detection.wiki

Detection rules › Kusto

Vectra Host's Behaviors

Status
available
Severity
informational
Time window
5m
Group by
Activity, source_entity
Source
github.com/Azure/Azure-Sentinel

'This analytic rule is looking for new attacker behaviors observed by the Vectra Platform. This rule is focused on host's detections.'

MITRE ATT&CK coverage

TacticTechniques
Credential Access
Discovery
Lateral Movement
Collection
Command & Control
Exfiltration
Impact

Rule body

id: 33e3b6da-2660-4cd7-9032-11be76db88d2
name: Vectra Host's Behaviors
description: |
  'This analytic rule is looking for new attacker behaviors observed by the Vectra Platform. This rule is focused on host's detections.'
severity: Informational
status: Available
requiredDataConnectors:
  - connectorId: CefAma
    dataTypes:
      - CommonSecurityLog
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
eventGroupingSettings:
  aggregationKind: AlertPerResult
tactics:
  - CredentialAccess
  - Discovery
  - LateralMovement
  - Collection
  - CommandAndControl
  - Exfiltration
  - Impact
relevantTechniques:
  - T1003
  - T1087
  - T1021
  - T1119
  - T1071
  - T1041
  - T1499
query: |
  CommonSecurityLog
  | where DeviceVendor == "Vectra Networks"
  | where DeviceProduct == "X Series"
  | where DeviceEventClassID != "campaigns"
      and DeviceEventClassID != "hsc"
      and DeviceEventClassID != "audit"
      and DeviceEventClassID != "health"
      and DeviceEventClassID != "asc"
  | extend Category = coalesce(
      column_ifexists("DeviceEventCategory", ""), 
      extract("cat=(.+?)(;|$)", 1, AdditionalExtensions), 
      ""
      )
  | project-rename threat_score = FlexNumber1
  | project-rename certainty_score = FlexNumber2
  | project-rename vectra_URL = DeviceCustomString4
  | project-rename detection_name = DeviceEventClassID
  | project-rename triaged = DeviceCustomString5
  | where triaged != "True" and AdditionalExtensions !has "account"
  | extend source_entity = case(isnotempty(SourceHostName), SourceHostName,
      "UNKNWON")
  | extend level = case(threat_score == 0 and certainty_score == 0, "Info",
      threat_score < 50 and certainty_score < 50, "Low",
      threat_score < 50 and certainty_score >= 50, "Medium", 
      threat_score >= 50 and certainty_score <= 50, "High", 
      threat_score >= 50 and certainty_score >= 50, "Critical",
      "UNKNOWN")
  | extend Severity = case(level == "Info", "Informational",level == "Critical", "High", level)
  | summarize arg_max(threat_score, *) by source_entity, Activity
  | sort by TimeGenerated
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: SourceHostName
alertDetailsOverride:
  alertDisplayNameFormat: Vectra AI - {{Activity}} Detected
  alertDescriptionFormat: |
    Entity is a host. Category is {{Category}}. Threat score is {{threat_score}} and certainty score is {{certainty_score}}.
  alertSeverityColumnName: Severity
  alertDynamicProperties:
    - alertProperty: AlertLink
      value: vectra_URL
    - alertProperty: ProductName
      value: DeviceProduct
    - alertProperty: ProviderName
      value: DeviceVendor
    - alertProperty: ConfidenceScore
      value: certainty_score
customDetails:
  AttackType: Activity
  AttackCategory: Category
version: 1.0.5
kind: Scheduled

Stages and Predicates

Stage 1: source

CommonSecurityLog

Stage 2: where

| where DeviceVendor == "Vectra Networks"

Stage 3: where

| where DeviceProduct == "X Series"

Stage 4: where

| where DeviceEventClassID != "campaigns"
    and DeviceEventClassID != "hsc"
    and DeviceEventClassID != "audit"
    and DeviceEventClassID != "health"
    and DeviceEventClassID != "asc"

Stage 5: extend

| extend Category = coalesce(
    column_ifexists("DeviceEventCategory", ""), 
    extract("cat=(.+?)(;|$)", 1, AdditionalExtensions), 
    ""
    )

Stage 6: project-rename

| project-rename threat_score = FlexNumber1

Stage 7: project-rename

| project-rename certainty_score = FlexNumber2

Stage 8: project-rename

| project-rename vectra_URL = DeviceCustomString4

Stage 9: project-rename

| project-rename detection_name = DeviceEventClassID

Stage 10: project-rename

| project-rename triaged = DeviceCustomString5

Stage 11: where

| where triaged != "True" and AdditionalExtensions !has "account"

Stage 12: extend (3 consecutive steps)

| extend source_entity = case(isnotempty(SourceHostName), SourceHostName,
    "UNKNWON")
| extend level = case(threat_score == 0 and certainty_score == 0, "Info",
    threat_score < 50 and certainty_score < 50, "Low",
    threat_score < 50 and certainty_score >= 50, "Medium", 
    threat_score >= 50 and certainty_score <= 50, "High", 
    threat_score >= 50 and certainty_score >= 50, "Critical",
    "UNKNOWN")
| extend Severity = case(level == "Info", "Informational",level == "Critical", "High", level)
source_entity =
ifisnotempty(SourceHostName)SourceHostName
else"UNKNWON"

Stage 13: summarize

| summarize arg_max(threat_score, *) by source_entity, Activity

Stage 14: sort

| sort by TimeGenerated

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
AdditionalExtensionsmatchaccountexcludes:AdditionalExtensions field:"AdditionalExtensions" value:"account"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
DeviceEventClassIDne
  • asc
  • audit
  • campaigns
  • health
  • hsc
field:"DeviceEventClassID" kind:ne
DeviceProducteq
  • X Series
field:"DeviceProduct" kind:eq value:"X Series"
DeviceVendoreq
  • Vectra Networks
field:"DeviceVendor" kind:eq value:"Vectra Networks"
triagedne
  • True
field:"triaged" kind:ne value:"True"

Output fields

These fields are emitted when the rule matches.

FieldSource
Activitysummarize
source_entitysummarize