detection.wiki

Detection rules › Kusto

Zero Networks Segement - Machine Removed from protection

Status
available
Severity
high
Time window
5m
Source
github.com/Azure/Azure-Sentinel

'Detects when a machine is removed from protection.'

MITRE ATT&CK coverage

TacticTechniques
Defense Impairment

Rule body

id: a4ce12ca-d01d-460a-b15e-6c74ef328b82
name: Zero Networks Segement - Machine Removed from protection
description: |
  'Detects when a machine is removed from protection.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: ZeroNetworksSegmentAuditFunction
    dataTypes:
      - ZNSegmentAudit_CL
  - connectorId: ZeroNetworksSegmentAuditNativePoller
    dataTypes:
      - ZNSegmentAuditNativePoller_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1562
query: |
  ZNSegmentAudit
  | where AuditTypeId == 4
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: PerformedByName
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: DestinationEntityName
version: 1.0.1
kind: Scheduled

Stages and Predicates

Stage 1: source

ZNSegmentAudit

Stage 2: where

| where AuditTypeId == 4

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
AuditTypeIdeq
  • 4
field:"AuditTypeId" kind:eq value:"4"