Vectra AI Detect - New Campaign Detected

Status: available
Severity: medium
Time window: 5m
Source: github.com/Azure/Azure-Sentinel

'Identifies when a new Campaign has been detected. This occurs when multiple Detections accross different Hosts are suspected to be part of the same Attack Campaign.'

MITRE ATT&CK coverage

Tactic	Techniques
Lateral Movement	`T1021` Remote Services
Command & Control	`T1071` Application Layer Protocol

Rule body

id: a34d0338-eda0-42b5-8b93-32aae0d7a501
name: Vectra AI Detect - New Campaign Detected
description: |
  'Identifies when a new Campaign has been detected.  This occurs when multiple Detections accross different Hosts are suspected to be part of the same Attack Campaign.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: CefAma
    dataTypes:
      - CommonSecurityLog
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - LateralMovement
  - CommandAndControl
relevantTechniques:
  - T1021
  - T1071
query: |
  CommonSecurityLog
  | where DeviceVendor == "Vectra Networks"
  | where DeviceProduct == "X Series"
  | where DeviceEventClassID contains "campaign"
  | where DeviceAction == "START"
  | extend reason = coalesce(
                            column_ifexists("Reason", ""), 
                            extract("reason=(.+?)($|;)", 1, AdditionalExtensions),
                            ""
                        )
  | project-rename vectra_URL = DeviceCustomString4
  | sort by TimeGenerated
entityMappings:
  - entityType: DNS
    fieldMappings:
      - identifier: DomainName
        columnName: Activity
alertDetailsOverride:
  alertDisplayNameFormat: Vectra AI - New Campaign Detected
  alertDescriptionFormat: |
    A new campaign named {{Activity}} has been detected (reason is {{reason}})
  alertDynamicProperties:
    - alertProperty: AlertLink
      value: vectra_URL
    - alertProperty: ProductName
      value: DeviceProduct
    - alertProperty: ProviderName
      value: DeviceVendor
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: true
    lookbackDuration: 7d
    matchingMethod: AllEntities
customDetails:
  CampaignName: Activity 
  CampaignReason: reason 
  CampaignSourceHost: SourceHostName
version: 1.2.3
kind: Scheduled

Stages and Predicates

Stage 1: `source`

CommonSecurityLog

Stage 2: `where`

| where DeviceVendor == "Vectra Networks"

Stage 3: `where`

| where DeviceProduct == "X Series"

Stage 4: `where`

| where DeviceEventClassID contains "campaign"

Stage 5: `where`

| where DeviceAction == "START"

Stage 6: `extend`

| extend reason = coalesce(
                          column_ifexists("Reason", ""), 
                          extract("reason=(.+?)($|;)", 1, AdditionalExtensions),
                          ""
                      )

Stage 7: `project-rename`

| project-rename vectra_URL = DeviceCustomString4

Stage 8: `sort`

| sort by TimeGenerated

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`DeviceAction`	eq	`START`	`field:"DeviceAction" kind:eq value:"START"`
`DeviceEventClassID`	contains	`campaign`	`field:"DeviceEventClassID" kind:contains value:"campaign"`
`DeviceProduct`	eq	`X Series`	`field:"DeviceProduct" kind:eq value:"X Series"`
`DeviceVendor`	eq	`Vectra Networks`	`field:"DeviceVendor" kind:eq value:"Vectra Networks"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`reason`	`extend`
`vectra_URL`	`project-rename`

Vectra AI Detect - New Campaign Detected

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: where

Stage 6: extend

Stage 7: project-rename

Stage 8: sort