monitored are launched by the same user in the same server within a 10 minutes timeframe'
requiredDataConnectors:
  - connectorId: ESI-ExchangeAdminAuditLogEvents
    dataTypes:
      - Event
severity: High
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
status: Available
tactics:
  - Exfiltration
  - Persistence
  - Collection
relevantTechniques:
  - T1020
  - T1098
  - T1114
query: |
  let timeframe = 1d;
  let spanoftime = 10m;
  let threshold = 0;
  ExchangeAdminAuditLogs 
    | where TimeGenerated > ago(2 * timeframe)
    | where isempty(UserOriented)
    | project serverExecutedTime = TimeGenerated,
      ServerCmdlet = CmdletName,
      ServerCmdletParams = CmdletParameters,
      Computer,
      Caller,
      ServerCmdletTargetObject = TargetObject
    | join kind= inner (
        ExchangeAdminAuditLogs
        | where TimeGenerated > ago(timeframe)
        | where UserOriented =~ 'Yes'
        | project userExecutedTime = TimeGenerated,
          UserCmdlet = CmdletName,
          UserCmdletParams = CmdletParameters,
          Computer,
          Caller,
          UserCmdletTargetObject = TargetObject,
          userPrincipalName,
          objectGUID,
          sAMAccountName,
          IsVIP)
      on Computer, Caller
    | where userExecutedTime - serverExecutedTime < spanoftime
    | extend TimeDelta = userExecutedTime - serverExecutedTime
    | extend TimeDeltaInverse = serverExecutedTime - userExecutedTime
    | where tolong(TimeDelta) >= threshold or tolong(TimeDeltaInverse) >= threshold
entityMappings:
- entityType: Mailbox
  fieldMappings:
    - identifier: MailboxPrimaryAddress
      columnName: userPrincipalName
    - identifier: Upn
      columnName: userPrincipalName
- entityType: Host
  fieldMappings:
    - identifier: FullName
      columnName: Computer
- entityType: Host
  fieldMappings:
    - identifier: HostName
      columnName: ServerCmdletTargetObject
- entityType: Account
  fieldMappings:
    - identifier: Name
      columnName: Caller
    - identifier: ObjectGuid
      columnName: objectGUID
version: 1.2.0
kind: Scheduled

Stages and Predicates

Parameters

let timeframe = 1d;
let spanoftime = 10m;
let threshold = 0;

Stage 1: source

ExchangeAdminAuditLogs

Stage 2: where

| where TimeGenerated > ago(2 * timeframe)

Stage 3: where

| where isempty(UserOriented)

Stage 4: project

| project serverExecutedTime = TimeGenerated,
    ServerCmdlet = CmdletName,
    ServerCmdletParams = CmdletParameters,
    Computer,
    Caller,
    ServerCmdletTargetObject = TargetObject

Stage 5: join

| join kind= inner (
      ExchangeAdminAuditLogs
      | where TimeGenerated > ago(timeframe)
      | where UserOriented =~ 'Yes'
      | project userExecutedTime = TimeGenerated,
        UserCmdlet = CmdletName,
        UserCmdletParams = CmdletParameters,
        Computer,
        Caller,
        UserCmdletTargetObject = TargetObject,
        userPrincipalName,
        objectGUID,
        sAMAccountName,
        IsVIP)
    on Computer, Caller

Stage 6: where userExecutedTime - serverExecutedTime < 10m

| where userExecutedTime - serverExecutedTime < spanoftime

Stage 7: extend

| extend TimeDelta = userExecutedTime - serverExecutedTime

Stage 8: extend

| extend TimeDeltaInverse = serverExecutedTime - userExecutedTime

Stage 9: where

| where tolong(TimeDelta) >= threshold or tolong(TimeDeltaInverse) >= threshold

Indicators

These rows show field, operator, and value matches.

Output fields

These fields are emitted when the rule matches.

FieldSource
Callerproject
Computerproject
ServerCmdletproject
ServerCmdletParamsproject
ServerCmdletTargetObjectproject
serverExecutedTimeproject
TimeDeltaextend
TimeDeltaInverseextend