diff --git a/Solutions/Malware Protection Essentials/Data/Solution_MalwareProtectionEssentials.json b/Solutions/Malware Protection Essentials/Data/Solution_MalwareProtectionEssentials.json index 53e3c0b304f..377bf9f88e7 100644 --- a/Solutions/Malware Protection Essentials/Data/Solution_MalwareProtectionEssentials.json +++ b/Solutions/Malware Protection Essentials/Data/Solution_MalwareProtectionEssentials.json @@ -1,53 +1,62 @@ { - "Name": "Malware Protection Essentials", - "Author": "Microsoft - support@microsoft.com", - "Logo": "", - "Description": "Malware Protection Essentials is a [domain solution](https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fsentinel%2Fsentinel-solutions-catalog%23domain-solutions&data=05%7C01%7Ckavishbakshi%40microsoft.com%7Cbe2a496082b24caa4b8c08da9cefacca%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637994850502413731%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=OJegu%2B2EqD7rmYmK9pm9QniD6YWp5ooloZ6tHzcwVi0%3D&reserved=0) and does not include any data connectors. The content in this solution requires one of the product solutions below , as well as any other connector or data source normalized to the [ASIM](https://aka.ms/AboutASIM).\n\n**Prerequisite :-**\n\n Install one or more of the listed solutions, or develop your custom ASIM parsers to unlock the value provided by this solution.\n 1. Amazon Web Services \n 2. Azure Firewall \n 3. Azure Network Security Groups \n 4. Check Point \n 5. Cisco ASA \n 6. Cisco Meraki Security Events \n 7. Corelight \n 8. Fortinet FortiGate \n 9. Microsoft Defender for IoT \n 10. Microsoft Defender for Cloud \n 11. Microsoft Sysmon For Linux \n 12. Windows Firewall \n 13. Palo Alto PANOS \n 14. Vectra AI Stream \n 15. WatchGuard Firebox \n 16. Zscaler Internet Access \n\n**Underlying Microsoft Technologies used:** \n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs: \n 1. Product solutions as described above \n 2. Logic app for data summarization\n\n**Recommendation :-**\n\nIt is highly recommended to use the **Summarize data** logic app playbook provided with this solution as it will significantly improve the performance of the Workbook, Analytic rules & Hunting queries.", - "Analytic Rules": [ - "Analytic Rules/StartupRegistryModified.yaml", - "Analytic Rules/PrintProcessersModified.yaml", - "Analytic Rules/SuspiciousProcessCreation.yaml", - "Analytic Rules/BackupDeletionDetected.yaml", - "Analytic Rules/WindowsUpdateDisabled.yaml", - "Analytic Rules/WindowsAllowFirewallRuleAdded.yaml" - ], - "Hunting Queries": [ - "Hunting Queries/NewMaliciousScheduledTask.yaml", - "Hunting Queries/FileCretaedInStartupFolder.yaml", - "Hunting Queries/FilesWithRansomwareExtensions.yaml", - "Hunting Queries/NewScheduledTaskCreation.yaml", - "Hunting Queries/SystemFilesModifiedByUser.yaml", - "Hunting Queries/ExecutableInUncommonLocation.yaml" - ], - "Watchlists": [ - "Watchlists/RansomwareFileExtensions.json" - ], - "WatchlistDescription": "This watchlist contains a list of file extensions that are commonly used by ransomware. Add additional file extensions to this watchlist as required.", - "Workbooks": [ - "Workbooks/MalwareProtectionEssentialsWorkbook.json" - ], - "dependentDomainSolutionIds": [ - "azuresentinel.azure-sentinel-solution-amazonwebservices", - "sentinel4azurefirewall.sentinel4azurefirewall", - "azuresentinel.azure-sentinel-solution-networksecuritygroup", - "checkpoint.checkpoint-sentinel-solutions", - "azuresentinel.azure-sentinel-solution-ciscoasa", - "azuresentinel.azure-sentinel-solution-ciscomeraki", - "corelightinc1584998267292.corelight-for-azure-sentinel", - "Fortinet FortiGate Next-Generation Firewall connector for Microsoft Sentinel", - "azuresentinel.azure-sentinel-solution-unifiedmicrosoftsocforot", - "azuresentinel.azure-sentinel-solution-microsoftdefenderforcloud", - "azuresentinel.azure-sentinel-solution-sysmonforlinux", - "azuresentinel.azure-sentinel-solution-windowsfirewall", - "azuresentinel.azure-sentinel-solution-paloaltopanos", - "vectraaiinc.vectra_sentinel_solution", - "watchguard-technologies.watchguard_firebox_mss", - "zscaler1579058425289.zscaler_internet_access_mss" + "Name": "Malware Protection Essentials", + "Author": "Microsoft - support@microsoft.com", + "Logo": "", + "Description": "Malware Protection Essentials is a [domain solution](https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fsentinel%2Fsentinel-solutions-catalog%23domain-solutions&data=05%7C01%7Ckavishbakshi%40microsoft.com%7Cbe2a496082b24caa4b8c08da9cefacca%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637994850502413731%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=OJegu%2B2EqD7rmYmK9pm9QniD6YWp5ooloZ6tHzcwVi0%3D&reserved=0) and does not include any data connectors. The content in this solution requires one of the product solutions below , as well as any other connector or data source normalized to the [ASIM](https://aka.ms/AboutASIM).\n\n**Prerequisite :-**\n\n Install one or more of the listed solutions, or develop your custom ASIM parsers to unlock the value provided by this solution.\n 1. Amazon Web Services \n 2. Azure Firewall \n 3. Azure Network Security Groups \n 4. Check Point \n 5. Cisco ASA \n 6. Cisco Meraki Security Events \n 7. Corelight \n 8. Fortinet FortiGate \n 9. Microsoft Defender for IoT \n 10. Microsoft Defender for Cloud \n 11. Microsoft Sysmon For Linux \n 12. Windows Firewall \n 13. Palo Alto PANOS \n 14. Vectra AI Stream \n 15. WatchGuard Firebox \n 16. Zscaler Internet Access \n\n**Underlying Microsoft Technologies used:** \n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs: \n 1. Product solutions as described above \n 2. Logic app for data summarization\n\n**Recommendation :-**\n\nIt is highly recommended to use the **Summarize data** logic app playbook provided with this solution as it will significantly improve the performance of the Workbook, Analytic rules & Hunting queries.", + "Analytic Rules": [ + "Analytic Rules/StartupRegistryModified.yaml", + "Analytic Rules/PrintProcessersModified.yaml", + "Analytic Rules/SuspiciousProcessCreation.yaml", + "Analytic Rules/BackupDeletionDetected.yaml", + "Analytic Rules/WindowsUpdateDisabled.yaml", + "Analytic Rules/WindowsAllowFirewallRuleAdded.yaml" ], - "WorkbooksDescription": "This workbook provides details about Suspicious Malware Activities from File, Process and Registry events generated by EDR (Endpoint Detection and Response) solutions.", - "BasePath": "C:\\Github\\Azure-Sentinel\\Solutions\\Malware Protection Essentials\\", - "Version": "3.0.1", - "Metadata": "SolutionMetadata.json", - "TemplateSpec": true, - "Is1PConnector": false - } \ No newline at end of file + "Hunting Queries": [ + "Hunting Queries/NewMaliciousScheduledTask.yaml", + "Hunting Queries/FileCretaedInStartupFolder.yaml", + "Hunting Queries/FilesWithRansomwareExtensions.yaml", + "Hunting Queries/NewScheduledTaskCreation.yaml", + "Hunting Queries/SystemFilesModifiedByUser.yaml", + "Hunting Queries/ExecutableInUncommonLocation.yaml" + ], + "Watchlists": [ + "Watchlists/RansomwareFileExtensions.json" + ], + "WatchlistDescription": "This watchlist contains a list of file extensions that are commonly used by ransomware. Add additional file extensions to this watchlist as required.", + "Workbooks": [ + "Workbooks/MalwareProtectionEssentialsWorkbook.json" + ], + "dependentDomainSolutionIds": [ + "azuresentinel.azure-sentinel-solution-amazonwebservices", + "sentinel4azurefirewall.sentinel4azurefirewall", + "azuresentinel.azure-sentinel-solution-networksecuritygroup", + "checkpoint.checkpoint-sentinel-solutions", + "azuresentinel.azure-sentinel-solution-ciscoasa", + "azuresentinel.azure-sentinel-solution-ciscomeraki", + "corelightinc1584998267292.corelight-for-azure-sentinel", + "Fortinet FortiGate Next-Generation Firewall connector for Microsoft Sentinel", + "azuresentinel.azure-sentinel-solution-unifiedmicrosoftsocforot", + "azuresentinel.azure-sentinel-solution-microsoftdefenderforcloud", + "azuresentinel.azure-sentinel-solution-sysmonforlinux", + "azuresentinel.azure-sentinel-solution-windowsfirewall", + "azuresentinel.azure-sentinel-solution-paloaltopanos", + "vectraaiinc.vectra_sentinel_solution", + "watchguard-technologies.watchguard_firebox_mss", + "zscaler1579058425289.zscaler_internet_access_mss" + ], + "WorkbooksDescription": "This workbook provides details about Suspicious Malware Activities from File, Process and Registry events generated by EDR (Endpoint Detection and Response) solutions.", + "BasePath": "C:\\Github\\Azure-Sentinel\\Solutions\\Malware Protection Essentials\\", + "Metadata": "SolutionMetadata.json", + "TemplateSpec": true, + "Is1PConnector": false, + "XDR Workbooks": [], + "XDR Detections": [ + "XDR Detections/BackupDeletionDetected.yaml", + "XDR Detections/PrintProcessersModified.yaml", + "XDR Detections/StartupRegistryModified.yaml", + "XDR Detections/SuspiciousProcessCreation.yaml", + "XDR Detections/WindowsAllowFirewallRuleAdded.yaml", + "XDR Detections/WindowsUpdateDisabled.yaml" + ], + "Version": "3.2.2" +} diff --git a/Solutions/Malware Protection Essentials/Package/3.2.2.zip b/Solutions/Malware Protection Essentials/Package/3.2.2.zip new file mode 100644 index 00000000000..3455aa8a49c Binary files /dev/null and b/Solutions/Malware Protection Essentials/Package/3.2.2.zip differ diff --git a/Solutions/Malware Protection Essentials/Package/createUiDefinition.json b/Solutions/Malware Protection Essentials/Package/createUiDefinition.json index 19402047074..719887e5f3f 100644 --- a/Solutions/Malware Protection Essentials/Package/createUiDefinition.json +++ b/Solutions/Malware Protection Essentials/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Malware%20Protection%20Essentials/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nMalware Protection Essentials is a [domain solution](https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fsentinel%2Fsentinel-solutions-catalog%23domain-solutions&data=05%7C01%7Ckavishbakshi%40microsoft.com%7Cbe2a496082b24caa4b8c08da9cefacca%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637994850502413731%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=OJegu%2B2EqD7rmYmK9pm9QniD6YWp5ooloZ6tHzcwVi0%3D&reserved=0) and does not include any data connectors. The content in this solution requires one of the product solutions below , as well as any other connector or data source normalized to the [ASIM](https://aka.ms/AboutASIM).\n\n**Prerequisite :-**\n\n Install one or more of the listed solutions, or develop your custom ASIM parsers to unlock the value provided by this solution.\n 1. Amazon Web Services \n 2. Azure Firewall \n 3. Azure Network Security Groups \n 4. Check Point \n 5. Cisco ASA \n 6. Cisco Meraki Security Events \n 7. Corelight \n 8. Fortinet FortiGate \n 9. Microsoft Defender for IoT \n 10. Microsoft Defender for Cloud \n 11. Microsoft Sysmon For Linux \n 12. Windows Firewall \n 13. Palo Alto PANOS \n 14. Vectra AI Stream \n 15. WatchGuard Firebox \n 16. Zscaler Internet Access \n\n**Underlying Microsoft Technologies used:** \n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs: \n 1. Product solutions as described above \n 2. Logic app for data summarization\n\n**Recommendation :-**\n\nIt is highly recommended to use the **Summarize data** logic app playbook provided with this solution as it will significantly improve the performance of the Workbook, Analytic rules & Hunting queries.\n\n**Workbooks:** 1, **Analytic Rules:** 6, **Hunting Queries:** 6, **Watchlists:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Malware%20Protection%20Essentials/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nMalware Protection Essentials is a [domain solution](https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fsentinel%2Fsentinel-solutions-catalog%23domain-solutions&data=05%7C01%7Ckavishbakshi%40microsoft.com%7Cbe2a496082b24caa4b8c08da9cefacca%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637994850502413731%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=OJegu%2B2EqD7rmYmK9pm9QniD6YWp5ooloZ6tHzcwVi0%3D&reserved=0) and does not include any data connectors. The content in this solution requires one of the product solutions below , as well as any other connector or data source normalized to the [ASIM](https://aka.ms/AboutASIM).\n\n**Prerequisite :-**\n\n Install one or more of the listed solutions, or develop your custom ASIM parsers to unlock the value provided by this solution.\n 1. Amazon Web Services \n 2. Azure Firewall \n 3. Azure Network Security Groups \n 4. Check Point \n 5. Cisco ASA \n 6. Cisco Meraki Security Events \n 7. Corelight \n 8. Fortinet FortiGate \n 9. Microsoft Defender for IoT \n 10. Microsoft Defender for Cloud \n 11. Microsoft Sysmon For Linux \n 12. Windows Firewall \n 13. Palo Alto PANOS \n 14. Vectra AI Stream \n 15. WatchGuard Firebox \n 16. Zscaler Internet Access \n\n**Underlying Microsoft Technologies used:** \n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs: \n 1. Product solutions as described above \n 2. Logic app for data summarization\n\n**Recommendation :-**\n\nIt is highly recommended to use the **Summarize data** logic app playbook provided with this solution as it will significantly improve the performance of the Workbook, Analytic rules & Hunting queries.\n\n**Workbooks:** 1, **Analytic Rules:** 6, **XDR Detections:** 6, **Hunting Queries:** 6, **Watchlists:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -51,6 +51,47 @@ } ], "steps": [ + { + "name": "contentSelection", + "label": "Content selection", + "elements": [ + { + "name": "DeployAnalyticsRule", + "type": "Microsoft.Common.CheckBox", + "label": "DeployAnalyticsRule", + "defaultValue": true, + "toolTip": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." + }, + { + "name": "DeployWorkbook", + "type": "Microsoft.Common.CheckBox", + "label": "DeployWorkbook", + "defaultValue": true, + "toolTip": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." + }, + { + "name": "DeployCustomDetection", + "type": "Microsoft.Common.CheckBox", + "label": "DeployCustomDetection", + "defaultValue": false, + "toolTip": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." + }, + { + "name": "DeployHuntingQuery", + "type": "Microsoft.Common.CheckBox", + "label": "DeployHuntingQuery", + "defaultValue": true, + "toolTip": "Deploy the Microsoft Sentinel hunting queries carried by this solution." + }, + { + "name": "DeployWatchlist", + "type": "Microsoft.Common.CheckBox", + "label": "DeployWatchlist", + "defaultValue": true, + "toolTip": "Deploy the watchlists and their registrations carried by this solution." + } + ] + }, { "name": "workbooks", "label": "Workbooks", @@ -353,7 +394,12 @@ "outputs": { "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]", "location": "[location()]", - "workspace": "[basics('workspace')]" + "workspace": "[basics('workspace')]", + "DeployAnalyticsRule": "[steps('contentSelection').DeployAnalyticsRule]", + "DeployWorkbook": "[steps('contentSelection').DeployWorkbook]", + "DeployCustomDetection": "[steps('contentSelection').DeployCustomDetection]", + "DeployHuntingQuery": "[steps('contentSelection').DeployHuntingQuery]", + "DeployWatchlist": "[steps('contentSelection').DeployWatchlist]" } } } diff --git a/Solutions/Malware Protection Essentials/Package/mainTemplate.json b/Solutions/Malware Protection Essentials/Package/mainTemplate.json index 32235a2ac84..bb57bf3a99c 100644 --- a/Solutions/Malware Protection Essentials/Package/mainTemplate.json +++ b/Solutions/Malware Protection Essentials/Package/mainTemplate.json @@ -43,13 +43,48 @@ "metadata": { "description": "Name for the workbook" } + }, + "DeployAnalyticsRule": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." + } + }, + "DeployWorkbook": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." + } + }, + "DeployCustomDetection": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." + } + }, + "DeployHuntingQuery": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel hunting queries carried by this solution." + } + }, + "DeployWatchlist": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the watchlists and their registrations carried by this solution." + } } }, "variables": { "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "Malware Protection Essentials", - "_solutionVersion": "3.0.1", + "_solutionVersion": "3.2.2", "solutionId": "azuresentinel.azure-sentinel-solution-malwareprotection", "_solutionId": "[variables('solutionId')]", "analyticRuleObject1": { @@ -145,7 +180,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "StartupRegistryModified_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "StartupRegistryModified_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -352,7 +387,8 @@ "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -363,7 +399,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PrintProcessersModified_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "PrintProcessersModified_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -568,7 +604,8 @@ "contentProductId": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", "id": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -579,7 +616,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SuspiciousProcessCreation_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "SuspiciousProcessCreation_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -764,7 +801,8 @@ "contentProductId": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", "id": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -775,7 +813,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BackupDeletionDetected_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "BackupDeletionDetected_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", @@ -958,7 +996,8 @@ "contentProductId": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", "id": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -969,7 +1008,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "WindowsUpdateDisabled_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "WindowsUpdateDisabled_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", @@ -1173,7 +1212,8 @@ "contentProductId": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", "id": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", "version": "[variables('analyticRuleObject5').analyticRuleVersion5]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1184,7 +1224,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "WindowsAllowFirewallRuleAdded_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "WindowsAllowFirewallRuleAdded_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", @@ -1388,7 +1428,8 @@ "contentProductId": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", "id": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", "version": "[variables('analyticRuleObject6').analyticRuleVersion6]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1399,7 +1440,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NewMaliciousScheduledTask_HuntingQueries Hunting Query with template version 3.0.1", + "description": "NewMaliciousScheduledTask_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", @@ -1408,7 +1449,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "Malware_Protection_Essentials_Hunting_Query_1", "location": "[parameters('workspace-location')]", "properties": { @@ -1473,7 +1514,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1484,7 +1526,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileCretaedInStartupFolder_HuntingQueries Hunting Query with template version 3.0.1", + "description": "FileCretaedInStartupFolder_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]", @@ -1493,7 +1535,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "Malware_Protection_Essentials_Hunting_Query_2", "location": "[parameters('workspace-location')]", "properties": { @@ -1558,7 +1600,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1569,7 +1612,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FilesWithRansomwareExtensions_HuntingQueries Hunting Query with template version 3.0.1", + "description": "FilesWithRansomwareExtensions_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]", @@ -1578,7 +1621,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "Malware_Protection_Essentials_Hunting_Query_3", "location": "[parameters('workspace-location')]", "properties": { @@ -1643,7 +1686,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1654,7 +1698,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NewScheduledTaskCreation_HuntingQueries Hunting Query with template version 3.0.1", + "description": "NewScheduledTaskCreation_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]", @@ -1663,7 +1707,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "Malware_Protection_Essentials_Hunting_Query_4", "location": "[parameters('workspace-location')]", "properties": { @@ -1728,7 +1772,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1739,7 +1784,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SystemFilesModifiedByUser_HuntingQueries Hunting Query with template version 3.0.1", + "description": "SystemFilesModifiedByUser_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]", @@ -1748,7 +1793,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "Malware_Protection_Essentials_Hunting_Query_5", "location": "[parameters('workspace-location')]", "properties": { @@ -1813,7 +1858,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1824,7 +1870,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ExecutableInUncommonLocation_HuntingQueries Hunting Query with template version 3.0.1", + "description": "ExecutableInUncommonLocation_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject6').huntingQueryVersion6]", @@ -1833,7 +1879,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "Malware_Protection_Essentials_Hunting_Query_6", "location": "[parameters('workspace-location')]", "properties": { @@ -1898,7 +1944,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',parameters('watchlist1-id'))]", @@ -1916,7 +1963,8 @@ "itemsSearchKey": "FileExtension", "rawContent": "FileExtension,Description,Enabled\r\n_AiraCropEncrypted,AiraCrop Ransomware affecte file,Yes\r\n1cbu1,Princess Locker ransomware affected file,Yes\r\n1txt,Enigma ransomware affected file,Yes\r\n73i87A,Xorist Ransomware affected data,Yes\r\na5zfn,Alma Locker ransomware affected data,Yes\r\naaa,TeslaCrypt ransomware encrypted data,No\r\nabc,TeslaCrypt ransomware encrypted data,Yes\r\nadk,Angry Duck ransomware affected file,Yes\r\naesir,Locky ransomware affected file,Yes\r\nalcatraz,Alcatraz Locker ransomware affected file,Yes\r\nangelamerkel,Angela Merkel ransomware affected file,Yes\r\nAngleWare,HiddenTear/MafiaWare (variant) ransomware affected file,Yes\r\nantihacker2017,Xorist (variant) Ransomware affected file,Yes\r\natlas,Atlas ransomware affected file,Yes\r\naxx,AxCrypt encrypted data,Yes\r\nBarRax,BarRax (HiddenTear variant) ransomware affected file,Yes\r\nbin,Alpha/Alfa ransomware affected data,No\r\nbitstak,Bitstak ransomware affected data,Yes\r\nbraincrypt,Braincrypt ransomware affected file,Yes\r\nbreaking_bad,Files1147@gmail(.)com ransomware affected data,Yes\r\nbript,BadEncriptor ransomware affected file,Yes\r\nbtc,Jigsaw Ransomware affected data,Yes\r\nccc,TeslaCrypt or Cryptowall encrypted data,No\r\nCCCRRRPPP,Unlock92 ransomware affected data,Yes\r\ncerber,Cerber ransomware affected data,Yes\r\ncerber2,Cerber 2 ransomware affected file,Yes\r\ncerber3,Cerber 3 ransomware affected data,Yes\r\ncoded,Anubis ransomware affected file,Yes\r\ncomrade,Comrade ransomware affected file,Yes\r\nconficker,Conficker ransomware affected file,Yes\r\ncoverton,Coverton ransomware affected data,Yes\r\ncovid19,Phishing / ransomware file,Yes\r\ncovid-19,Phishing / ransomware file,Yes\r\ncrab,GandCrab ransomware affected data,Yes\r\ncrinf,DecryptorMax or CryptInfinite ransomware affected data,Yes\r\ncrjoker,CryptoJoker ransomware affected data,Yes\r\ncrptrgr,CryptoRoger ransomware affected data,Yes\r\ncry,CryLocker ransomware affected data,Yes\r\ncryeye,DoubleLocker ransomware affected data,Yes\r\ncryp1,CryptXXX ransomware affected data,Yes\r\ncrypt,Scatter ransomware affected data,Yes\r\ncrypte,Jigsaw (variant) ransomware affected file,Yes\r\ncrypted,Nemucod ransomware affected file,Yes\r\ncryptolocker,CryptoLocker encrypted file,Yes\r\ncryptowall,Encrypted file by Cryptowall ransomware,Yes\r\ncrypz,CryptXXX ransomware affected data,Yes\r\nczvxce,Coverton ransomware affected file,Yes\r\nd4nk,PyL33T ransomware affected file,Yes\r\ndale,Chip ransomware affected file,Yes\r\ndamage,Damage ransomware affected file,Yes\r\ndarkness,Rakhni ransomware affected data,Yes\r\ndCrypt,DummyLocker ransomware affected file,Yes\r\ndeadbolt,Deadbolt ransomware affected file,Yes\r\ndecrypt2017,Globe 3 ransomware affected file,Yes\r\nderp,Derp ransomware renamed file,Yes\r\nDexter,Troldesh (variant) ransomware affected file,Yes\r\ndharma,CrySiS ransomware affected file,Yes\r\ndll,FSociety ransomware affected file,No\r\ndxxd,DXXD ransomware affected file,Yes\r\necc,Cryptolocker or TeslaCrypt virus encrypted file,Yes\r\nedgel,EdgeLocker ransomware affected file,Yes\r\nenc,TorrentLocker ransomware affected file,No\r\nenc,Cryptorium ransomware affected file,No\r\nenciphered,Malware (ransomware) encoded data,Yes\r\nEnCiPhErEd,Xorist Ransomware affected data,Yes\r\nencr,FileLocker ransomware affected file,Yes\r\nencrypt,Alpha ransomware affected data,Yes\r\nencrypted,Various ransomware affected file,Yes\r\nencrypted,Donald Trump ransomware affected file,Yes\r\nencrypted,KeRanger OS X ransomware affected file,Yes\r\nenigma,Coverton ransomware affected data,Yes\r\nevillock,Evil-JS (variant) ransomware affected file,Yes\r\nexotic,Exotic ransomware affected file,Yes\r\nexx,Alpha Crypt encrypted data,Yes\r\nezz,Alpha Crypt virus encrypted data,Yes\r\nfantom,Fantom ransomware affected data,Yes\r\nfile0locked,Evil ransomware affected file,Yes\r\nfucked,Manifestus ransomware affected file,Yes\r\nfun,Jigsaw Ransomware affected data,Yes\r\nfun,Jigsaw (variant) ransomware affected file,Yes\r\ngefickt,Jigsaw (variant) ransomware affected file,Yes\r\nglobe,Globe ransomware affected file,Yes\r\ngood,Scatter ransomware affected data,Yes\r\ngrt,Karmen HiddenTear (variant) ransomware affected file,Yes\r\nha3,El-Polocker affected file,Yes\r\nhelpmeencedfiles,Samas/SamSam ransomware affected file,Yes\r\nherbst,Herbst ransomware affacted data,Yes\r\nhnumkhotep,Globe 3 ransomware affected file,Yes\r\nhush,Jigsaw ransomware affected file,Yes\r\nifuckedyou,SerbRansom ransomware affected file,Yes\r\ninfo,PizzaCrypts Ransomware affected data,Yes\r\nkernel_complete,KeRanger OS X ransomware data,Yes\r\nkernel_pid,KeRanger OS X ransomware data,Yes\r\nkernel_time,KeRanger OS X ransomware,Yes\r\nkeybtc@inbox_com,KeyBTC ransomware affected data,Yes\r\nkimcilware,KimcilWare ransomware affected data,Yes\r\nkkk,Jigsaw Ransomware affected data,Yes\r\nkostya,Kostya ransomware affected file,Yes\r\nkrab,GandCrab v4 ransomware affected data,Yes\r\nkraken,Rakhni ransomware affected file,Yes\r\nkratos,KratosCrypt ransomware affected data,Yes\r\nkyra,Globe ransomware affected file,Yes\r\nlcked,Jigsaw (variant) ransomware affected file,Yes\r\nLeChiffre,LeChiffre ransomware affected data,Yes\r\nlegion,Legion ransomware affected data,Yes\r\nlesli,CryptoMix ransomware affected file,Yes\r\nlock93,Lock93 ransomware affected file,Yes\r\nlocked,Various ransomware affected data,Yes\r\nlocklock,LockLock ransomware affected data,Yes\r\nlocky,Locky ransomware affected data,Yes\r\nlol!,GPCode ransomware affected data,Yes\r\nloli,LOLI RanSomeWare ransomware affected file,Yes\r\nlovewindows,Globe (variant) ransomware affected file,Yes\r\nmadebyadam,Roga ransomware affected file,Yes\r\nmagic,Magic ransomware affected data,Yes\r\nmaya,HiddenTear (variant) ransomware affected file,Yes\r\nMERRY,Merry X-Mas ransomware affected file,Yes\r\nmicro,TeslaCrypt 3.0 ransomware encrypted data,Yes\r\nmole,CryptoMix (variant) ransomware affected data,Yes\r\nmp3,TeslaCrypt 3.0 ransomware encrypted data,No\r\nMRCR1,Merry X-Mas ransomware affected file,Yes\r\nnoproblemwedecfiles​,Samas/SamSam ransomware affected file,Yes\r\nnuclear55,Nuke ransomware affected file,Yes\r\nodcodc,ODCODC ransomware affected file,Yes\r\nodin,Locky ransomware affected file,Yes\r\nonion,Dharma ransomware affected data,Yes\r\noops,Marlboro ransomware affected file,Yes\r\nosiris,Locky (variant) ransomware affected data,Yes\r\np5tkjw,Xorist Ransomware affected data,Yes\r\npadcrypt,PadCrypt ransomware affected data,Yes\r\npaym,Jigsaw Ransomware affected data,Yes\r\npaymrss,Jigsaw Ransomware affected file,Yes\r\npayms,Jigsaw Ransomware affected file,Yes\r\npaymst,Jigsaw Ransomware affected file,Yes\r\npaymts,Jigsaw Ransomware affected file,Yes\r\npayrms,Jigsaw Ransomware affected file,Yes\r\npays,Jigsaw Ransomware affected data,Yes\r\npdcr,PadCrypt Ransomware script,Yes\r\npec,PEC 2017 ransomware affected file,Yes\r\nPEGS1,Merry X-Mas ransomware affected file,Yes\r\nperl,Bart ransomware affected file,Yes\r\nPoAr2w,Xorist Ransomware affected file,Yes\r\npotato,Potato ransomware affected file,Yes\r\npowerfulldecrypt,Samas/SamSam ransomware affected file,Yes\r\npubg,PUBG ransomware affected data,Yes\r\npurge,Globe ransomware affected file,Yes\r\npzdc,Scatter ransomware affected data,Yes\r\nR16m01d05,Ransomware affected data,Yes\r\nr5a,7ev3n ransomware affected file,Yes\r\nraid10,Globe [variant] ransomware affected file,Yes\r\nRARE1,Merry X-Mas ransomware affected file,Yes\r\nrazy,Razy ransomware affected data,Yes\r\nrdm,Radamant ransomware affected file,Yes\r\nrealfs0ciety@sigaint.org.fs0ciety,Fsociety ransomware affected file,Yes\r\nreco,STOP/DJVU ransomware file,Yes\r\nrekt,HiddenTear (variant) ransomware affected file,Yes\r\nrekt,RektLocker ransomware affected data,Yes\r\nremk,STOP Ransomware variant,Yes\r\nrip,KillLocker ransomware affected file,Yes\r\nRMCM1,Merry X-Mas ransomware affected file,Yes\r\nrmd,Zeta ransomware affected file,Yes\r\nrnsmwr,Gremit ransomware affected file,Yes\r\nrokku,Rokku ransomware affected data,Yes\r\nrrk,Radamant v2 ransomware affected file,Yes\r\nruby,Ruby ransomware affected file,Yes\r\nsage,Sage ransomware affected data,Yes\r\nSecureCrypted,Apocalypse ransomware affected file,Yes\r\nserp,Serpent (variant) ransomware affected file,Yes\r\nserpent,Serpent ransomware affected file,Yes\r\nsexy,PayDay ransomware affected files,Yes\r\nshit,Locky ransomware affected file,Yes\r\nspora,Spora ransomware affected file,Yes\r\nstn,Satan ransomware affected file,Yes\r\nsurprise,Surprise ransomware affected data,Yes\r\nszf,SZFLocker ransomware affected data,Yes\r\ntheworldisyours,Samas/SamSam ransomware affected file,Yes\r\nthor,Locky ransomware affected file,Yes\r\nttt,TeslaCrypt 3.0 ransomware encrypted data,Yes\r\nunavailable,Al-Namrood ransomware affected file,Yes\r\nvbransom,VBRansom 7 ransomware affected file,Yes\r\nvenusf,Venus Locker ransomware affected file,Yes\r\nVforVendetta,Samsam (variant) ransomware affected file,Yes\r\nvindows,Vindows Locker ransomware affected file,Yes\r\nvvv,TeslaCrypt 3.0 ransomware encrypted data,Yes\r\nvxlock,vxLock ransomware affected file,Yes\r\nwallet,Globe 3 (variant) ransomware affected file,Yes\r\nwcry,WannaCry ransomware affected file,Yes\r\nwflx,WildFire ransomware affected file,Yes\r\nWhereisyourfiles,Samas/SamSam ransomware affected file,Yes\r\nwindows10,Shade ransomware affected data,Yes\r\nwncry,Wana Decrypt0r 2.0 ransomware affected data,Yes\r\nxxx,TeslaCrypt 3.0 ransomware encrypted file,Yes\r\nxxx,help_dcfile ransomware affected file,Yes\r\nxyz,TeslaCrypt ransomware encrypted data,No\r\nytbl,Troldesh (variant) ransomware affected file,Yes\r\nzcrypt,ZCRYPT ransomware affected data,Yes\r\nzepto,Locky ransomware affected data,Yes\r\nzorro,Zorro ransomware affected file,Yes\r\nzyklon,ZYKLON ransomware affected data,Yes\r\nzzz,TeslaCrypt ransomware encrypted data,Yes\r\nzzzzz,Locky ransomware affected file,Yes\r\n" }, - "apiVersion": "2022-11-01" + "apiVersion": "2022-11-01", + "condition": "[parameters('DeployWatchlist')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1927,7 +1975,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MalwareProtectionEssentialsWorkbook Workbook with template version 3.0.1", + "description": "MalwareProtectionEssentialsWorkbook Workbook with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -2004,19 +2052,20 @@ "contentProductId": "[variables('_workbookcontentProductId1')]", "id": "[variables('_workbookcontentProductId1')]", "version": "[variables('workbookVersion1')]" - } + }, + "condition": "[parameters('DeployWorkbook')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.1", + "version": "3.2.2", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Malware Protection Essentials", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

Malware Protection Essentials is a domain solution and does not include any data connectors. The content in this solution requires one of the product solutions below , as well as any other connector or data source normalized to the ASIM.

\n

Prerequisite :-

\n

Install one or more of the listed solutions, or develop your custom ASIM parsers to unlock the value provided by this solution.

\n
    \n
  1. Amazon Web Services
    2. \n
  2. Azure Firewall
    3. \n
  3. Azure Network Security Groups
    4. \n
  4. Check Point
    5. \n
  5. Cisco ASA
    6. \n
  6. Cisco Meraki Security Events
    7. \n
  7. Corelight
    8. \n
  8. Fortinet FortiGate
    9. \n
  9. Microsoft Defender for IoT
    10. \n
  10. Microsoft Defender for Cloud
    11. \n
  11. Microsoft Sysmon For Linux
    12. \n
  12. Windows Firewall
    13. \n
  13. Palo Alto PANOS
    14. \n
  14. Vectra AI Stream
    15. \n
  15. WatchGuard Firebox
    16. \n
  16. Zscaler Internet Access
    17. \n
\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n
  1. Product solutions as described above
    2. \n
  2. Logic app for data summarization
    3. \n
\n

Recommendation :-

\n

It is highly recommended to use the Summarize data logic app playbook provided with this solution as it will significantly improve the performance of the Workbook, Analytic rules & Hunting queries.

\n

Workbooks: 1, Analytic Rules: 6, Hunting Queries: 6, Watchlists: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

Malware Protection Essentials is a domain solution and does not include any data connectors. The content in this solution requires one of the product solutions below , as well as any other connector or data source normalized to the ASIM.

\n

Prerequisite :-

\n

Install one or more of the listed solutions, or develop your custom ASIM parsers to unlock the value provided by this solution.

\n
    \n
  1. Amazon Web Services
    2. \n
  2. Azure Firewall
    3. \n
  3. Azure Network Security Groups
    4. \n
  4. Check Point
    5. \n
  5. Cisco ASA
    6. \n
  6. Cisco Meraki Security Events
    7. \n
  7. Corelight
    8. \n
  8. Fortinet FortiGate
    9. \n
  9. Microsoft Defender for IoT
    10. \n
  10. Microsoft Defender for Cloud
    11. \n
  11. Microsoft Sysmon For Linux
    12. \n
  12. Windows Firewall
    13. \n
  13. Palo Alto PANOS
    14. \n
  14. Vectra AI Stream
    15. \n
  15. WatchGuard Firebox
    16. \n
  16. Zscaler Internet Access
    17. \n
\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n
  1. Product solutions as described above
    2. \n
  2. Logic app for data summarization
    3. \n
\n

Recommendation :-

\n

It is highly recommended to use the Summarize data logic app playbook provided with this solution as it will significantly improve the performance of the Workbook, Analytic rules & Hunting queries.

\n

Workbooks: 1, Analytic Rules: 6, XDR Detections: 6, Hunting Queries: 6, Watchlists: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -2103,7 +2152,7 @@ { "kind": "Watchlist", "contentId": "[variables('_Ransomware File Extensions')]", - "version": "3.0.1" + "version": "3.2.2" }, { "kind": "Workbook", @@ -2173,6 +2222,36 @@ { "kind": "Solution", "contentId": "zscaler1579058425289.zscaler_internet_access_mss" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-259de2c1-c546-4c6d-a17c-df639722f4d7", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-7edde3d4-9859-4a00-b93c-b19ddda55320", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-dd041e4e-1ee2-41ec-ba4e-82a71d628260", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-fdbcc0eb-44fb-467e-a51d-a91df0780a81", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-056593d4-ca3b-47a7-be9d-d1d0884a1d36", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-f1443a87-78d5-40c3-b051-f468f0f2def0", + "version": "3.2.1" } ] }, @@ -2188,6 +2267,1611 @@ } }, "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "MalwareProtectionEssentials-CD-xdr-259de2c1-c546-4c6d-a-871268a6", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "detectionAction": { + "alertTemplate": { + "customDetails": { + "ProcessCommandLine": "CommandLine", + "ProcessProcessId": "TargetProcessId" + }, + "title": "Detect Malicious Usage of Recovery Tools to Delete Backup Files", + "tactics": [ + { + "techniques": [ + { + "technique": "T1490" + } + ], + "tactic": "Impact" + } + ], + "severity": "high", + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "ntDomainColumn": "NTDomain", + "nameColumn": "Username", + "upnSuffixColumn": "UPNSuffix" + } + ], + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "DvcIpAddr" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DvcDomain", + "nameColumn": "DvcHostname", + "ntDomainColumn": "NTDomain" + } + ] + }, + "description": "This analytic rule detects usage of recovery tools vssadmin, wbadmin, wmic and bcedit to delete backup files or change recovery configuration. Adversaries may use these tools to delete shadow copies and backup files to prevent recovery of files.\nhttps://attack.mitre.org/techniques/T1490/" + } + }, + "queryCondition": { + "queryText": "_ASim_ProcessEvent\n| where TargetProcessFilename has_any ('vssadmin.exe', 'wbadmin.exe', 'wmic.exe')\n| where CommandLine has_all ('delete', 'shadow')\n| union isfuzzy=True\n (_ASim_ProcessEvent\n | where TargetProcessFilename =~ 'bcedit.exe'\n | where CommandLine has_all ('/set', 'recoveryenabled no')\n )\n| project\n TimeGenerated,\n DvcHostname,\n DvcIpAddr,\n DvcDomain,\n TargetUsername,\n TargetUsernameType,\n TargetProcessName,\n TargetProcessId,\n CommandLine\n| extend Username = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\\\')[1]), TargetUsername)\n| extend NTDomain = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\\\')[0]), TargetUsername)\n| extend Username = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[0]), Username)\n| extend UPNSuffix = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[1]), '')" + }, + "displayName": "Detect Malicious Usage of Recovery Tools to Delete Backup Files", + "id": "[if(true(), 'xdr-259de2c1-c546-4c6d-a17c-df639722f4d7', 'xdr-259de2c1-c546-4c6d-a17c-df639722f4d7')]", + "schedule": { + "frequency": "PT1H" + }, + "status": "disabled", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-259de2c1-c546-4c6d-a17c-df639722f4d7", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-259de2c1-c546-4c6d-a17c-df639722f4d7')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'MalwareProtectionEssentials-CD-xdr-259de2c1-c546-4c6d-a-871268a6')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "This analytic rule detects usage of recovery tools vssadmin, wbadmin, wmic and bcedit to delete backup files or change recovery configuration. Adversaries may use these tools to delete shadow copies and backup files to prevent recovery of files.\nhttps://attack.mitre.org/techniques/T1490/", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "detectionAction": { + "alertTemplate": { + "customDetails": { + "ProcessCommandLine": "CommandLine", + "ProcessProcessId": "TargetProcessId" + }, + "title": "Detect Malicious Usage of Recovery Tools to Delete Backup Files", + "tactics": [ + { + "techniques": [ + { + "technique": "T1490" + } + ], + "tactic": "Impact" + } + ], + "severity": "high", + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "ntDomainColumn": "NTDomain", + "nameColumn": "Username", + "upnSuffixColumn": "UPNSuffix" + } + ], + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "DvcIpAddr" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DvcDomain", + "nameColumn": "DvcHostname", + "ntDomainColumn": "NTDomain" + } + ] + }, + "description": "This analytic rule detects usage of recovery tools vssadmin, wbadmin, wmic and bcedit to delete backup files or change recovery configuration. Adversaries may use these tools to delete shadow copies and backup files to prevent recovery of files.\nhttps://attack.mitre.org/techniques/T1490/" + } + }, + "queryCondition": { + "queryText": "_ASim_ProcessEvent\n| where TargetProcessFilename has_any ('vssadmin.exe', 'wbadmin.exe', 'wmic.exe')\n| where CommandLine has_all ('delete', 'shadow')\n| union isfuzzy=True\n (_ASim_ProcessEvent\n | where TargetProcessFilename =~ 'bcedit.exe'\n | where CommandLine has_all ('/set', 'recoveryenabled no')\n )\n| project\n TimeGenerated,\n DvcHostname,\n DvcIpAddr,\n DvcDomain,\n TargetUsername,\n TargetUsernameType,\n TargetProcessName,\n TargetProcessId,\n CommandLine\n| extend Username = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\\\')[1]), TargetUsername)\n| extend NTDomain = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\\\')[0]), TargetUsername)\n| extend Username = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[0]), Username)\n| extend UPNSuffix = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[1]), '')" + }, + "displayName": "Detect Malicious Usage of Recovery Tools to Delete Backup Files", + "id": "[if(true(), 'xdr-259de2c1-c546-4c6d-a17c-df639722f4d7', 'xdr-259de2c1-c546-4c6d-a17c-df639722f4d7')]", + "schedule": { + "frequency": "PT1H" + }, + "status": "disabled", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-259de2c1-c546-4c6d-a17c-df639722f4d7", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-259de2c1-c546-4c6d-a17c-df639722f4d7", + "contentKind": "CustomDetection", + "displayName": "Detect Malicious Usage of Recovery Tools to Delete Backup Files", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-259de2c1-c546-4c6d-a17c-df639722f4d7','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-259de2c1-c546-4c6d-a17c-df639722f4d7','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-259de2c1-c546-4c6d-a17c-df639722f4d7", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "workload": "sentinel", + "dataTypes": [ + "CarbonBlackEvents_CL", + "CiscoSecureEndpoint_CL", + "CommonSecurityLog", + "SecurityAlert", + "SentinelOne_CL" + ] + } + ], + "requiredDataConnectors": [ + { + "connectorId": "CrowdStrikeFalconEndpointProtection", + "dataTypes": [ + "CommonSecurityLog" + ] + }, + { + "connectorId": "MicrosoftThreatProtection", + "dataTypes": [ + "SecurityAlert" + ] + }, + { + "connectorId": "SentinelOne", + "dataTypes": [ + "SentinelOne_CL" + ] + }, + { + "connectorId": "VMwareCarbonBlack", + "dataTypes": [ + "CarbonBlackEvents_CL" + ] + }, + { + "connectorId": "CiscoSecureEndpoint", + "dataTypes": [ + "CiscoSecureEndpoint_CL" + ] + }, + { + "connectorId": "TrendMicroApexOne", + "dataTypes": [ + "TMApexOneEvent" + ] + }, + { + "connectorId": "TrendMicroApexOneAma", + "dataTypes": [ + "TMApexOneEvent" + ] + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "MalwareProtectionEssentials-CD-xdr-7edde3d4-9859-4a00-b-ae267fb3", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "detectionAction": { + "alertTemplate": { + "customDetails": { + "ProcessCommandLine": "ActingProcessCommandLine", + "RegistryValueValue": "RegistryValueData", + "ProcessProcessId": "ActingProcessId", + "RegistryKeyHive": "RegHive", + "RegistryKeyKey": "RegKey", + "RegistryValueValueType": "RegistryValueType" + }, + "title": "Detect Print Processors Registry Driver Key Creation/Modification", + "tactics": [ + { + "techniques": [ + { + "technique": "T1547" + } + ], + "tactic": "Persistence" + } + ], + "severity": "medium", + "entityMappings": { + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DnsDomain", + "nameColumn": "HostName", + "ntDomainColumn": "NTDomain" + } + ], + "registryValues": [ + { + "id": "[if(true(), 'registryValue1', 'registryValue1')]", + "valueNameColumn": "RegistryValue" + } + ], + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "ntDomainColumn": "NTDomain", + "nameColumn": "Username", + "upnSuffixColumn": "UPNSuffix" + } + ] + }, + "description": "This analytic rule detects any registry value creation or modification of print processor registry Driver key. This will load the executable at startup with print spooler service. This could be an indication of a persistence attempt by an adversary." + } + }, + "queryCondition": { + "queryText": "// Print Processor Registry Key RegEx\nlet printProcessorRegistryRegEx = @'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\[A-Za-z0-9]*ControlSet[A-Za-z0-9]*\\\\Control\\\\Print\\\\Environments\\\\Windows\\s[A-Za-z0-9]+\\\\Print Processors\\\\[A-Za-z0-9]+\\\\Driver';\n_ASim_RegistryEvent\n| where EventType in ('RegistryValueSet', 'RegistryKeyCreated')\n| where RegistryKey matches regex printProcessorRegistryRegEx\n| project\n TimeGenerated,\n DvcHostname,\n ActorUsername,\n ActorUsernameType,\n ActingProcessId,\n ActingProcessName,\n ActingProcessCommandLine,\n RegistryKey,\n RegistryValue,\n RegistryValueType,\n RegistryValueData\n| extend HostName = tostring(split(DvcHostname, '.')[0])\n| extend DnsDomain = tostring(strcat_array(array_slice(split(DvcHostname, '.'), 1, -1), '.'))\n| extend Username = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[1]), ActorUsername)\n| extend NTDomain = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[0]), ActorUsername)\n| extend Username = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[0]), Username)\n| extend UPNSuffix = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[1]), '')\n| extend RegHive = tostring(split(RegistryKey, '\\\\')[0]), RegKey = tostring(strcat_array(array_slice(split(RegistryKey, '\\\\'), 1, -1), '\\\\'))" + }, + "displayName": "Detect Print Processors Registry Driver Key Creation/Modification", + "id": "[if(true(), 'xdr-7edde3d4-9859-4a00-b93c-b19ddda55320', 'xdr-7edde3d4-9859-4a00-b93c-b19ddda55320')]", + "schedule": { + "frequency": "PT1H" + }, + "status": "disabled", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-7edde3d4-9859-4a00-b93c-b19ddda55320", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-7edde3d4-9859-4a00-b93c-b19ddda55320')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'MalwareProtectionEssentials-CD-xdr-7edde3d4-9859-4a00-b-ae267fb3')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "This analytic rule detects any registry value creation or modification of print processor registry Driver key. This will load the executable at startup with print spooler service. This could be an indication of a persistence attempt by an adversary.", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "detectionAction": { + "alertTemplate": { + "customDetails": { + "ProcessCommandLine": "ActingProcessCommandLine", + "RegistryValueValue": "RegistryValueData", + "ProcessProcessId": "ActingProcessId", + "RegistryKeyHive": "RegHive", + "RegistryKeyKey": "RegKey", + "RegistryValueValueType": "RegistryValueType" + }, + "title": "Detect Print Processors Registry Driver Key Creation/Modification", + "tactics": [ + { + "techniques": [ + { + "technique": "T1547" + } + ], + "tactic": "Persistence" + } + ], + "severity": "medium", + "entityMappings": { + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DnsDomain", + "nameColumn": "HostName", + "ntDomainColumn": "NTDomain" + } + ], + "registryValues": [ + { + "id": "[if(true(), 'registryValue1', 'registryValue1')]", + "valueNameColumn": "RegistryValue" + } + ], + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "ntDomainColumn": "NTDomain", + "nameColumn": "Username", + "upnSuffixColumn": "UPNSuffix" + } + ] + }, + "description": "This analytic rule detects any registry value creation or modification of print processor registry Driver key. This will load the executable at startup with print spooler service. This could be an indication of a persistence attempt by an adversary." + } + }, + "queryCondition": { + "queryText": "// Print Processor Registry Key RegEx\nlet printProcessorRegistryRegEx = @'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\[A-Za-z0-9]*ControlSet[A-Za-z0-9]*\\\\Control\\\\Print\\\\Environments\\\\Windows\\s[A-Za-z0-9]+\\\\Print Processors\\\\[A-Za-z0-9]+\\\\Driver';\n_ASim_RegistryEvent\n| where EventType in ('RegistryValueSet', 'RegistryKeyCreated')\n| where RegistryKey matches regex printProcessorRegistryRegEx\n| project\n TimeGenerated,\n DvcHostname,\n ActorUsername,\n ActorUsernameType,\n ActingProcessId,\n ActingProcessName,\n ActingProcessCommandLine,\n RegistryKey,\n RegistryValue,\n RegistryValueType,\n RegistryValueData\n| extend HostName = tostring(split(DvcHostname, '.')[0])\n| extend DnsDomain = tostring(strcat_array(array_slice(split(DvcHostname, '.'), 1, -1), '.'))\n| extend Username = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[1]), ActorUsername)\n| extend NTDomain = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[0]), ActorUsername)\n| extend Username = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[0]), Username)\n| extend UPNSuffix = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[1]), '')\n| extend RegHive = tostring(split(RegistryKey, '\\\\')[0]), RegKey = tostring(strcat_array(array_slice(split(RegistryKey, '\\\\'), 1, -1), '\\\\'))" + }, + "displayName": "Detect Print Processors Registry Driver Key Creation/Modification", + "id": "[if(true(), 'xdr-7edde3d4-9859-4a00-b93c-b19ddda55320', 'xdr-7edde3d4-9859-4a00-b93c-b19ddda55320')]", + "schedule": { + "frequency": "PT1H" + }, + "status": "disabled", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-7edde3d4-9859-4a00-b93c-b19ddda55320", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-7edde3d4-9859-4a00-b93c-b19ddda55320", + "contentKind": "CustomDetection", + "displayName": "Detect Print Processors Registry Driver Key Creation/Modification", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-7edde3d4-9859-4a00-b93c-b19ddda55320','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-7edde3d4-9859-4a00-b93c-b19ddda55320','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-7edde3d4-9859-4a00-b93c-b19ddda55320", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "workload": "sentinel", + "dataTypes": [ + "CarbonBlackEvents_CL", + "CiscoSecureEndpoint_CL", + "CommonSecurityLog", + "SecurityAlert", + "SentinelOne_CL" + ] + } + ], + "requiredDataConnectors": [ + { + "connectorId": "CrowdStrikeFalconEndpointProtection", + "dataTypes": [ + "CommonSecurityLog" + ] + }, + { + "connectorId": "MicrosoftThreatProtection", + "dataTypes": [ + "SecurityAlert" + ] + }, + { + "connectorId": "SentinelOne", + "dataTypes": [ + "SentinelOne_CL" + ] + }, + { + "connectorId": "VMwareCarbonBlack", + "dataTypes": [ + "CarbonBlackEvents_CL" + ] + }, + { + "connectorId": "CiscoSecureEndpoint", + "dataTypes": [ + "CiscoSecureEndpoint_CL" + ] + }, + { + "connectorId": "TrendMicroApexOne", + "dataTypes": [ + "TMApexOneEvent" + ] + }, + { + "connectorId": "TrendMicroApexOneAma", + "dataTypes": [ + "TMApexOneEvent" + ] + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "MalwareProtectionEssentials-CD-xdr-dd041e4e-1ee2-41ec-b-b6377a34", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "detectionAction": { + "alertTemplate": { + "customDetails": { + "ProcessCommandLine": "ActingProcessCommandLine", + "RegistryValueValue": "RegistryValueData", + "ProcessProcessId": "ActingProcessId", + "RegistryKeyHive": "RegHive", + "RegistryKeyKey": "RegKey", + "RegistryValueValueType": "RegistryValueType" + }, + "title": "Detect Registry Run Key Creation/Modification", + "tactics": [ + { + "techniques": [ + { + "technique": "T1547" + } + ], + "tactic": "Persistence" + } + ], + "severity": "medium", + "entityMappings": { + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DnsDomain", + "nameColumn": "HostName", + "ntDomainColumn": "NTDomain" + } + ], + "registryValues": [ + { + "id": "[if(true(), 'registryValue1', 'registryValue1')]", + "valueNameColumn": "RegistryValue" + } + ], + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "ntDomainColumn": "NTDomain", + "nameColumn": "Username", + "upnSuffixColumn": "UPNSuffix" + } + ] + }, + "description": "This analytic rule detects any registry value or key creation in the registry run keys. This could be an indication of a persistence attempt by an adversary." + } + }, + "queryCondition": { + "queryText": "// List of startup registry keys to monitor\nlet startupRegistryList = dynamic([\n 'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run',\n 'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce',\n 'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices',\n 'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run',\n 'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Userinit',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Shell',\n 'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows'\n ]);\n_ASim_RegistryEvent\n| where EventType in ('RegistryValueSet', 'RegistryKeyCreated') and RegistryKey has_any (startupRegistryList)\n| project\n TimeGenerated,\n DvcHostname,\n ActorUsername,\n ActorUsernameType,\n ActingProcessId,\n ActingProcessName,\n ActingProcessCommandLine,\n RegistryKey,\n RegistryValue,\n RegistryValueType,\n RegistryValueData\n| extend HostName = tostring(split(DvcHostname, '.')[0])\n| extend DnsDomain = tostring(strcat_array(array_slice(split(DvcHostname, '.'), 1, -1), '.'))\n| extend Username = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[1]), ActorUsername)\n| extend NTDomain = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[0]), ActorUsername)\n| extend Username = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[0]), Username)\n| extend UPNSuffix = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[1]), '')\n| extend RegHive = tostring(split(RegistryKey, '\\\\')[0]), RegKey = tostring(strcat_array(array_slice(split(RegistryKey, '\\\\'), 1, -1), '\\\\'))" + }, + "displayName": "Detect Registry Run Key Creation/Modification", + "id": "[if(true(), 'xdr-dd041e4e-1ee2-41ec-ba4e-82a71d628260', 'xdr-dd041e4e-1ee2-41ec-ba4e-82a71d628260')]", + "schedule": { + "frequency": "PT1H" + }, + "status": "disabled", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-dd041e4e-1ee2-41ec-ba4e-82a71d628260", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-dd041e4e-1ee2-41ec-ba4e-82a71d628260')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'MalwareProtectionEssentials-CD-xdr-dd041e4e-1ee2-41ec-b-b6377a34')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "This analytic rule detects any registry value or key creation in the registry run keys. This could be an indication of a persistence attempt by an adversary.", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "detectionAction": { + "alertTemplate": { + "customDetails": { + "ProcessCommandLine": "ActingProcessCommandLine", + "RegistryValueValue": "RegistryValueData", + "ProcessProcessId": "ActingProcessId", + "RegistryKeyHive": "RegHive", + "RegistryKeyKey": "RegKey", + "RegistryValueValueType": "RegistryValueType" + }, + "title": "Detect Registry Run Key Creation/Modification", + "tactics": [ + { + "techniques": [ + { + "technique": "T1547" + } + ], + "tactic": "Persistence" + } + ], + "severity": "medium", + "entityMappings": { + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DnsDomain", + "nameColumn": "HostName", + "ntDomainColumn": "NTDomain" + } + ], + "registryValues": [ + { + "id": "[if(true(), 'registryValue1', 'registryValue1')]", + "valueNameColumn": "RegistryValue" + } + ], + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "ntDomainColumn": "NTDomain", + "nameColumn": "Username", + "upnSuffixColumn": "UPNSuffix" + } + ] + }, + "description": "This analytic rule detects any registry value or key creation in the registry run keys. This could be an indication of a persistence attempt by an adversary." + } + }, + "queryCondition": { + "queryText": "// List of startup registry keys to monitor\nlet startupRegistryList = dynamic([\n 'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run',\n 'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce',\n 'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices',\n 'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run',\n 'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Userinit',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Shell',\n 'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows'\n ]);\n_ASim_RegistryEvent\n| where EventType in ('RegistryValueSet', 'RegistryKeyCreated') and RegistryKey has_any (startupRegistryList)\n| project\n TimeGenerated,\n DvcHostname,\n ActorUsername,\n ActorUsernameType,\n ActingProcessId,\n ActingProcessName,\n ActingProcessCommandLine,\n RegistryKey,\n RegistryValue,\n RegistryValueType,\n RegistryValueData\n| extend HostName = tostring(split(DvcHostname, '.')[0])\n| extend DnsDomain = tostring(strcat_array(array_slice(split(DvcHostname, '.'), 1, -1), '.'))\n| extend Username = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[1]), ActorUsername)\n| extend NTDomain = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[0]), ActorUsername)\n| extend Username = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[0]), Username)\n| extend UPNSuffix = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[1]), '')\n| extend RegHive = tostring(split(RegistryKey, '\\\\')[0]), RegKey = tostring(strcat_array(array_slice(split(RegistryKey, '\\\\'), 1, -1), '\\\\'))" + }, + "displayName": "Detect Registry Run Key Creation/Modification", + "id": "[if(true(), 'xdr-dd041e4e-1ee2-41ec-ba4e-82a71d628260', 'xdr-dd041e4e-1ee2-41ec-ba4e-82a71d628260')]", + "schedule": { + "frequency": "PT1H" + }, + "status": "disabled", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-dd041e4e-1ee2-41ec-ba4e-82a71d628260", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-dd041e4e-1ee2-41ec-ba4e-82a71d628260", + "contentKind": "CustomDetection", + "displayName": "Detect Registry Run Key Creation/Modification", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-dd041e4e-1ee2-41ec-ba4e-82a71d628260','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-dd041e4e-1ee2-41ec-ba4e-82a71d628260','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-dd041e4e-1ee2-41ec-ba4e-82a71d628260", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "workload": "sentinel", + "dataTypes": [ + "CarbonBlackEvents_CL", + "CiscoSecureEndpoint_CL", + "CommonSecurityLog", + "SecurityAlert", + "SentinelOne_CL" + ] + } + ], + "requiredDataConnectors": [ + { + "connectorId": "CrowdStrikeFalconEndpointProtection", + "dataTypes": [ + "CommonSecurityLog" + ] + }, + { + "connectorId": "MicrosoftThreatProtection", + "dataTypes": [ + "SecurityAlert" + ] + }, + { + "connectorId": "SentinelOne", + "dataTypes": [ + "SentinelOne_CL" + ] + }, + { + "connectorId": "VMwareCarbonBlack", + "dataTypes": [ + "CarbonBlackEvents_CL" + ] + }, + { + "connectorId": "CiscoSecureEndpoint", + "dataTypes": [ + "CiscoSecureEndpoint_CL" + ] + }, + { + "connectorId": "TrendMicroApexOne", + "dataTypes": [ + "TMApexOneEvent" + ] + }, + { + "connectorId": "TrendMicroApexOneAma", + "dataTypes": [ + "TMApexOneEvent" + ] + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "MalwareProtectionEssentials-CD-xdr-fdbcc0eb-44fb-467e-a-8a0a03ba", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "detectionAction": { + "alertTemplate": { + "customDetails": { + "ProcessCommandLine": "CommandLine", + "ProcessProcessId": "TargetProcessId" + }, + "title": "Process Creation with Suspicious CommandLine Arguments", + "tactics": [ + { + "techniques": [ + { + "technique": "T1059" + } + ], + "tactic": "Execution" + } + ], + "severity": "medium", + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "ntDomainColumn": "NTDomain", + "nameColumn": "Username", + "upnSuffixColumn": "UPNSuffix" + } + ], + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "DvcIpAddr" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DvcDomain", + "nameColumn": "DvcHostname", + "ntDomainColumn": "NTDomain" + } + ] + }, + "description": "This analytic rule detects process creation events with base64 encoded command line arguments. This could be an indication of a malicious process being executed." + } + }, + "queryCondition": { + "queryText": "_ASim_ProcessEvent\n| where EventType == 'ProcessCreated'\n| extend CommandLineArgs = strcat_array(array_slice(split(CommandLine, \" \"), 1, -1), \" \")\n| where strlen(CommandLineArgs) > 0\n| where CommandLineArgs contains \"base64\"\n| project\nTimeGenerated,\nDvcHostname,\nDvcIpAddr,\nDvcDomain,\nTargetUsername,\nTargetUsernameType,\nTargetProcessName,\nTargetProcessId,\nCommandLine\n| extend Username = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\\\')[1]), TargetUsername)\n| extend NTDomain = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\\\')[0]), TargetUsername)\n| extend Username = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[0]), Username)\n| extend UPNSuffix = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[1]), '')" + }, + "displayName": "Process Creation with Suspicious CommandLine Arguments", + "id": "[if(true(), 'xdr-fdbcc0eb-44fb-467e-a51d-a91df0780a81', 'xdr-fdbcc0eb-44fb-467e-a51d-a91df0780a81')]", + "schedule": { + "frequency": "PT1H" + }, + "status": "disabled", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-fdbcc0eb-44fb-467e-a51d-a91df0780a81", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-fdbcc0eb-44fb-467e-a51d-a91df0780a81')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'MalwareProtectionEssentials-CD-xdr-fdbcc0eb-44fb-467e-a-8a0a03ba')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "This analytic rule detects process creation events with base64 encoded command line arguments. This could be an indication of a malicious process being executed.", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "detectionAction": { + "alertTemplate": { + "customDetails": { + "ProcessCommandLine": "CommandLine", + "ProcessProcessId": "TargetProcessId" + }, + "title": "Process Creation with Suspicious CommandLine Arguments", + "tactics": [ + { + "techniques": [ + { + "technique": "T1059" + } + ], + "tactic": "Execution" + } + ], + "severity": "medium", + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "ntDomainColumn": "NTDomain", + "nameColumn": "Username", + "upnSuffixColumn": "UPNSuffix" + } + ], + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "DvcIpAddr" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DvcDomain", + "nameColumn": "DvcHostname", + "ntDomainColumn": "NTDomain" + } + ] + }, + "description": "This analytic rule detects process creation events with base64 encoded command line arguments. This could be an indication of a malicious process being executed." + } + }, + "queryCondition": { + "queryText": "_ASim_ProcessEvent\n| where EventType == 'ProcessCreated'\n| extend CommandLineArgs = strcat_array(array_slice(split(CommandLine, \" \"), 1, -1), \" \")\n| where strlen(CommandLineArgs) > 0\n| where CommandLineArgs contains \"base64\"\n| project\nTimeGenerated,\nDvcHostname,\nDvcIpAddr,\nDvcDomain,\nTargetUsername,\nTargetUsernameType,\nTargetProcessName,\nTargetProcessId,\nCommandLine\n| extend Username = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\\\')[1]), TargetUsername)\n| extend NTDomain = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\\\')[0]), TargetUsername)\n| extend Username = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[0]), Username)\n| extend UPNSuffix = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[1]), '')" + }, + "displayName": "Process Creation with Suspicious CommandLine Arguments", + "id": "[if(true(), 'xdr-fdbcc0eb-44fb-467e-a51d-a91df0780a81', 'xdr-fdbcc0eb-44fb-467e-a51d-a91df0780a81')]", + "schedule": { + "frequency": "PT1H" + }, + "status": "disabled", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-fdbcc0eb-44fb-467e-a51d-a91df0780a81", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-fdbcc0eb-44fb-467e-a51d-a91df0780a81", + "contentKind": "CustomDetection", + "displayName": "Process Creation with Suspicious CommandLine Arguments", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-fdbcc0eb-44fb-467e-a51d-a91df0780a81','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-fdbcc0eb-44fb-467e-a51d-a91df0780a81','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-fdbcc0eb-44fb-467e-a51d-a91df0780a81", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "workload": "sentinel", + "dataTypes": [ + "CarbonBlackEvents_CL", + "CiscoSecureEndpoint_CL", + "CommonSecurityLog", + "SecurityAlert", + "SentinelOne_CL" + ] + } + ], + "requiredDataConnectors": [ + { + "connectorId": "CrowdStrikeFalconEndpointProtection", + "dataTypes": [ + "CommonSecurityLog" + ] + }, + { + "connectorId": "MicrosoftThreatProtection", + "dataTypes": [ + "SecurityAlert" + ] + }, + { + "connectorId": "SentinelOne", + "dataTypes": [ + "SentinelOne_CL" + ] + }, + { + "connectorId": "VMwareCarbonBlack", + "dataTypes": [ + "CarbonBlackEvents_CL" + ] + }, + { + "connectorId": "CiscoSecureEndpoint", + "dataTypes": [ + "CiscoSecureEndpoint_CL" + ] + }, + { + "connectorId": "TrendMicroApexOne", + "dataTypes": [ + "TMApexOneEvent" + ] + }, + { + "connectorId": "TrendMicroApexOneAma", + "dataTypes": [ + "TMApexOneEvent" + ] + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "MalwareProtectionEssentials-CD-xdr-056593d4-ca3b-47a7-b-2456e56a", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "detectionAction": { + "alertTemplate": { + "customDetails": { + "ProcessCommandLine": "ActingProcessCommandLine", + "RegistryValueValue": "RegistryValueData", + "ProcessProcessId": "ActingProcessId", + "RegistryKeyHive": "RegHive", + "RegistryKeyKey": "RegKey", + "RegistryValueValueType": "RegistryValueType" + }, + "title": "Detect Windows Allow Firewall Rule Addition/Modification", + "tactics": [ + { + "techniques": [ + { + "technique": "T1562" + } + ], + "tactic": "DefenseEvasion" + } + ], + "severity": "medium", + "entityMappings": { + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DnsDomain", + "nameColumn": "HostName", + "ntDomainColumn": "NTDomain" + } + ], + "registryValues": [ + { + "id": "[if(true(), 'registryValue1', 'registryValue1')]", + "valueNameColumn": "RegistryValue" + } + ], + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "ntDomainColumn": "NTDomain", + "nameColumn": "Username", + "upnSuffixColumn": "UPNSuffix" + } + ] + }, + "description": "This analytic rule detects any registry value creation or modification of Windows firewall registry keys to allow network traffic. This could be an indication of defense evasion by an adversary to allow network traffic to/from a compromised host." + } + }, + "queryCondition": { + "queryText": "// List of Windows Firewall registry keys to monitor\nlet firewallRegistryList = dynamic([\n 'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\SharedAccess\\\\Parameters\\\\FirewallPolicy\\\\RestrictedServices\\\\Static\\\\System',\n 'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\SharedAccess\\\\Parameters\\\\FirewallPolicy\\\\RestrictedServices\\\\Configurable\\\\System',\n 'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\SharedAccess\\\\Defaults\\\\FirewallPolicy\\\\FirewallRules',\n 'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\WindowsFirewall'\n ]);\n_ASim_RegistryEvent\n| where EventType in ('RegistryValueSet', 'RegistryKeyCreated')\n| where RegistryKey has_any (firewallRegistryList) and RegistryValueData has_all ('Action=Allow', 'Active=TRUE')\n| project\n TimeGenerated,\n DvcHostname,\n ActorUsername,\n ActorUsernameType,\n ActingProcessId,\n ActingProcessName,\n ActingProcessCommandLine,\n RegistryKey,\n RegistryValue,\n RegistryValueType,\n RegistryValueData\n| extend HostName = tostring(split(DvcHostname, '.')[0])\n| extend DnsDomain = tostring(strcat_array(array_slice(split(DvcHostname, '.'), 1, -1), '.'))\n| extend Username = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[1]), ActorUsername)\n| extend NTDomain = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[0]), ActorUsername)\n| extend Username = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[0]), Username)\n| extend UPNSuffix = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[1]), '')\n| extend RegHive = tostring(split(RegistryKey, '\\\\')[0]), RegKey = tostring(strcat_array(array_slice(split(RegistryKey, '\\\\'), 1, -1), '\\\\'))" + }, + "displayName": "Detect Windows Allow Firewall Rule Addition/Modification", + "id": "[if(true(), 'xdr-056593d4-ca3b-47a7-be9d-d1d0884a1d36', 'xdr-056593d4-ca3b-47a7-be9d-d1d0884a1d36')]", + "schedule": { + "frequency": "PT1H" + }, + "status": "disabled", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-056593d4-ca3b-47a7-be9d-d1d0884a1d36", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-056593d4-ca3b-47a7-be9d-d1d0884a1d36')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'MalwareProtectionEssentials-CD-xdr-056593d4-ca3b-47a7-b-2456e56a')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "This analytic rule detects any registry value creation or modification of Windows firewall registry keys to allow network traffic. This could be an indication of defense evasion by an adversary to allow network traffic to/from a compromised host.", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "detectionAction": { + "alertTemplate": { + "customDetails": { + "ProcessCommandLine": "ActingProcessCommandLine", + "RegistryValueValue": "RegistryValueData", + "ProcessProcessId": "ActingProcessId", + "RegistryKeyHive": "RegHive", + "RegistryKeyKey": "RegKey", + "RegistryValueValueType": "RegistryValueType" + }, + "title": "Detect Windows Allow Firewall Rule Addition/Modification", + "tactics": [ + { + "techniques": [ + { + "technique": "T1562" + } + ], + "tactic": "DefenseEvasion" + } + ], + "severity": "medium", + "entityMappings": { + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DnsDomain", + "nameColumn": "HostName", + "ntDomainColumn": "NTDomain" + } + ], + "registryValues": [ + { + "id": "[if(true(), 'registryValue1', 'registryValue1')]", + "valueNameColumn": "RegistryValue" + } + ], + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "ntDomainColumn": "NTDomain", + "nameColumn": "Username", + "upnSuffixColumn": "UPNSuffix" + } + ] + }, + "description": "This analytic rule detects any registry value creation or modification of Windows firewall registry keys to allow network traffic. This could be an indication of defense evasion by an adversary to allow network traffic to/from a compromised host." + } + }, + "queryCondition": { + "queryText": "// List of Windows Firewall registry keys to monitor\nlet firewallRegistryList = dynamic([\n 'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\SharedAccess\\\\Parameters\\\\FirewallPolicy\\\\RestrictedServices\\\\Static\\\\System',\n 'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\SharedAccess\\\\Parameters\\\\FirewallPolicy\\\\RestrictedServices\\\\Configurable\\\\System',\n 'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\SharedAccess\\\\Defaults\\\\FirewallPolicy\\\\FirewallRules',\n 'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\WindowsFirewall'\n ]);\n_ASim_RegistryEvent\n| where EventType in ('RegistryValueSet', 'RegistryKeyCreated')\n| where RegistryKey has_any (firewallRegistryList) and RegistryValueData has_all ('Action=Allow', 'Active=TRUE')\n| project\n TimeGenerated,\n DvcHostname,\n ActorUsername,\n ActorUsernameType,\n ActingProcessId,\n ActingProcessName,\n ActingProcessCommandLine,\n RegistryKey,\n RegistryValue,\n RegistryValueType,\n RegistryValueData\n| extend HostName = tostring(split(DvcHostname, '.')[0])\n| extend DnsDomain = tostring(strcat_array(array_slice(split(DvcHostname, '.'), 1, -1), '.'))\n| extend Username = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[1]), ActorUsername)\n| extend NTDomain = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[0]), ActorUsername)\n| extend Username = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[0]), Username)\n| extend UPNSuffix = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[1]), '')\n| extend RegHive = tostring(split(RegistryKey, '\\\\')[0]), RegKey = tostring(strcat_array(array_slice(split(RegistryKey, '\\\\'), 1, -1), '\\\\'))" + }, + "displayName": "Detect Windows Allow Firewall Rule Addition/Modification", + "id": "[if(true(), 'xdr-056593d4-ca3b-47a7-be9d-d1d0884a1d36', 'xdr-056593d4-ca3b-47a7-be9d-d1d0884a1d36')]", + "schedule": { + "frequency": "PT1H" + }, + "status": "disabled", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-056593d4-ca3b-47a7-be9d-d1d0884a1d36", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-056593d4-ca3b-47a7-be9d-d1d0884a1d36", + "contentKind": "CustomDetection", + "displayName": "Detect Windows Allow Firewall Rule Addition/Modification", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-056593d4-ca3b-47a7-be9d-d1d0884a1d36','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-056593d4-ca3b-47a7-be9d-d1d0884a1d36','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-056593d4-ca3b-47a7-be9d-d1d0884a1d36", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "workload": "sentinel", + "dataTypes": [ + "CarbonBlackEvents_CL", + "CiscoSecureEndpoint_CL", + "CommonSecurityLog", + "SecurityAlert", + "SentinelOne_CL" + ] + } + ], + "requiredDataConnectors": [ + { + "connectorId": "CrowdStrikeFalconEndpointProtection", + "dataTypes": [ + "CommonSecurityLog" + ] + }, + { + "connectorId": "MicrosoftThreatProtection", + "dataTypes": [ + "SecurityAlert" + ] + }, + { + "connectorId": "SentinelOne", + "dataTypes": [ + "SentinelOne_CL" + ] + }, + { + "connectorId": "VMwareCarbonBlack", + "dataTypes": [ + "CarbonBlackEvents_CL" + ] + }, + { + "connectorId": "CiscoSecureEndpoint", + "dataTypes": [ + "CiscoSecureEndpoint_CL" + ] + }, + { + "connectorId": "TrendMicroApexOne", + "dataTypes": [ + "TMApexOneEvent" + ] + }, + { + "connectorId": "TrendMicroApexOneAma", + "dataTypes": [ + "TMApexOneEvent" + ] + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "MalwareProtectionEssentials-CD-xdr-f1443a87-78d5-40c3-b-2e08d941", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "detectionAction": { + "alertTemplate": { + "customDetails": { + "ProcessCommandLine": "ActingProcessCommandLine", + "RegistryValueValue": "RegistryValueData", + "ProcessProcessId": "ActingProcessId", + "RegistryKeyHive": "RegHive", + "RegistryKeyKey": "RegKey", + "RegistryValueValueType": "RegistryValueType" + }, + "title": "Detect Windows Update Disabled from Registry", + "tactics": [ + { + "techniques": [ + { + "technique": "T1562" + } + ], + "tactic": "DefenseEvasion" + } + ], + "severity": "medium", + "entityMappings": { + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DnsDomain", + "nameColumn": "HostName", + "ntDomainColumn": "NTDomain" + } + ], + "registryValues": [ + { + "id": "[if(true(), 'registryValue1', 'registryValue1')]", + "valueNameColumn": "RegistryValue" + } + ], + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "ntDomainColumn": "NTDomain", + "nameColumn": "Username", + "upnSuffixColumn": "UPNSuffix" + } + ] + }, + "description": "This analytic rule detects any registry value creation or modification of Windows Update registry keys to disable Windows Update. This could be an indication of defense evasion by an adversary on a compromised host." + } + }, + "queryCondition": { + "queryText": "// List of Windows Firewall registry keys to monitor\nlet windowsUpdateRegistryList = dynamic([\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Policies\\\\Microsoft\\\\Windows\\\\WindowsUpdate',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Policies\\\\Microsoft\\\\Windows\\\\WindowsUpdate\\\\AU'\n ]);\n_ASim_RegistryEvent\n| where EventType in ('RegistryValueSet', 'RegistryKeyCreated')\n| where RegistryKey has_any (windowsUpdateRegistryList)\n| where RegistryValue has_any ('AUOptions', 'NoAutoUpdate') and RegistryValueData == '1'\n| project\n TimeGenerated,\n DvcHostname,\n ActorUsername,\n ActorUsernameType,\n ActingProcessId,\n ActingProcessName,\n ActingProcessCommandLine,\n RegistryKey,\n RegistryValue,\n RegistryValueType,\n RegistryValueData\n| extend HostName = tostring(split(DvcHostname, '.')[0])\n| extend DnsDomain = tostring(strcat_array(array_slice(split(DvcHostname, '.'), 1, -1), '.'))\n| extend Username = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[1]), ActorUsername)\n| extend NTDomain = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[0]), ActorUsername)\n| extend Username = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[0]), Username)\n| extend UPNSuffix = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[1]), '')\n| extend RegHive = tostring(split(RegistryKey, '\\\\')[0]), RegKey = tostring(strcat_array(array_slice(split(RegistryKey, '\\\\'), 1, -1), '\\\\'))" + }, + "displayName": "Detect Windows Update Disabled from Registry", + "id": "[if(true(), 'xdr-f1443a87-78d5-40c3-b051-f468f0f2def0', 'xdr-f1443a87-78d5-40c3-b051-f468f0f2def0')]", + "schedule": { + "frequency": "PT1H" + }, + "status": "disabled", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-f1443a87-78d5-40c3-b051-f468f0f2def0", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-f1443a87-78d5-40c3-b051-f468f0f2def0')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'MalwareProtectionEssentials-CD-xdr-f1443a87-78d5-40c3-b-2e08d941')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "This analytic rule detects any registry value creation or modification of Windows Update registry keys to disable Windows Update. This could be an indication of defense evasion by an adversary on a compromised host.", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "detectionAction": { + "alertTemplate": { + "customDetails": { + "ProcessCommandLine": "ActingProcessCommandLine", + "RegistryValueValue": "RegistryValueData", + "ProcessProcessId": "ActingProcessId", + "RegistryKeyHive": "RegHive", + "RegistryKeyKey": "RegKey", + "RegistryValueValueType": "RegistryValueType" + }, + "title": "Detect Windows Update Disabled from Registry", + "tactics": [ + { + "techniques": [ + { + "technique": "T1562" + } + ], + "tactic": "DefenseEvasion" + } + ], + "severity": "medium", + "entityMappings": { + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DnsDomain", + "nameColumn": "HostName", + "ntDomainColumn": "NTDomain" + } + ], + "registryValues": [ + { + "id": "[if(true(), 'registryValue1', 'registryValue1')]", + "valueNameColumn": "RegistryValue" + } + ], + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "ntDomainColumn": "NTDomain", + "nameColumn": "Username", + "upnSuffixColumn": "UPNSuffix" + } + ] + }, + "description": "This analytic rule detects any registry value creation or modification of Windows Update registry keys to disable Windows Update. This could be an indication of defense evasion by an adversary on a compromised host." + } + }, + "queryCondition": { + "queryText": "// List of Windows Firewall registry keys to monitor\nlet windowsUpdateRegistryList = dynamic([\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Policies\\\\Microsoft\\\\Windows\\\\WindowsUpdate',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Policies\\\\Microsoft\\\\Windows\\\\WindowsUpdate\\\\AU'\n ]);\n_ASim_RegistryEvent\n| where EventType in ('RegistryValueSet', 'RegistryKeyCreated')\n| where RegistryKey has_any (windowsUpdateRegistryList)\n| where RegistryValue has_any ('AUOptions', 'NoAutoUpdate') and RegistryValueData == '1'\n| project\n TimeGenerated,\n DvcHostname,\n ActorUsername,\n ActorUsernameType,\n ActingProcessId,\n ActingProcessName,\n ActingProcessCommandLine,\n RegistryKey,\n RegistryValue,\n RegistryValueType,\n RegistryValueData\n| extend HostName = tostring(split(DvcHostname, '.')[0])\n| extend DnsDomain = tostring(strcat_array(array_slice(split(DvcHostname, '.'), 1, -1), '.'))\n| extend Username = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[1]), ActorUsername)\n| extend NTDomain = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[0]), ActorUsername)\n| extend Username = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[0]), Username)\n| extend UPNSuffix = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[1]), '')\n| extend RegHive = tostring(split(RegistryKey, '\\\\')[0]), RegKey = tostring(strcat_array(array_slice(split(RegistryKey, '\\\\'), 1, -1), '\\\\'))" + }, + "displayName": "Detect Windows Update Disabled from Registry", + "id": "[if(true(), 'xdr-f1443a87-78d5-40c3-b051-f468f0f2def0', 'xdr-f1443a87-78d5-40c3-b051-f468f0f2def0')]", + "schedule": { + "frequency": "PT1H" + }, + "status": "disabled", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-f1443a87-78d5-40c3-b051-f468f0f2def0", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-f1443a87-78d5-40c3-b051-f468f0f2def0", + "contentKind": "CustomDetection", + "displayName": "Detect Windows Update Disabled from Registry", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-f1443a87-78d5-40c3-b051-f468f0f2def0','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-f1443a87-78d5-40c3-b051-f468f0f2def0','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-f1443a87-78d5-40c3-b051-f468f0f2def0", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "workload": "sentinel", + "dataTypes": [ + "CarbonBlackEvents_CL", + "CiscoSecureEndpoint_CL", + "CommonSecurityLog", + "SecurityAlert", + "SentinelOne_CL" + ] + } + ], + "requiredDataConnectors": [ + { + "connectorId": "CrowdStrikeFalconEndpointProtection", + "dataTypes": [ + "CommonSecurityLog" + ] + }, + { + "connectorId": "MicrosoftThreatProtection", + "dataTypes": [ + "SecurityAlert" + ] + }, + { + "connectorId": "SentinelOne", + "dataTypes": [ + "SentinelOne_CL" + ] + }, + { + "connectorId": "VMwareCarbonBlack", + "dataTypes": [ + "CarbonBlackEvents_CL" + ] + }, + { + "connectorId": "CiscoSecureEndpoint", + "dataTypes": [ + "CiscoSecureEndpoint_CL" + ] + }, + { + "connectorId": "TrendMicroApexOne", + "dataTypes": [ + "TMApexOneEvent" + ] + }, + { + "connectorId": "TrendMicroApexOneAma", + "dataTypes": [ + "TMApexOneEvent" + ] + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "pid-2f546ea1-39c2-49b0-af60-f07e4f841c4c-partnercenter", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [] + } + } } ], "outputs": {} diff --git a/Solutions/Malware Protection Essentials/Package/testParameters.json b/Solutions/Malware Protection Essentials/Package/testParameters.json index 0f5a632ebbc..97bfab726a6 100644 --- a/Solutions/Malware Protection Essentials/Package/testParameters.json +++ b/Solutions/Malware Protection Essentials/Package/testParameters.json @@ -36,5 +36,40 @@ "metadata": { "description": "Name for the workbook" } + }, + "DeployAnalyticsRule": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." + } + }, + "DeployWorkbook": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." + } + }, + "DeployCustomDetection": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." + } + }, + "DeployHuntingQuery": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel hunting queries carried by this solution." + } + }, + "DeployWatchlist": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the watchlists and their registrations carried by this solution." + } } } diff --git a/Solutions/Malware Protection Essentials/ReleaseNotes.md b/Solutions/Malware Protection Essentials/ReleaseNotes.md index 28c43343876..7f2bd477ec9 100644 --- a/Solutions/Malware Protection Essentials/ReleaseNotes.md +++ b/Solutions/Malware Protection Essentials/ReleaseNotes.md @@ -1,4 +1,5 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |--------------|---------------------------------|----------------------------------------------| +| 3.2.2 | 20-10-2026 | Added six disabled Defender XDR Custom Detections alongside the existing Microsoft Sentinel content. Defender Workbook drafts remain excluded pending review. | | 3.0.1 | 18-10-2024 | **Analytical Rule** [Process Creation with Suspicious CommandLine Arguments] | | 3.0.0 | 21-12-2023 | Initial Solution Release | diff --git a/Solutions/Malware Protection Essentials/SolutionMetadata.json b/Solutions/Malware Protection Essentials/SolutionMetadata.json index fee85892448..7dbe8c440f3 100644 --- a/Solutions/Malware Protection Essentials/SolutionMetadata.json +++ b/Solutions/Malware Protection Essentials/SolutionMetadata.json @@ -1,20 +1,22 @@ { - "publisherId": "azuresentinel", - "offerId": "azure-sentinel-solution-malwareprotection", - "firstPublishDate": "2023-09-25", - "lastPublishDate": "2023-09-25", - "providers": [ - "Microsoft" - ], - "categories": { - "domains": [ - "Security - Threat Protection" - ] - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - } -} \ No newline at end of file + "trackingId": "pid-2f546ea1-39c2-49b0-af60-f07e4f841c4c-partnercenter", + "publisherId": "azuresentinel", + "offerId": "azure-sentinel-solution-malwareprotection", + "firstPublishDate": "2023-09-25", + "lastPublishDate": "2023-09-25", + "providers": [ + "Microsoft" + ], + "categories": { + "domains": [ + "Security - Threat Protection" + ] + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + }, + "version": "3.2.2" +} diff --git a/Solutions/Malware Protection Essentials/XDR Detections/BackupDeletionDetected.yaml b/Solutions/Malware Protection Essentials/XDR Detections/BackupDeletionDetected.yaml new file mode 100644 index 00000000000..86500f4e6d2 --- /dev/null +++ b/Solutions/Malware Protection Essentials/XDR Detections/BackupDeletionDetected.yaml @@ -0,0 +1,198 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: CrowdStrikeFalconEndpointProtection + dataTypes: + - CommonSecurityLog +- connectorId: MicrosoftThreatProtection + dataTypes: + - SecurityAlert +- connectorId: SentinelOne + dataTypes: + - SentinelOne_CL +- connectorId: VMwareCarbonBlack + dataTypes: + - CarbonBlackEvents_CL +- connectorId: CiscoSecureEndpoint + dataTypes: + - CiscoSecureEndpoint_CL +- connectorId: TrendMicroApexOne + dataTypes: + - TMApexOneEvent +- connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - CarbonBlackEvents_CL + - CiscoSecureEndpoint_CL + - CommonSecurityLog + - SecurityAlert + - SentinelOne_CL + requiredDataConnectors: + - connectorId: CrowdStrikeFalconEndpointProtection + dataTypes: + - CommonSecurityLog + - connectorId: MicrosoftThreatProtection + dataTypes: + - SecurityAlert + - connectorId: SentinelOne + dataTypes: + - SentinelOne_CL + - connectorId: VMwareCarbonBlack + dataTypes: + - CarbonBlackEvents_CL + - connectorId: CiscoSecureEndpoint + dataTypes: + - CiscoSecureEndpoint_CL + - connectorId: TrendMicroApexOne + dataTypes: + - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: 259de2c1-c546-4c6d-a17c-df639722f4d7 + path: Analytic Rules/BackupDeletionDetected.yaml + version: 1.0.0 + querySha256: 3d07f45d3829525e975843cffc777bfa56c52f04572379ababaa7d88b96766a7 + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - isfuzzy unions can still fail semantic binding in Advanced Hunting + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - Process.ProcessId value is retained as customDetails.ProcessProcessId from query column `TargetProcessId`, but its target + output binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.ProcessProcessId column `TargetProcessId` requires runtime output-schema binding verification + - Process.CommandLine value is retained as customDetails.ProcessCommandLine from query column `CommandLine`, but its target + output binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.ProcessCommandLine column `CommandLine` requires runtime output-schema binding verification + - Custom-detail values must remain within the documented combined 4 KB per-alert limit; runtime values are unverified + and the service drops all custom details if exceeded + informational: [] + errors: [] + originalTactics: + - Impact + originalTechniques: + - T1490 + reviewScope: + sourceDocumentSha256: fab91a32e8d98add1aa8582310b6286f6cb892be5918124d880ef0acc7f1879f + targetQuerySha256: c2e6249472903d1e7accd61c7d453d2c493911aae4c4406b7d7a46f6f297ec19 + reviewDecisions: + - reason: isfuzzy unions can still fail semantic binding in Advanced Hunting + decision: accepted + sourceDocumentSha256: fab91a32e8d98add1aa8582310b6286f6cb892be5918124d880ef0acc7f1879f + targetQuerySha256: c2e6249472903d1e7accd61c7d453d2c493911aae4c4406b7d7a46f6f297ec19 + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: false + aggregationWindowDifference: false + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: No summarize/make-series aggregation detected in query; native 4-hour XDR lookback relies on + Defender XDR alert deduplication across hourly runs. + sourceDocumentSha256: fab91a32e8d98add1aa8582310b6286f6cb892be5918124d880ef0acc7f1879f + targetQuerySha256: c2e6249472903d1e7accd61c7d453d2c493911aae4c4406b7d7a46f6f297ec19 + supplementalEntityDetails: + - entityType: Process + entityIndex: 4 + identifier: ProcessId + sourceColumn: TargetProcessId + column: TargetProcessId + status: runtime-binding-pending + customDetailKey: ProcessProcessId + - entityType: Process + entityIndex: 4 + identifier: CommandLine + sourceColumn: CommandLine + column: CommandLine + status: runtime-binding-pending + customDetailKey: ProcessCommandLine + acceptedReviewReasons: + - isfuzzy unions can still fail semantic binding in Advanced Hunting +properties: + id: xdr-259de2c1-c546-4c6d-a17c-df639722f4d7 + displayName: Detect Malicious Usage of Recovery Tools to Delete Backup Files + status: disabled + queryCondition: + queryText: |- + _ASim_ProcessEvent + | where TargetProcessFilename has_any ('vssadmin.exe', 'wbadmin.exe', 'wmic.exe') + | where CommandLine has_all ('delete', 'shadow') + | union isfuzzy=True + (_ASim_ProcessEvent + | where TargetProcessFilename =~ 'bcedit.exe' + | where CommandLine has_all ('/set', 'recoveryenabled no') + ) + | project + TimeGenerated, + DvcHostname, + DvcIpAddr, + DvcDomain, + TargetUsername, + TargetUsernameType, + TargetProcessName, + TargetProcessId, + CommandLine + | extend Username = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\')[1]), TargetUsername) + | extend NTDomain = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\')[0]), TargetUsername) + | extend Username = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[0]), Username) + | extend UPNSuffix = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[1]), '') + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Detect Malicious Usage of Recovery Tools to Delete Backup Files + description: |- + This analytic rule detects usage of recovery tools vssadmin, wbadmin, wmic and bcedit to delete backup files or change recovery configuration. Adversaries may use these tools to delete shadow copies and backup files to prevent recovery of files. + https://attack.mitre.org/techniques/T1490/ + severity: high + entityMappings: + hosts: + - id: host1 + nameColumn: DvcHostname + dnsDomainColumn: DvcDomain + ntDomainColumn: NTDomain + ips: + - id: ip1 + addressColumn: DvcIpAddr + accounts: + - id: account1 + nameColumn: Username + upnSuffixColumn: UPNSuffix + ntDomainColumn: NTDomain + tactics: + - tactic: Impact + techniques: + - technique: T1490 + customDetails: + ProcessProcessId: TargetProcessId + ProcessCommandLine: CommandLine diff --git a/Solutions/Malware Protection Essentials/XDR Detections/PrintProcessersModified.yaml b/Solutions/Malware Protection Essentials/XDR Detections/PrintProcessersModified.yaml new file mode 100644 index 00000000000..1e6cad12084 --- /dev/null +++ b/Solutions/Malware Protection Essentials/XDR Detections/PrintProcessersModified.yaml @@ -0,0 +1,247 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: CrowdStrikeFalconEndpointProtection + dataTypes: + - CommonSecurityLog +- connectorId: MicrosoftThreatProtection + dataTypes: + - SecurityAlert +- connectorId: SentinelOne + dataTypes: + - SentinelOne_CL +- connectorId: VMwareCarbonBlack + dataTypes: + - CarbonBlackEvents_CL +- connectorId: CiscoSecureEndpoint + dataTypes: + - CiscoSecureEndpoint_CL +- connectorId: TrendMicroApexOne + dataTypes: + - TMApexOneEvent +- connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - CarbonBlackEvents_CL + - CiscoSecureEndpoint_CL + - CommonSecurityLog + - SecurityAlert + - SentinelOne_CL + requiredDataConnectors: + - connectorId: CrowdStrikeFalconEndpointProtection + dataTypes: + - CommonSecurityLog + - connectorId: MicrosoftThreatProtection + dataTypes: + - SecurityAlert + - connectorId: SentinelOne + dataTypes: + - SentinelOne_CL + - connectorId: VMwareCarbonBlack + dataTypes: + - CarbonBlackEvents_CL + - connectorId: CiscoSecureEndpoint + dataTypes: + - CiscoSecureEndpoint_CL + - connectorId: TrendMicroApexOne + dataTypes: + - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: 7edde3d4-9859-4a00-b93c-b19ddda55320 + path: Analytic Rules/PrintProcessersModified.yaml + version: 1.0.0 + querySha256: 02bf6e90dea3db0cfc16ac45386b2ad34d92aa26e3650203250fd2967e6c3c74 + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - Process.ProcessId value is retained as customDetails.ProcessProcessId from query column `ActingProcessId`, but its target + output binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.ProcessProcessId column `ActingProcessId` requires runtime output-schema binding verification + - Process.CommandLine value is retained as customDetails.ProcessCommandLine from query column `ActingProcessCommandLine`, + but its target output binding requires runtime-schema verification; custom details do not restore entity identity or + correlation + - Supplemental customDetails.ProcessCommandLine column `ActingProcessCommandLine` requires runtime output-schema binding + verification + - RegistryKey.Hive value is retained as customDetails.RegistryKeyHive from query column `RegHive`, but its target output + binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.RegistryKeyHive column `RegHive` requires runtime output-schema binding verification + - RegistryKey.Key value is retained as customDetails.RegistryKeyKey from query column `RegKey`, but its target output + binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.RegistryKeyKey column `RegKey` requires runtime output-schema binding verification + - RegistryValue.Value value is retained as customDetails.RegistryValueValue from query column `RegistryValueData`, but + its target output binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.RegistryValueValue column `RegistryValueData` requires runtime output-schema binding verification + - RegistryValue.ValueType value is retained as customDetails.RegistryValueValueType from query column `RegistryValueType`, + but its target output binding requires runtime-schema verification; custom details do not restore entity identity or + correlation + - Supplemental customDetails.RegistryValueValueType column `RegistryValueType` requires runtime output-schema binding + verification + - Custom-detail values must remain within the documented combined 4 KB per-alert limit; runtime values are unverified + and the service drops all custom details if exceeded + informational: + - All source MITRE tactics are preserved in source order in authored YAML. V3.1 ARM packaging carries only the first tactic + and its compatible techniques; this classification loss is not validated parity. Direct Graph deployment requires a + single tactic. + errors: [] + originalTactics: + - Persistence + - PrivilegeEscalation + originalTechniques: + - T1547 + reviewScope: + sourceDocumentSha256: 12311a56a6160fb773dad6e72306926bf9f472a021531519df2647e45724b343 + targetQuerySha256: 3a3ee0c747411a48f832c71d17a3c4e6611a7c935f03bd0bb24482958dc35b8f + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: false + aggregationWindowDifference: false + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: No summarize/make-series aggregation detected in query; native 4-hour XDR lookback relies on + Defender XDR alert deduplication across hourly runs. + sourceDocumentSha256: 12311a56a6160fb773dad6e72306926bf9f472a021531519df2647e45724b343 + targetQuerySha256: 3a3ee0c747411a48f832c71d17a3c4e6611a7c935f03bd0bb24482958dc35b8f + supplementalEntityDetails: + - entityType: Process + entityIndex: 3 + identifier: ProcessId + sourceColumn: ActingProcessId + column: ActingProcessId + status: runtime-binding-pending + customDetailKey: ProcessProcessId + - entityType: Process + entityIndex: 3 + identifier: CommandLine + sourceColumn: ActingProcessCommandLine + column: ActingProcessCommandLine + status: runtime-binding-pending + customDetailKey: ProcessCommandLine + - entityType: RegistryKey + entityIndex: 4 + identifier: Hive + sourceColumn: RegHive + column: RegHive + status: runtime-binding-pending + customDetailKey: RegistryKeyHive + - entityType: RegistryKey + entityIndex: 4 + identifier: Key + sourceColumn: RegKey + column: RegKey + status: runtime-binding-pending + customDetailKey: RegistryKeyKey + - entityType: RegistryValue + entityIndex: 5 + identifier: Value + sourceColumn: RegistryValueData + column: RegistryValueData + status: runtime-binding-pending + customDetailKey: RegistryValueValue + - entityType: RegistryValue + entityIndex: 5 + identifier: ValueType + sourceColumn: RegistryValueType + column: RegistryValueType + status: runtime-binding-pending + customDetailKey: RegistryValueValueType +properties: + id: xdr-7edde3d4-9859-4a00-b93c-b19ddda55320 + displayName: Detect Print Processors Registry Driver Key Creation/Modification + status: disabled + queryCondition: + queryText: |- + // Print Processor Registry Key RegEx + let printProcessorRegistryRegEx = @'HKEY_LOCAL_MACHINE\\SYSTEM\\[A-Za-z0-9]*ControlSet[A-Za-z0-9]*\\Control\\Print\\Environments\\Windows\s[A-Za-z0-9]+\\Print Processors\\[A-Za-z0-9]+\\Driver'; + _ASim_RegistryEvent + | where EventType in ('RegistryValueSet', 'RegistryKeyCreated') + | where RegistryKey matches regex printProcessorRegistryRegEx + | project + TimeGenerated, + DvcHostname, + ActorUsername, + ActorUsernameType, + ActingProcessId, + ActingProcessName, + ActingProcessCommandLine, + RegistryKey, + RegistryValue, + RegistryValueType, + RegistryValueData + | extend HostName = tostring(split(DvcHostname, '.')[0]) + | extend DnsDomain = tostring(strcat_array(array_slice(split(DvcHostname, '.'), 1, -1), '.')) + | extend Username = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\')[1]), ActorUsername) + | extend NTDomain = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\')[0]), ActorUsername) + | extend Username = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[0]), Username) + | extend UPNSuffix = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[1]), '') + | extend RegHive = tostring(split(RegistryKey, '\\')[0]), RegKey = tostring(strcat_array(array_slice(split(RegistryKey, '\\'), 1, -1), '\\')) + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Detect Print Processors Registry Driver Key Creation/Modification + description: This analytic rule detects any registry value creation or modification of print processor registry Driver + key. This will load the executable at startup with print spooler service. This could be an indication of a persistence + attempt by an adversary. + severity: medium + entityMappings: + hosts: + - id: host1 + nameColumn: HostName + dnsDomainColumn: DnsDomain + ntDomainColumn: NTDomain + accounts: + - id: account1 + nameColumn: Username + upnSuffixColumn: UPNSuffix + ntDomainColumn: NTDomain + registryValues: + - id: registryValue1 + valueNameColumn: RegistryValue + tactics: + - tactic: Persistence + techniques: + - technique: T1547 + - tactic: PrivilegeEscalation + techniques: + - technique: T1547 + customDetails: + ProcessProcessId: ActingProcessId + ProcessCommandLine: ActingProcessCommandLine + RegistryKeyHive: RegHive + RegistryKeyKey: RegKey + RegistryValueValue: RegistryValueData + RegistryValueValueType: RegistryValueType diff --git a/Solutions/Malware Protection Essentials/XDR Detections/StartupRegistryModified.yaml b/Solutions/Malware Protection Essentials/XDR Detections/StartupRegistryModified.yaml new file mode 100644 index 00000000000..f9b4f46c3aa --- /dev/null +++ b/Solutions/Malware Protection Essentials/XDR Detections/StartupRegistryModified.yaml @@ -0,0 +1,265 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: CrowdStrikeFalconEndpointProtection + dataTypes: + - CommonSecurityLog +- connectorId: MicrosoftThreatProtection + dataTypes: + - SecurityAlert +- connectorId: SentinelOne + dataTypes: + - SentinelOne_CL +- connectorId: VMwareCarbonBlack + dataTypes: + - CarbonBlackEvents_CL +- connectorId: CiscoSecureEndpoint + dataTypes: + - CiscoSecureEndpoint_CL +- connectorId: TrendMicroApexOne + dataTypes: + - TMApexOneEvent +- connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - CarbonBlackEvents_CL + - CiscoSecureEndpoint_CL + - CommonSecurityLog + - SecurityAlert + - SentinelOne_CL + requiredDataConnectors: + - connectorId: CrowdStrikeFalconEndpointProtection + dataTypes: + - CommonSecurityLog + - connectorId: MicrosoftThreatProtection + dataTypes: + - SecurityAlert + - connectorId: SentinelOne + dataTypes: + - SentinelOne_CL + - connectorId: VMwareCarbonBlack + dataTypes: + - CarbonBlackEvents_CL + - connectorId: CiscoSecureEndpoint + dataTypes: + - CiscoSecureEndpoint_CL + - connectorId: TrendMicroApexOne + dataTypes: + - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: dd041e4e-1ee2-41ec-ba4e-82a71d628260 + path: Analytic Rules/StartupRegistryModified.yaml + version: 1.0.0 + querySha256: 86284fafcc39473ab99f786b86508c419394167e96da004f39e854514b9268b7 + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - Process.ProcessId value is retained as customDetails.ProcessProcessId from query column `ActingProcessId`, but its target + output binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.ProcessProcessId column `ActingProcessId` requires runtime output-schema binding verification + - Process.CommandLine value is retained as customDetails.ProcessCommandLine from query column `ActingProcessCommandLine`, + but its target output binding requires runtime-schema verification; custom details do not restore entity identity or + correlation + - Supplemental customDetails.ProcessCommandLine column `ActingProcessCommandLine` requires runtime output-schema binding + verification + - RegistryKey.Hive value is retained as customDetails.RegistryKeyHive from query column `RegHive`, but its target output + binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.RegistryKeyHive column `RegHive` requires runtime output-schema binding verification + - RegistryKey.Key value is retained as customDetails.RegistryKeyKey from query column `RegKey`, but its target output + binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.RegistryKeyKey column `RegKey` requires runtime output-schema binding verification + - RegistryValue.Value value is retained as customDetails.RegistryValueValue from query column `RegistryValueData`, but + its target output binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.RegistryValueValue column `RegistryValueData` requires runtime output-schema binding verification + - RegistryValue.ValueType value is retained as customDetails.RegistryValueValueType from query column `RegistryValueType`, + but its target output binding requires runtime-schema verification; custom details do not restore entity identity or + correlation + - Supplemental customDetails.RegistryValueValueType column `RegistryValueType` requires runtime output-schema binding + verification + - Custom-detail values must remain within the documented combined 4 KB per-alert limit; runtime values are unverified + and the service drops all custom details if exceeded + informational: + - All source MITRE tactics are preserved in source order in authored YAML. V3.1 ARM packaging carries only the first tactic + and its compatible techniques; this classification loss is not validated parity. Direct Graph deployment requires a + single tactic. + errors: [] + originalTactics: + - Persistence + - PrivilegeEscalation + - DefenseEvasion + originalTechniques: + - T1547 + - T1112 + reviewScope: + sourceDocumentSha256: bc180730ff2fd19e267388f18e2f1b0844cfe51c661483f954f32987ecc415cb + targetQuerySha256: 72823d886fbaf9d28a8537c8a8fa16f7898f308d4eb8cd2f3c8b27f01db46b20 + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: false + aggregationWindowDifference: false + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: No summarize/make-series aggregation detected in query; native 4-hour XDR lookback relies on + Defender XDR alert deduplication across hourly runs. + sourceDocumentSha256: bc180730ff2fd19e267388f18e2f1b0844cfe51c661483f954f32987ecc415cb + targetQuerySha256: 72823d886fbaf9d28a8537c8a8fa16f7898f308d4eb8cd2f3c8b27f01db46b20 + supplementalEntityDetails: + - entityType: Process + entityIndex: 3 + identifier: ProcessId + sourceColumn: ActingProcessId + column: ActingProcessId + status: runtime-binding-pending + customDetailKey: ProcessProcessId + - entityType: Process + entityIndex: 3 + identifier: CommandLine + sourceColumn: ActingProcessCommandLine + column: ActingProcessCommandLine + status: runtime-binding-pending + customDetailKey: ProcessCommandLine + - entityType: RegistryKey + entityIndex: 4 + identifier: Hive + sourceColumn: RegHive + column: RegHive + status: runtime-binding-pending + customDetailKey: RegistryKeyHive + - entityType: RegistryKey + entityIndex: 4 + identifier: Key + sourceColumn: RegKey + column: RegKey + status: runtime-binding-pending + customDetailKey: RegistryKeyKey + - entityType: RegistryValue + entityIndex: 5 + identifier: Value + sourceColumn: RegistryValueData + column: RegistryValueData + status: runtime-binding-pending + customDetailKey: RegistryValueValue + - entityType: RegistryValue + entityIndex: 5 + identifier: ValueType + sourceColumn: RegistryValueType + column: RegistryValueType + status: runtime-binding-pending + customDetailKey: RegistryValueValueType +properties: + id: xdr-dd041e4e-1ee2-41ec-ba4e-82a71d628260 + displayName: Detect Registry Run Key Creation/Modification + status: disabled + queryCondition: + queryText: |- + // List of startup registry keys to monitor + let startupRegistryList = dynamic([ + 'HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run', + 'HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce', + 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run', + 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce', + 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx', + 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce', + 'HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce', + 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices', + 'HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices', + 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run', + 'HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run', + 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit', + 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell', + 'HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows' + ]); + _ASim_RegistryEvent + | where EventType in ('RegistryValueSet', 'RegistryKeyCreated') and RegistryKey has_any (startupRegistryList) + | project + TimeGenerated, + DvcHostname, + ActorUsername, + ActorUsernameType, + ActingProcessId, + ActingProcessName, + ActingProcessCommandLine, + RegistryKey, + RegistryValue, + RegistryValueType, + RegistryValueData + | extend HostName = tostring(split(DvcHostname, '.')[0]) + | extend DnsDomain = tostring(strcat_array(array_slice(split(DvcHostname, '.'), 1, -1), '.')) + | extend Username = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\')[1]), ActorUsername) + | extend NTDomain = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\')[0]), ActorUsername) + | extend Username = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[0]), Username) + | extend UPNSuffix = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[1]), '') + | extend RegHive = tostring(split(RegistryKey, '\\')[0]), RegKey = tostring(strcat_array(array_slice(split(RegistryKey, '\\'), 1, -1), '\\')) + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Detect Registry Run Key Creation/Modification + description: This analytic rule detects any registry value or key creation in the registry run keys. This could be an + indication of a persistence attempt by an adversary. + severity: medium + entityMappings: + hosts: + - id: host1 + nameColumn: HostName + dnsDomainColumn: DnsDomain + ntDomainColumn: NTDomain + accounts: + - id: account1 + nameColumn: Username + upnSuffixColumn: UPNSuffix + ntDomainColumn: NTDomain + registryValues: + - id: registryValue1 + valueNameColumn: RegistryValue + tactics: + - tactic: Persistence + techniques: + - technique: T1547 + - tactic: PrivilegeEscalation + techniques: + - technique: T1547 + - tactic: DefenseEvasion + techniques: + - technique: T1112 + customDetails: + ProcessProcessId: ActingProcessId + ProcessCommandLine: ActingProcessCommandLine + RegistryKeyHive: RegHive + RegistryKeyKey: RegKey + RegistryValueValue: RegistryValueData + RegistryValueValueType: RegistryValueType diff --git a/Solutions/Malware Protection Essentials/XDR Detections/SuspiciousProcessCreation.yaml b/Solutions/Malware Protection Essentials/XDR Detections/SuspiciousProcessCreation.yaml new file mode 100644 index 00000000000..04c72d0abf9 --- /dev/null +++ b/Solutions/Malware Protection Essentials/XDR Detections/SuspiciousProcessCreation.yaml @@ -0,0 +1,192 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: CrowdStrikeFalconEndpointProtection + dataTypes: + - CommonSecurityLog +- connectorId: MicrosoftThreatProtection + dataTypes: + - SecurityAlert +- connectorId: SentinelOne + dataTypes: + - SentinelOne_CL +- connectorId: VMwareCarbonBlack + dataTypes: + - CarbonBlackEvents_CL +- connectorId: CiscoSecureEndpoint + dataTypes: + - CiscoSecureEndpoint_CL +- connectorId: TrendMicroApexOne + dataTypes: + - TMApexOneEvent +- connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - CarbonBlackEvents_CL + - CiscoSecureEndpoint_CL + - CommonSecurityLog + - SecurityAlert + - SentinelOne_CL + requiredDataConnectors: + - connectorId: CrowdStrikeFalconEndpointProtection + dataTypes: + - CommonSecurityLog + - connectorId: MicrosoftThreatProtection + dataTypes: + - SecurityAlert + - connectorId: SentinelOne + dataTypes: + - SentinelOne_CL + - connectorId: VMwareCarbonBlack + dataTypes: + - CarbonBlackEvents_CL + - connectorId: CiscoSecureEndpoint + dataTypes: + - CiscoSecureEndpoint_CL + - connectorId: TrendMicroApexOne + dataTypes: + - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: fdbcc0eb-44fb-467e-a51d-a91df0780a81 + path: Analytic Rules/SuspiciousProcessCreation.yaml + version: 1.0.1 + querySha256: f369f6af13562ce0001bf5bb25f9ab540abefff083d5e2773b94125b1a1284b8 + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - Custom-detail values must remain within the documented combined 4 KB per-alert limit; runtime values are unverified + and the service drops all custom details if exceeded + informational: + - Process.ProcessId mismatch is informational because its original value is preserved as customDetails.ProcessProcessId + from query column `TargetProcessId`; supplemental details do not restore entity identity, correlation, or alert parity + - Process.CommandLine mismatch is informational because its original value is preserved as customDetails.ProcessCommandLine + from query column `CommandLine`; supplemental details do not restore entity identity, correlation, or alert parity + - All source MITRE tactics are preserved in source order in authored YAML. V3.1 ARM packaging carries only the first tactic + and its compatible techniques; this classification loss is not validated parity. Direct Graph deployment requires a + single tactic. + errors: [] + originalTactics: + - Execution + - DefenseEvasion + originalTechniques: + - T1059 + - T1027 + reviewScope: + sourceDocumentSha256: cbc7ee063db574c80bd5c99dd98bcff043487bd9336cba3585c362b8d82d30d2 + targetQuerySha256: fb876bc3350b450a14ec559706f2f3ddb7fc55f8faf3d469cc9b8094ec873f9f + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: false + aggregationWindowDifference: false + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: No summarize/make-series aggregation detected in query; native 4-hour XDR lookback relies on + Defender XDR alert deduplication across hourly runs. + sourceDocumentSha256: cbc7ee063db574c80bd5c99dd98bcff043487bd9336cba3585c362b8d82d30d2 + targetQuerySha256: fb876bc3350b450a14ec559706f2f3ddb7fc55f8faf3d469cc9b8094ec873f9f + supplementalEntityDetails: + - entityType: Process + entityIndex: 4 + identifier: ProcessId + sourceColumn: TargetProcessId + column: TargetProcessId + status: available + customDetailKey: ProcessProcessId + - entityType: Process + entityIndex: 4 + identifier: CommandLine + sourceColumn: CommandLine + column: CommandLine + status: available + customDetailKey: ProcessCommandLine +properties: + id: xdr-fdbcc0eb-44fb-467e-a51d-a91df0780a81 + displayName: Process Creation with Suspicious CommandLine Arguments + status: disabled + queryCondition: + queryText: |- + _ASim_ProcessEvent + | where EventType == 'ProcessCreated' + | extend CommandLineArgs = strcat_array(array_slice(split(CommandLine, " "), 1, -1), " ") + | where strlen(CommandLineArgs) > 0 + | where CommandLineArgs contains "base64" + | project + TimeGenerated, + DvcHostname, + DvcIpAddr, + DvcDomain, + TargetUsername, + TargetUsernameType, + TargetProcessName, + TargetProcessId, + CommandLine + | extend Username = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\')[1]), TargetUsername) + | extend NTDomain = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\')[0]), TargetUsername) + | extend Username = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[0]), Username) + | extend UPNSuffix = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[1]), '') + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Process Creation with Suspicious CommandLine Arguments + description: This analytic rule detects process creation events with base64 encoded command line arguments. This could + be an indication of a malicious process being executed. + severity: medium + entityMappings: + hosts: + - id: host1 + nameColumn: DvcHostname + dnsDomainColumn: DvcDomain + ntDomainColumn: NTDomain + ips: + - id: ip1 + addressColumn: DvcIpAddr + accounts: + - id: account1 + nameColumn: Username + upnSuffixColumn: UPNSuffix + ntDomainColumn: NTDomain + tactics: + - tactic: Execution + techniques: + - technique: T1059 + - tactic: DefenseEvasion + techniques: + - technique: T1027 + customDetails: + ProcessProcessId: TargetProcessId + ProcessCommandLine: CommandLine diff --git a/Solutions/Malware Protection Essentials/XDR Detections/WindowsAllowFirewallRuleAdded.yaml b/Solutions/Malware Protection Essentials/XDR Detections/WindowsAllowFirewallRuleAdded.yaml new file mode 100644 index 00000000000..7bade7dc41a --- /dev/null +++ b/Solutions/Malware Protection Essentials/XDR Detections/WindowsAllowFirewallRuleAdded.yaml @@ -0,0 +1,245 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: CrowdStrikeFalconEndpointProtection + dataTypes: + - CommonSecurityLog +- connectorId: MicrosoftThreatProtection + dataTypes: + - SecurityAlert +- connectorId: SentinelOne + dataTypes: + - SentinelOne_CL +- connectorId: VMwareCarbonBlack + dataTypes: + - CarbonBlackEvents_CL +- connectorId: CiscoSecureEndpoint + dataTypes: + - CiscoSecureEndpoint_CL +- connectorId: TrendMicroApexOne + dataTypes: + - TMApexOneEvent +- connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - CarbonBlackEvents_CL + - CiscoSecureEndpoint_CL + - CommonSecurityLog + - SecurityAlert + - SentinelOne_CL + requiredDataConnectors: + - connectorId: CrowdStrikeFalconEndpointProtection + dataTypes: + - CommonSecurityLog + - connectorId: MicrosoftThreatProtection + dataTypes: + - SecurityAlert + - connectorId: SentinelOne + dataTypes: + - SentinelOne_CL + - connectorId: VMwareCarbonBlack + dataTypes: + - CarbonBlackEvents_CL + - connectorId: CiscoSecureEndpoint + dataTypes: + - CiscoSecureEndpoint_CL + - connectorId: TrendMicroApexOne + dataTypes: + - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: 056593d4-ca3b-47a7-be9d-d1d0884a1d36 + path: Analytic Rules/WindowsAllowFirewallRuleAdded.yaml + version: 1.0.0 + querySha256: 9b8f5535691e7e96533a1f5935ea00f283306aaba07734f37d2ed1294f6b665f + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - Process.ProcessId value is retained as customDetails.ProcessProcessId from query column `ActingProcessId`, but its target + output binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.ProcessProcessId column `ActingProcessId` requires runtime output-schema binding verification + - Process.CommandLine value is retained as customDetails.ProcessCommandLine from query column `ActingProcessCommandLine`, + but its target output binding requires runtime-schema verification; custom details do not restore entity identity or + correlation + - Supplemental customDetails.ProcessCommandLine column `ActingProcessCommandLine` requires runtime output-schema binding + verification + - RegistryKey.Hive value is retained as customDetails.RegistryKeyHive from query column `RegHive`, but its target output + binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.RegistryKeyHive column `RegHive` requires runtime output-schema binding verification + - RegistryKey.Key value is retained as customDetails.RegistryKeyKey from query column `RegKey`, but its target output + binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.RegistryKeyKey column `RegKey` requires runtime output-schema binding verification + - RegistryValue.Value value is retained as customDetails.RegistryValueValue from query column `RegistryValueData`, but + its target output binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.RegistryValueValue column `RegistryValueData` requires runtime output-schema binding verification + - RegistryValue.ValueType value is retained as customDetails.RegistryValueValueType from query column `RegistryValueType`, + but its target output binding requires runtime-schema verification; custom details do not restore entity identity or + correlation + - Supplemental customDetails.RegistryValueValueType column `RegistryValueType` requires runtime output-schema binding + verification + - Custom-detail values must remain within the documented combined 4 KB per-alert limit; runtime values are unverified + and the service drops all custom details if exceeded + informational: [] + errors: [] + originalTactics: + - DefenseEvasion + originalTechniques: + - T1562 + reviewScope: + sourceDocumentSha256: 79192571e381e74bed57394cef736a5b88b2b9878348214eff0016b5ae9d795f + targetQuerySha256: f718a97a0d63a107fe9c6d76d210859a68ff5dd3307b8916d2275daae3dc6de2 + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: false + aggregationWindowDifference: false + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: No summarize/make-series aggregation detected in query; native 4-hour XDR lookback relies on + Defender XDR alert deduplication across hourly runs. + sourceDocumentSha256: 79192571e381e74bed57394cef736a5b88b2b9878348214eff0016b5ae9d795f + targetQuerySha256: f718a97a0d63a107fe9c6d76d210859a68ff5dd3307b8916d2275daae3dc6de2 + supplementalEntityDetails: + - entityType: Process + entityIndex: 3 + identifier: ProcessId + sourceColumn: ActingProcessId + column: ActingProcessId + status: runtime-binding-pending + customDetailKey: ProcessProcessId + - entityType: Process + entityIndex: 3 + identifier: CommandLine + sourceColumn: ActingProcessCommandLine + column: ActingProcessCommandLine + status: runtime-binding-pending + customDetailKey: ProcessCommandLine + - entityType: RegistryKey + entityIndex: 4 + identifier: Hive + sourceColumn: RegHive + column: RegHive + status: runtime-binding-pending + customDetailKey: RegistryKeyHive + - entityType: RegistryKey + entityIndex: 4 + identifier: Key + sourceColumn: RegKey + column: RegKey + status: runtime-binding-pending + customDetailKey: RegistryKeyKey + - entityType: RegistryValue + entityIndex: 5 + identifier: Value + sourceColumn: RegistryValueData + column: RegistryValueData + status: runtime-binding-pending + customDetailKey: RegistryValueValue + - entityType: RegistryValue + entityIndex: 5 + identifier: ValueType + sourceColumn: RegistryValueType + column: RegistryValueType + status: runtime-binding-pending + customDetailKey: RegistryValueValueType +properties: + id: xdr-056593d4-ca3b-47a7-be9d-d1d0884a1d36 + displayName: Detect Windows Allow Firewall Rule Addition/Modification + status: disabled + queryCondition: + queryText: |- + // List of Windows Firewall registry keys to monitor + let firewallRegistryList = dynamic([ + 'HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\RestrictedServices\\Static\\System', + 'HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\RestrictedServices\\Configurable\\System', + 'HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Defaults\\FirewallPolicy\\FirewallRules', + 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall' + ]); + _ASim_RegistryEvent + | where EventType in ('RegistryValueSet', 'RegistryKeyCreated') + | where RegistryKey has_any (firewallRegistryList) and RegistryValueData has_all ('Action=Allow', 'Active=TRUE') + | project + TimeGenerated, + DvcHostname, + ActorUsername, + ActorUsernameType, + ActingProcessId, + ActingProcessName, + ActingProcessCommandLine, + RegistryKey, + RegistryValue, + RegistryValueType, + RegistryValueData + | extend HostName = tostring(split(DvcHostname, '.')[0]) + | extend DnsDomain = tostring(strcat_array(array_slice(split(DvcHostname, '.'), 1, -1), '.')) + | extend Username = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\')[1]), ActorUsername) + | extend NTDomain = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\')[0]), ActorUsername) + | extend Username = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[0]), Username) + | extend UPNSuffix = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[1]), '') + | extend RegHive = tostring(split(RegistryKey, '\\')[0]), RegKey = tostring(strcat_array(array_slice(split(RegistryKey, '\\'), 1, -1), '\\')) + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Detect Windows Allow Firewall Rule Addition/Modification + description: This analytic rule detects any registry value creation or modification of Windows firewall registry keys + to allow network traffic. This could be an indication of defense evasion by an adversary to allow network traffic + to/from a compromised host. + severity: medium + entityMappings: + hosts: + - id: host1 + nameColumn: HostName + dnsDomainColumn: DnsDomain + ntDomainColumn: NTDomain + accounts: + - id: account1 + nameColumn: Username + upnSuffixColumn: UPNSuffix + ntDomainColumn: NTDomain + registryValues: + - id: registryValue1 + valueNameColumn: RegistryValue + tactics: + - tactic: DefenseEvasion + techniques: + - technique: T1562 + customDetails: + ProcessProcessId: ActingProcessId + ProcessCommandLine: ActingProcessCommandLine + RegistryKeyHive: RegHive + RegistryKeyKey: RegKey + RegistryValueValue: RegistryValueData + RegistryValueValueType: RegistryValueType diff --git a/Solutions/Malware Protection Essentials/XDR Detections/WindowsUpdateDisabled.yaml b/Solutions/Malware Protection Essentials/XDR Detections/WindowsUpdateDisabled.yaml new file mode 100644 index 00000000000..ff09911965c --- /dev/null +++ b/Solutions/Malware Protection Essentials/XDR Detections/WindowsUpdateDisabled.yaml @@ -0,0 +1,243 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: CrowdStrikeFalconEndpointProtection + dataTypes: + - CommonSecurityLog +- connectorId: MicrosoftThreatProtection + dataTypes: + - SecurityAlert +- connectorId: SentinelOne + dataTypes: + - SentinelOne_CL +- connectorId: VMwareCarbonBlack + dataTypes: + - CarbonBlackEvents_CL +- connectorId: CiscoSecureEndpoint + dataTypes: + - CiscoSecureEndpoint_CL +- connectorId: TrendMicroApexOne + dataTypes: + - TMApexOneEvent +- connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - CarbonBlackEvents_CL + - CiscoSecureEndpoint_CL + - CommonSecurityLog + - SecurityAlert + - SentinelOne_CL + requiredDataConnectors: + - connectorId: CrowdStrikeFalconEndpointProtection + dataTypes: + - CommonSecurityLog + - connectorId: MicrosoftThreatProtection + dataTypes: + - SecurityAlert + - connectorId: SentinelOne + dataTypes: + - SentinelOne_CL + - connectorId: VMwareCarbonBlack + dataTypes: + - CarbonBlackEvents_CL + - connectorId: CiscoSecureEndpoint + dataTypes: + - CiscoSecureEndpoint_CL + - connectorId: TrendMicroApexOne + dataTypes: + - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: f1443a87-78d5-40c3-b051-f468f0f2def0 + path: Analytic Rules/WindowsUpdateDisabled.yaml + version: 1.0.0 + querySha256: 64b135be87b6e21d6f95e9e623b17dd2c7cba8d7c80c93477fffb9c5a98aa054 + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - Process.ProcessId value is retained as customDetails.ProcessProcessId from query column `ActingProcessId`, but its target + output binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.ProcessProcessId column `ActingProcessId` requires runtime output-schema binding verification + - Process.CommandLine value is retained as customDetails.ProcessCommandLine from query column `ActingProcessCommandLine`, + but its target output binding requires runtime-schema verification; custom details do not restore entity identity or + correlation + - Supplemental customDetails.ProcessCommandLine column `ActingProcessCommandLine` requires runtime output-schema binding + verification + - RegistryKey.Hive value is retained as customDetails.RegistryKeyHive from query column `RegHive`, but its target output + binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.RegistryKeyHive column `RegHive` requires runtime output-schema binding verification + - RegistryKey.Key value is retained as customDetails.RegistryKeyKey from query column `RegKey`, but its target output + binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.RegistryKeyKey column `RegKey` requires runtime output-schema binding verification + - RegistryValue.Value value is retained as customDetails.RegistryValueValue from query column `RegistryValueData`, but + its target output binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.RegistryValueValue column `RegistryValueData` requires runtime output-schema binding verification + - RegistryValue.ValueType value is retained as customDetails.RegistryValueValueType from query column `RegistryValueType`, + but its target output binding requires runtime-schema verification; custom details do not restore entity identity or + correlation + - Supplemental customDetails.RegistryValueValueType column `RegistryValueType` requires runtime output-schema binding + verification + - Custom-detail values must remain within the documented combined 4 KB per-alert limit; runtime values are unverified + and the service drops all custom details if exceeded + informational: [] + errors: [] + originalTactics: + - DefenseEvasion + originalTechniques: + - T1562 + reviewScope: + sourceDocumentSha256: 6ea745beeac95b5ef22a5138e58a3885ae480bf7e89649afab71cc6518227c42 + targetQuerySha256: 39060f43c2637704df73fd4481c40bc8cd34c5ec753c652f30add1351e749858 + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: false + aggregationWindowDifference: false + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: No summarize/make-series aggregation detected in query; native 4-hour XDR lookback relies on + Defender XDR alert deduplication across hourly runs. + sourceDocumentSha256: 6ea745beeac95b5ef22a5138e58a3885ae480bf7e89649afab71cc6518227c42 + targetQuerySha256: 39060f43c2637704df73fd4481c40bc8cd34c5ec753c652f30add1351e749858 + supplementalEntityDetails: + - entityType: Process + entityIndex: 3 + identifier: ProcessId + sourceColumn: ActingProcessId + column: ActingProcessId + status: runtime-binding-pending + customDetailKey: ProcessProcessId + - entityType: Process + entityIndex: 3 + identifier: CommandLine + sourceColumn: ActingProcessCommandLine + column: ActingProcessCommandLine + status: runtime-binding-pending + customDetailKey: ProcessCommandLine + - entityType: RegistryKey + entityIndex: 4 + identifier: Hive + sourceColumn: RegHive + column: RegHive + status: runtime-binding-pending + customDetailKey: RegistryKeyHive + - entityType: RegistryKey + entityIndex: 4 + identifier: Key + sourceColumn: RegKey + column: RegKey + status: runtime-binding-pending + customDetailKey: RegistryKeyKey + - entityType: RegistryValue + entityIndex: 5 + identifier: Value + sourceColumn: RegistryValueData + column: RegistryValueData + status: runtime-binding-pending + customDetailKey: RegistryValueValue + - entityType: RegistryValue + entityIndex: 5 + identifier: ValueType + sourceColumn: RegistryValueType + column: RegistryValueType + status: runtime-binding-pending + customDetailKey: RegistryValueValueType +properties: + id: xdr-f1443a87-78d5-40c3-b051-f468f0f2def0 + displayName: Detect Windows Update Disabled from Registry + status: disabled + queryCondition: + queryText: |- + // List of Windows Firewall registry keys to monitor + let windowsUpdateRegistryList = dynamic([ + 'HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate', + 'HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU' + ]); + _ASim_RegistryEvent + | where EventType in ('RegistryValueSet', 'RegistryKeyCreated') + | where RegistryKey has_any (windowsUpdateRegistryList) + | where RegistryValue has_any ('AUOptions', 'NoAutoUpdate') and RegistryValueData == '1' + | project + TimeGenerated, + DvcHostname, + ActorUsername, + ActorUsernameType, + ActingProcessId, + ActingProcessName, + ActingProcessCommandLine, + RegistryKey, + RegistryValue, + RegistryValueType, + RegistryValueData + | extend HostName = tostring(split(DvcHostname, '.')[0]) + | extend DnsDomain = tostring(strcat_array(array_slice(split(DvcHostname, '.'), 1, -1), '.')) + | extend Username = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\')[1]), ActorUsername) + | extend NTDomain = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\')[0]), ActorUsername) + | extend Username = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[0]), Username) + | extend UPNSuffix = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[1]), '') + | extend RegHive = tostring(split(RegistryKey, '\\')[0]), RegKey = tostring(strcat_array(array_slice(split(RegistryKey, '\\'), 1, -1), '\\')) + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Detect Windows Update Disabled from Registry + description: This analytic rule detects any registry value creation or modification of Windows Update registry keys + to disable Windows Update. This could be an indication of defense evasion by an adversary on a compromised host. + severity: medium + entityMappings: + hosts: + - id: host1 + nameColumn: HostName + dnsDomainColumn: DnsDomain + ntDomainColumn: NTDomain + accounts: + - id: account1 + nameColumn: Username + upnSuffixColumn: UPNSuffix + ntDomainColumn: NTDomain + registryValues: + - id: registryValue1 + valueNameColumn: RegistryValue + tactics: + - tactic: DefenseEvasion + techniques: + - technique: T1562 + customDetails: + ProcessProcessId: ActingProcessId + ProcessCommandLine: ActingProcessCommandLine + RegistryKeyHive: RegHive + RegistryKeyKey: RegKey + RegistryValueValue: RegistryValueData + RegistryValueValueType: RegistryValueType