Votiro - File Blocked from Connector

Severity: low
Time window: 10m
Group by: FileWithConnectorDetails, LogSeverity, SrcFileSHA256, fileName, policyName, sanitizationResult
Source: github.com/Azure/Azure-Sentinel

'The analytic rule is intended to detect when a file is blocked by Votiro Sanitization Engine due to a specific policy, and notify the appropriate parties so that they can take appropriate action. The alert message will state that a file with a specific name and hash value was blocked by Votiro Sanatization Engine due to a specific policy name, and that more details can be found at a specific incident URL.'

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1036` Masquerading
Discovery	`T1057` Process Discovery `T1082` System Information Discovery `T1083` File and Directory Discovery
Impact	`T1498` Network Denial of Service `T1565` Data Manipulation
Impact	`T0837` Loss of Protection

Rule body

id: 17bf3780-ae0d-4cd9-a884-5df8b687f3f5
name: Votiro - File Blocked from Connector
description: |
 'The analytic rule is intended to detect when a file is blocked by Votiro Sanitization Engine due to a specific policy, and notify the appropriate parties so that they can take appropriate action. The alert message will state that a file with a specific name and hash value was blocked by Votiro Sanatization Engine due to a specific policy name, and that more details can be found at a specific incident URL.'
severity: Low
requiredDataConnectors:
  - connectorId: Votiro
    dataTypes:
      - CommonSecurityLog 
  - connectorId: CefAma
    dataTypes:
      - CommonSecurityLog
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - DefenseEvasion
  - Discovery
  - Impact
relevantTechniques:
  - T1036
  - T1083
  - T1057
  - T1082
  - T1565
  - T1498
  - T0837
query: let Votiro_view  = view () {
  VotiroEvents
  | where sanitizationResult has "Blocked" and passwordProtected == "false" and from =~ "null"
  | extend FileWithConnectorDetails = strcat_delim(' ', fileName, 'with the hash', SrcFileSHA256, 'that was sent from connector', connectorName)
  | summarize count() by fileName, SrcFileSHA256, FileWithConnectorDetails, policyName, tostring(incidentURL), sanitizationResult, LogSeverity
  | extend FileHashAlgo = "SHA256", FileHashValue = SrcFileSHA256};Votiro_view
entityMappings:
- entityType: FileHash
  fieldMappings:
    - identifier: Algorithm
      columnName: FileHashAlgo
    - identifier: Value
      columnName: FileHashValue
incidentConfiguration:
  createIncident: true
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride: 
   alertDisplayNameFormat: File with hash {{SrcFileSHA256}} was blocked
   alertDescriptionFormat: The {{FileWithConnectorDetails}} was blocked by Votiro due to Policy rules, see more detail in the following link {{incidentURL}}
   alertTacticsColumnName: sanitizationResult
   alertSeverityColumnName: LogSeverity
version: 1.0.1
kind: Scheduled

Stages and Predicates

Let binding: `Votiro_view`

let Votiro_view = view () { VotiroEvents | where sanitizationResult has "Blocked" and passwordProtected == "false" and from =~ "null" | extend FileWithConnectorDetails = strcat_delim(' ', fileName, 'with the hash', SrcFileSHA256, 'that was sent from connector', connectorName) | summarize count() by fileName, SrcFileSHA256, FileWithConnectorDetails, policyName, tostring(incidentURL), sanitizationResult, LogSeverity | extend FileHashAlgo = "SHA256", FileHashValue = SrcFileSHA256};

Stage 1: `source`

VotiroEvents

Stage 2: `where`

where from =~ "null" and passwordProtected =~ false and sanitizationResult contains "Blocked"

Stage 3: `extend`

extend FileWithConnectorDetails

Stage 4: `summarize`

summarize by fileName, SrcFileSHA256, FileWithConnectorDetails, policyName, sanitizationResult, LogSeverity

Stage 5: `extend`

extend FileHashAlgo, FileHashValue

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`from`	eq	`null`	`field:"from" kind:eq value:"null"`
`passwordProtected`	eq	`false`	`field:"passwordProtected" kind:eq value:"false"`
`sanitizationResult`	match	`Blocked` transforms: `term`	`field:"sanitizationResult" kind:match value:"Blocked"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`FileWithConnectorDetails`	`summarize`
`LogSeverity`	`summarize`
`SrcFileSHA256`	`summarize`
`fileName`	`summarize`
`policyName`	`summarize`
`sanitizationResult`	`summarize`
`FileHashAlgo`	`extend`
`FileHashValue`	`extend`

Votiro - File Blocked from Connector

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Let binding: Votiro_view

Stage 1: source

Stage 2: where

Stage 3: extend

Stage 4: summarize

Stage 5: extend