detection.wiki

Detection rules › Kusto

VTI - High Severity SHA1 Collision Detection

Severity
high
Time window
1h
Group by
InitiatingProcessSHA1, Value
Source
github.com/Azure/Azure-Sentinel

This will alert when a collision is detected for DeviceFileEvents events with VTI high severity SHA1 IoCs

MITRE ATT&CK coverage

TacticTechniques
Execution

Telemetry coverage

PlatformRecord / event type
Microsoft Defender for EndpointDeviceFileEvents action any: File activity

Rule body

id: dbd9e28f-973d-47f3-a8c3-9e18da846870
name: VTI - High Severity SHA1 Collision Detection
version: 1.0.0
kind: Scheduled
description: |-
  This will alert when a collision is detected for DeviceFileEvents events with VTI high severity SHA1 IoCs
severity: High
requiredDataConnectors:
  - connectorId: VisaThreatIntelligence
    dataTypes:
      - VisaThreatIntelligenceIOC_CL
      - DeviceFileEvents
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- Execution
relevantTechniques:
- T1204
query: |-
  DeviceFileEvents
  | join kind=inner (VisaThreatIntelligenceIOC_CL  | where IOCType == "sha1" and SourceSeverity == "High")
  on $left.InitiatingProcessSHA1 == $right.Value
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1h
    matchingMethod: AllEntities
suppressionDuration: 1h
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: DeviceName
- entityType: FileHash
  fieldMappings:
  - identifier: Algorithm
    columnName: SHA1
  - identifier: Value
    columnName: InitiatingProcessSHA1

Stages and Predicates

Stage 1: source

DeviceFileEvents

Stage 2: join

| join kind=inner (VisaThreatIntelligenceIOC_CL  | where IOCType == "sha1" and SourceSeverity == "High")
on $left.InitiatingProcessSHA1 == $right.Value

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
IOCTypeeq
  • sha1
field:"IOCType" kind:eq value:"sha1"
SourceSeverityeq
  • High corpus 2 (kusto 2)
field:"SourceSeverity" kind:eq value:"High"