AV detections related to Zinc actors

Status: available
Severity: high
Time window: 1d
Group by: AlertSeverity, CompromisedEntity, Description, DeviceId, DeviceName, DisplayName, Entities, ProductName, PublicIP, TenantId, ThreatFamilyName, ThreatName
Source: github.com/Azure/Azure-Sentinel

This query looks for Microsoft Defender AV detections related to Zinc threat actor. In Microsoft Sentinel the SecurityAlerts table includes only the Device Name of the affected device, this query joins the DeviceInfo table to clearly connect other information such as Device group, ip, etc. This would allow the Microsoft Sentinel analyst to have more context related to the alert, if available. Reference: https://www.microsoft.com/security/blog/2022/09/29/zinc-weaponizing-open-source-software/

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1486` Data Encrypted for Impact

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`DeviceInfo` action `any`: Device information

Rule body

id: 3705158d-e008-49c9-92dd-e538e1549090
name: AV detections related to Zinc actors
description: |
  'This query looks for Microsoft Defender AV detections related to  Zinc threat actor. In Microsoft Sentinel the SecurityAlerts table includes only the Device Name of the affected device, this query joins the DeviceInfo table to clearly connect other information such as Device group, ip, etc. 
   This would allow the Microsoft Sentinel analyst to have more context related to the alert, if available.
   Reference: https://www.microsoft.com/security/blog/2022/09/29/zinc-weaponizing-open-source-software/'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - SecurityAlert
      - DeviceInfo
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Impact
relevantTechniques:
  - T1486
tags:
  -  Zinc
query: |
  let Zinc_threats = dynamic(["Trojan:Win32/ZetaNile.A", "Trojan:Win32/EventHorizon.A", "Trojan:Win32/FoggyBrass.A", "Trojan:Win32/FoggyBrass.B", "Trojan:Win32/PhantomStar.A","Trojan:Win32/PhantomStar.C","TrojanDropper:Win32/PhantomStar.A"]);
  DeviceInfo
  | extend DeviceName = tolower(DeviceName)
  | join kind=inner ( SecurityAlert
  | where ProviderName == "MDATP"
  | extend ThreatName = tostring(parse_json(ExtendedProperties).ThreatName)
  | extend ThreatFamilyName = tostring(parse_json(ExtendedProperties).ThreatFamilyName)
  | where ThreatName in~ (Zinc_threats) or ThreatFamilyName in~ (Zinc_threats)
  | extend CompromisedEntity = tolower(CompromisedEntity)
  ) on $left.DeviceName == $right.CompromisedEntity
  | summarize by DisplayName, ThreatName, ThreatFamilyName, PublicIP, AlertSeverity, Description, tostring(LoggedOnUsers), DeviceId, TenantId , bin(TimeGenerated, 1d), CompromisedEntity, tostring(LoggedOnUsers), ProductName, Entities
  | extend HostName = tostring(split(CompromisedEntity, '.', 0)[0]), DnsDomain = tostring(strcat_array(array_slice(split(CompromisedEntity, '.'), 1, -1), '.'))
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: HostName
      - identifier: DnsDomain
        columnName: DnsDomain
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: PublicIP
version: 1.0.2
kind: Scheduled

Stages and Predicates

Let binding: `Zinc_threats` used in Stage 3

let Zinc_threats = dynamic(["Trojan:Win32/ZetaNile.A", "Trojan:Win32/EventHorizon.A", "Trojan:Win32/FoggyBrass.A", "Trojan:Win32/FoggyBrass.B", "Trojan:Win32/PhantomStar.A","Trojan:Win32/PhantomStar.C","TrojanDropper:Win32/PhantomStar.A"]);

Stage 1: `source`

DeviceInfo

Stage 2: `extend`

| extend DeviceName = tolower(DeviceName)

Stage 3: `join`

| join kind=inner ( SecurityAlert
| where ProviderName == "MDATP"
| extend ThreatName = tostring(parse_json(ExtendedProperties).ThreatName)
| extend ThreatFamilyName = tostring(parse_json(ExtendedProperties).ThreatFamilyName)
| where ThreatName in~ (Zinc_threats) or ThreatFamilyName in~ (Zinc_threats)
| extend CompromisedEntity = tolower(CompromisedEntity)
) on $left.DeviceName == $right.CompromisedEntity

Stage 4: `summarize`

| summarize by DisplayName, ThreatName, ThreatFamilyName, PublicIP, AlertSeverity, Description, tostring(LoggedOnUsers), DeviceId, TenantId , bin(TimeGenerated, 1d), CompromisedEntity, tostring(LoggedOnUsers), ProductName, Entities

Stage 5: `extend`

| extend HostName = tostring(split(CompromisedEntity, '.', 0)[0]), DnsDomain = tostring(strcat_array(array_slice(split(CompromisedEntity, '.'), 1, -1), '.'))

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ProviderName`	eq	`MDATP`	`field:"ProviderName" kind:eq value:"MDATP"`
`ThreatFamilyName`	in	`Trojan:Win32/EventHorizon.A` `Trojan:Win32/FoggyBrass.A` `Trojan:Win32/FoggyBrass.B` `Trojan:Win32/PhantomStar.A` `Trojan:Win32/PhantomStar.C` `Trojan:Win32/ZetaNile.A` `TrojanDropper:Win32/PhantomStar.A`	`field:"ThreatFamilyName" kind:in`
`ThreatName`	in	`Trojan:Win32/EventHorizon.A` `Trojan:Win32/FoggyBrass.A` `Trojan:Win32/FoggyBrass.B` `Trojan:Win32/PhantomStar.A` `Trojan:Win32/PhantomStar.C` `Trojan:Win32/ZetaNile.A` `TrojanDropper:Win32/PhantomStar.A`	`field:"ThreatName" kind:in`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AlertSeverity`	`summarize`
`CompromisedEntity`	`summarize`
`Description`	`summarize`
`DeviceId`	`summarize`
`DisplayName`	`summarize`
`Entities`	`summarize`
`ProductName`	`summarize`
`PublicIP`	`summarize`
`TenantId`	`summarize`
`ThreatFamilyName`	`summarize`
`ThreatName`	`summarize`
`DnsDomain`	`extend`
`HostName`	`extend`

AV detections related to Zinc actors

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Let binding: Zinc_threats used in Stage 3

Stage 1: source

Stage 2: extend

Stage 3: join

Stage 4: summarize

Stage 5: extend