From 76cb898e2842e9817880c78670eddcdf74f9e5aa Mon Sep 17 00:00:00 2001 From: Alon Karmona Date: Tue, 20 Oct 2026 14:56:34 +0300 Subject: [PATCH] Migrate Malware Protection Essentials (3.2.2) to Defender XDR Custom Detections (V3.1) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9f05623b-293a-427c-a28f-23d9b3fcc32c --- .../Solution_MalwareProtectionEssentials.json | 111 +- .../Package/3.2.2.zip | Bin 0 -> 27633 bytes .../Package/createUiDefinition.json | 50 +- .../Package/mainTemplate.json | 1758 ++++++++++++++++- .../Package/testParameters.json | 35 + .../ReleaseNotes.md | 1 + .../SolutionMetadata.json | 40 +- .../BackupDeletionDetected.yaml | 198 ++ .../PrintProcessersModified.yaml | 247 +++ .../StartupRegistryModified.yaml | 265 +++ .../SuspiciousProcessCreation.yaml | 192 ++ .../WindowsAllowFirewallRuleAdded.yaml | 245 +++ .../XDR Detections/WindowsUpdateDisabled.yaml | 243 +++ 13 files changed, 3276 insertions(+), 109 deletions(-) create mode 100644 Solutions/Malware Protection Essentials/Package/3.2.2.zip create mode 100644 Solutions/Malware Protection Essentials/XDR Detections/BackupDeletionDetected.yaml create mode 100644 Solutions/Malware Protection Essentials/XDR Detections/PrintProcessersModified.yaml create mode 100644 Solutions/Malware Protection Essentials/XDR Detections/StartupRegistryModified.yaml create mode 100644 Solutions/Malware Protection Essentials/XDR Detections/SuspiciousProcessCreation.yaml create mode 100644 Solutions/Malware Protection Essentials/XDR Detections/WindowsAllowFirewallRuleAdded.yaml create mode 100644 Solutions/Malware Protection Essentials/XDR Detections/WindowsUpdateDisabled.yaml diff --git a/Solutions/Malware Protection Essentials/Data/Solution_MalwareProtectionEssentials.json b/Solutions/Malware Protection Essentials/Data/Solution_MalwareProtectionEssentials.json index 53e3c0b304f..377bf9f88e7 100644 --- a/Solutions/Malware Protection Essentials/Data/Solution_MalwareProtectionEssentials.json +++ b/Solutions/Malware Protection Essentials/Data/Solution_MalwareProtectionEssentials.json @@ -1,53 +1,62 @@ { - "Name": "Malware Protection Essentials", - "Author": "Microsoft - support@microsoft.com", - "Logo": "", - "Description": "Malware Protection Essentials is a [domain solution](https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fsentinel%2Fsentinel-solutions-catalog%23domain-solutions&data=05%7C01%7Ckavishbakshi%40microsoft.com%7Cbe2a496082b24caa4b8c08da9cefacca%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637994850502413731%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=OJegu%2B2EqD7rmYmK9pm9QniD6YWp5ooloZ6tHzcwVi0%3D&reserved=0) and does not include any data connectors. The content in this solution requires one of the product solutions below , as well as any other connector or data source normalized to the [ASIM](https://aka.ms/AboutASIM).\n\n**Prerequisite :-**\n\n Install one or more of the listed solutions, or develop your custom ASIM parsers to unlock the value provided by this solution.\n 1. Amazon Web Services \n 2. Azure Firewall \n 3. Azure Network Security Groups \n 4. Check Point \n 5. Cisco ASA \n 6. Cisco Meraki Security Events \n 7. Corelight \n 8. Fortinet FortiGate \n 9. Microsoft Defender for IoT \n 10. Microsoft Defender for Cloud \n 11. Microsoft Sysmon For Linux \n 12. Windows Firewall \n 13. Palo Alto PANOS \n 14. Vectra AI Stream \n 15. WatchGuard Firebox \n 16. Zscaler Internet Access \n\n**Underlying Microsoft Technologies used:** \n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs: \n 1. Product solutions as described above \n 2. Logic app for data summarization\n\n**Recommendation :-**\n\nIt is highly recommended to use the **Summarize data** logic app playbook provided with this solution as it will significantly improve the performance of the Workbook, Analytic rules & Hunting queries.", - "Analytic Rules": [ - "Analytic Rules/StartupRegistryModified.yaml", - "Analytic Rules/PrintProcessersModified.yaml", - "Analytic Rules/SuspiciousProcessCreation.yaml", - "Analytic Rules/BackupDeletionDetected.yaml", - "Analytic Rules/WindowsUpdateDisabled.yaml", - "Analytic Rules/WindowsAllowFirewallRuleAdded.yaml" - ], - "Hunting Queries": [ - "Hunting Queries/NewMaliciousScheduledTask.yaml", - "Hunting Queries/FileCretaedInStartupFolder.yaml", - "Hunting Queries/FilesWithRansomwareExtensions.yaml", - "Hunting Queries/NewScheduledTaskCreation.yaml", - "Hunting Queries/SystemFilesModifiedByUser.yaml", - "Hunting Queries/ExecutableInUncommonLocation.yaml" - ], - "Watchlists": [ - "Watchlists/RansomwareFileExtensions.json" - ], - "WatchlistDescription": "This watchlist contains a list of file extensions that are commonly used by ransomware. Add additional file extensions to this watchlist as required.", - "Workbooks": [ - "Workbooks/MalwareProtectionEssentialsWorkbook.json" - ], - "dependentDomainSolutionIds": [ - "azuresentinel.azure-sentinel-solution-amazonwebservices", - "sentinel4azurefirewall.sentinel4azurefirewall", - "azuresentinel.azure-sentinel-solution-networksecuritygroup", - "checkpoint.checkpoint-sentinel-solutions", - "azuresentinel.azure-sentinel-solution-ciscoasa", - "azuresentinel.azure-sentinel-solution-ciscomeraki", - "corelightinc1584998267292.corelight-for-azure-sentinel", - "Fortinet FortiGate Next-Generation Firewall connector for Microsoft Sentinel", - "azuresentinel.azure-sentinel-solution-unifiedmicrosoftsocforot", - "azuresentinel.azure-sentinel-solution-microsoftdefenderforcloud", - "azuresentinel.azure-sentinel-solution-sysmonforlinux", - "azuresentinel.azure-sentinel-solution-windowsfirewall", - "azuresentinel.azure-sentinel-solution-paloaltopanos", - "vectraaiinc.vectra_sentinel_solution", - "watchguard-technologies.watchguard_firebox_mss", - "zscaler1579058425289.zscaler_internet_access_mss" + "Name": "Malware Protection Essentials", + "Author": "Microsoft - support@microsoft.com", + "Logo": "", + "Description": "Malware Protection Essentials is a [domain solution](https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fsentinel%2Fsentinel-solutions-catalog%23domain-solutions&data=05%7C01%7Ckavishbakshi%40microsoft.com%7Cbe2a496082b24caa4b8c08da9cefacca%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637994850502413731%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=OJegu%2B2EqD7rmYmK9pm9QniD6YWp5ooloZ6tHzcwVi0%3D&reserved=0) and does not include any data connectors. The content in this solution requires one of the product solutions below , as well as any other connector or data source normalized to the [ASIM](https://aka.ms/AboutASIM).\n\n**Prerequisite :-**\n\n Install one or more of the listed solutions, or develop your custom ASIM parsers to unlock the value provided by this solution.\n 1. Amazon Web Services \n 2. Azure Firewall \n 3. Azure Network Security Groups \n 4. Check Point \n 5. Cisco ASA \n 6. Cisco Meraki Security Events \n 7. Corelight \n 8. Fortinet FortiGate \n 9. Microsoft Defender for IoT \n 10. Microsoft Defender for Cloud \n 11. Microsoft Sysmon For Linux \n 12. Windows Firewall \n 13. Palo Alto PANOS \n 14. Vectra AI Stream \n 15. WatchGuard Firebox \n 16. Zscaler Internet Access \n\n**Underlying Microsoft Technologies used:** \n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs: \n 1. Product solutions as described above \n 2. Logic app for data summarization\n\n**Recommendation :-**\n\nIt is highly recommended to use the **Summarize data** logic app playbook provided with this solution as it will significantly improve the performance of the Workbook, Analytic rules & Hunting queries.", + "Analytic Rules": [ + "Analytic Rules/StartupRegistryModified.yaml", + "Analytic Rules/PrintProcessersModified.yaml", + "Analytic Rules/SuspiciousProcessCreation.yaml", + "Analytic Rules/BackupDeletionDetected.yaml", + "Analytic Rules/WindowsUpdateDisabled.yaml", + "Analytic Rules/WindowsAllowFirewallRuleAdded.yaml" ], - "WorkbooksDescription": "This workbook provides details about Suspicious Malware Activities from File, Process and Registry events generated by EDR (Endpoint Detection and Response) solutions.", - "BasePath": "C:\\Github\\Azure-Sentinel\\Solutions\\Malware Protection Essentials\\", - "Version": "3.0.1", - "Metadata": "SolutionMetadata.json", - "TemplateSpec": true, - "Is1PConnector": false - } \ No newline at end of file + "Hunting Queries": [ + "Hunting Queries/NewMaliciousScheduledTask.yaml", + "Hunting Queries/FileCretaedInStartupFolder.yaml", + "Hunting Queries/FilesWithRansomwareExtensions.yaml", + "Hunting Queries/NewScheduledTaskCreation.yaml", + "Hunting Queries/SystemFilesModifiedByUser.yaml", + "Hunting Queries/ExecutableInUncommonLocation.yaml" + ], + "Watchlists": [ + "Watchlists/RansomwareFileExtensions.json" + ], + "WatchlistDescription": "This watchlist contains a list of file extensions that are commonly used by ransomware. Add additional file extensions to this watchlist as required.", + "Workbooks": [ + "Workbooks/MalwareProtectionEssentialsWorkbook.json" + ], + "dependentDomainSolutionIds": [ + "azuresentinel.azure-sentinel-solution-amazonwebservices", + "sentinel4azurefirewall.sentinel4azurefirewall", + "azuresentinel.azure-sentinel-solution-networksecuritygroup", + "checkpoint.checkpoint-sentinel-solutions", + "azuresentinel.azure-sentinel-solution-ciscoasa", + "azuresentinel.azure-sentinel-solution-ciscomeraki", + "corelightinc1584998267292.corelight-for-azure-sentinel", + "Fortinet FortiGate Next-Generation Firewall connector for Microsoft Sentinel", + "azuresentinel.azure-sentinel-solution-unifiedmicrosoftsocforot", + "azuresentinel.azure-sentinel-solution-microsoftdefenderforcloud", + "azuresentinel.azure-sentinel-solution-sysmonforlinux", + "azuresentinel.azure-sentinel-solution-windowsfirewall", + "azuresentinel.azure-sentinel-solution-paloaltopanos", + "vectraaiinc.vectra_sentinel_solution", + "watchguard-technologies.watchguard_firebox_mss", + "zscaler1579058425289.zscaler_internet_access_mss" + ], + "WorkbooksDescription": "This workbook provides details about Suspicious Malware Activities from File, Process and Registry events generated by EDR (Endpoint Detection and Response) solutions.", + "BasePath": "C:\\Github\\Azure-Sentinel\\Solutions\\Malware Protection Essentials\\", + "Metadata": "SolutionMetadata.json", + "TemplateSpec": true, + "Is1PConnector": false, + "XDR Workbooks": [], + "XDR Detections": [ + "XDR Detections/BackupDeletionDetected.yaml", + "XDR Detections/PrintProcessersModified.yaml", + "XDR Detections/StartupRegistryModified.yaml", + "XDR Detections/SuspiciousProcessCreation.yaml", + "XDR Detections/WindowsAllowFirewallRuleAdded.yaml", + "XDR Detections/WindowsUpdateDisabled.yaml" + ], + "Version": "3.2.2" +} diff --git a/Solutions/Malware Protection Essentials/Package/3.2.2.zip b/Solutions/Malware Protection Essentials/Package/3.2.2.zip new file mode 100644 index 0000000000000000000000000000000000000000..3455aa8a49c23369c9a660ad59f466a39ef24866 GIT binary patch literal 27633 zcmZU(W3VVqumpH)+vgtJwr$(CZQHhWk8RtwZQFalx9|Pf*!hvs)6rGYlQWZ1l{4~E zz#u39000mGvaZTHpg9ZoDo6kTjj8|u=>KMo98C>};>O zziqKwlYY_9xL}-5HyDqaskvN{w0%PeH!HL{U2Mp1Y8~X|JBcDt)3y?|sU+$8cqVx^ zc*YIJzLSkdC61VBfKV!i}~3+xC}Cf%@wjnjNXzm0k8@ZfqAL10kF2T zAK0YDVn*rp2lOk?&Y1=WC#+X73LshJtXm%Z?%g3o!{ln9F3edWL$_iVd@bd}BsB{W z=0~oFemfmv7aSuDnM_9tcequBOuTpPJoNNy!qi~X@5W+twOL;9h-+)H=mmLk)(>8L zYmQR1^?nsJyt{hf%78Ki=GggRRReGdV3H9m2aXXw*yXVTq>M5UmIS{=Ba&I4Fd$Zb zzh{33GK!3=k#%zm!epc})U4ipzjf_)@|VNkX=j=AO&^0JAQ#&fEb=T(7>ZX?WIy{b zGDm~gr&66NK^>NexBTNfF$zS(*HJzo=tdP~i0zFQC>5=z0@tiL^^rt+AP+@9`(?!C zwMI&afE6OK#}KUr80E&?bA15~Qm#QKa`@Zf_rNf^qLruGsLM4BDK)lsU}3QH_Z+PQ zivf_zm!L{UVw-kLHMt#}R9iZ!at2do42lJjheEQ0DRs|rI3={taZb2uzuFb#4Ty|W zAz8G~t-ZP?YU~J2*OOj?Qo41$tW0XzOjoy}Kdh}qy-mt=^lWQaN8vU-nl^pc&fQ!E zM_fPP2VVxmd7vEn2I8x)o?keF#NhE?z~SA%wYapb@64l~x#o2-np;~6e`a&$K6QMzK7Y(Cz2*_m$Fqn&zMlf|ukm79MXwwMd;L7-xi)wbu2ZhR|7CIQl$rea z?P0LJytzL8<~=!cwQ!-BoA ziq37y>N5sO5Cm4#*keSo2<|&VfnW}nl!U2XApJucD$NFvmirE+u=pl6!Ga}^BmkR@ zL#ioaVICy__CdY`qS*%{Ef4X*M^kbI;nI#qeyzqvxl9nK%xN0f+fS|rPuF=WM&?ww zcwM=qD7Se3_VH068kV+?wtqkJ(SbZhLc()4FtIe)=W^WNTJN`N?(&9zP(fH5sdg$<{}BIhSUOdHgXk{XdmIjF6J{W#B5Je zfb730Vn4WKu6z{Deww0Q!R?t`2r58&4?YFTOut6r>OT1>I(d}94wt5N@St1DBEce z9(pD~{gi!&rli-B$__=V!{q;S)IYA1-R@u zV6L3~Sk&)GOB1pMDQPO!7OZs3=U@M15T3DJwrH-nADk?b@TijxKpSR`qf2Z6X_@L0 zJfSWWn*8?QENhwpcq{P40JNgE8Vk$`h*L=bA3zfES*5GL$Zne1>yXa_I7_eW5Y6al z6M}-L(ZEQ=ixWX{<{h1Ox0GMB@bTdR29Nvp?1C_y8KJ+}qj;#eK)Mxc+JwZ^MOme-m(GOw}o~rJf zuX06`i3K#NKF==@iRG%2OfI<}`U-k7KMY%biocYR&+&zM-Ws&Jg`mcU7qo1FD*t2l zA_mtMtp~MI4#t=`9IRp#{?g{9VOY3=_5s7c2-!C`tj=wY*rZALRRZZaCOeCLd>GUNa`# zYTDm*&AK_O*7DC-n1B&F!??Ht%9^{Yy~62~=)l!jH3lUnW2Y+WOtWcU(Tb%A)(s{9 zZbPu0vBFi7Z0F*RIp3DKT{Wv73!2aNijAIw<0$-^l0%hoU9Cz(EolR*W*sjSR!=%M zQokS$1>!rv_m&U7J}N_73^ZYNVmKj-8J{?0P-5W#5^5~{?KskiLpO!22A$sdZ4v7a_-lp$3?VMqv>*eX8z0v5FU$Gd@IdSuW2Kw z)t2Ga9y^&E&0*m(UoH1^EmmADRwYfofvqaEYAsfEW$2)>!|mp>Y2(Z~rkzvFd{=C_ zVwJMQvH)gL_e678eR`LYhcROGDJarp$k)>30ZyYm29#OCiS=65-ln8$=97 zE~n5V(GfS>Z>48XThV|kojx&k{ffHST1Lhh1Nn#EurmzLop$moi4)`yX{(+;3jxj1 zk$m=;0^{^X4^nUqGd@=a|8`{uwQaH}=Gj;j@bL4g5{`LVD|n(e2UVFT^2%?HPcT zq2dgN0PT+|;+J3&m9xN-t%x!isL+UPRdn=)b@E14H4ISst?=YgCx#Hi85NW8NL-dA z+C+*68-?j7wq%%cVeA$X^vJe@^I?t3XxIwo%sRY$+fY6kiQIp|W7#Io#mYOl)w{rT z+=$NLN#~0pY^WGj(u%ke%fId~ZfZ`o+11=gPdjBc_+~_xbXtTDp-J21?2Tsz{oyGL zPG8#DU9E{H);_v?NGby~rhzY@(e^=GXCONO2VY&Jpr%-?P&?67PAA`9y4EM00R_C3Bh<|U1hE6I2Q%bsvuUz7nO|vzBXK6Ja z%bw>u0@4zuN#i05@jX#_N14l`gHcel?5}(b`est+idQ(0rMj4z$IKL#2%2VuH6SisGC;DqgM;FNc6(c4mo6;g}jl%Uky_%qGWtwV7 z?)X5rDDS?lV%gcKJOIxQ+KOCrbP^G{)xIc5k8jByne){gT0|T8lk`dSJ(ZAWI=U}8 zh*75d)FsYUKrMQ%ya1qPvR62%ER3?oh=pacROFvN?~qeq|!Mj?U4lNF-XOymKM^qJuvM_|t>=jR{5E%(xo*NqW)@rT$|sgPy;f_yG{xXbe8Cjd$>qQHVTw?hO7? zC`ci9?%mFt2z|tXStK{5#WkrGLpBVThy5_W1W-P5g!POTcjXrrjwEA)G^O9X5!O09?tp(1Fsy|G+U1@t$(wAi6O73*zg zPZG_9Vx_?zXK2e3CK=DRgOE}->?jLeiz{v;D=&2%|KC0y|F)h=2-i>e=K8zUyWT)k z=M>?80ZV_w97kpx>2S(E6=!3<%1&b`Ko$w~S&0tAHWAz?O0iUYj#xL5%Qt7ONk5%=oTC!r?-4$g#koM^>mo5^& z_BY(-SWLo=G&t1{pSNUujEziN)NYFQ*gaInuAim>W^pKbo1H`zTHB?Y!4sVik)*7s zJeX2sVK3_6-Fwtw4*V!38LYG35+tb*>^f-YkSmv%L1jm>y!j7_E7JH1ut_;TuAhWk-eiBJ zP=s6^5vQPBQD`jP2ksf=&5|mVeN5%EyD9)jF$P(fraCHS4|}Ar#{)^8S}s;oP(oIf z{K?)mEDfc6*6%;@W`WYV49HbYI@_}39T6fGBzb(yn!wZ$c!n+$rsR3|xROKKABMCk z9d*_lFAEGY@?#p_7Vke$J`*g8#_6*SthLzDmSQtydQC2W2`$gqwdGJ9JSde)v+Su1 z|61V+g+luwjJC=a3(KUFZE)EhThA-I;Y3*fh5qQ8mOK1X89u;6N-0`SOe~kDzPQNiQa_Ej%BIxSXOeJSC1={F6;yW98}qPCDPR9f zx9}d9Hgo-%Fhd>SK4Ms8XhsaDtCfs`Kuve5vN>vI=`9rFq0dZyUYId;9tf%f#7>o! zBcA3{L(f>K^{d;Zp-}-Q99zzqcBZHJ83p*=8Fe;8=1>Ap9P-ny(2Y;9{r>4bb~cu9 zD%Zo_sh7RYHGaWkyj>X~{V+bGqn)gwQDTs1g>H;M^jdb8-K4?>qtY?OG_`@pM@GRq z=FDDL=R!Js{-uU5lxilbkfRDyocR9d!~)Dp1&XydeYUsrUHb%3I74URXf`dBBkjr~ zmvKBv`jyBh?|NRSgnF2xcDdniyK^GNqlBgfD@~H*txDwqo*<_FanpY3MGBoo@vKzz z?k9g~SBBHzclz)*zPErWL0eomK_kZKYY(B4|9f#6UleU%>S{^DUz0)|*LM;=_+sU9 zDM}^w%5#Ub2`l#~N%wbK)-gtn(R92#}JW0qCPj`x%+Mj=s1Cbe_gm7fel7^&>ePy3{Fw}xdNcmHa8M95bYPD^Pl{%JqFqp+buPfXw zV|0rt7~EV!icM-U(Qh72G6pAZaKMEwbR{);GE_TMgFKuZ;mI_aNjA}rqaRHxx?+z)!+Bjob*lY-gZGZrm{Wqo2_=-0@QQr^ecyb&bY2w@N@W* z4lzEjSM|ETKPrF0<^MlU)Jp!?RjxV!z{C?U0OCI<%ErLLR@ubH-uj;(_5XTM-Jh`K_5#rJe^9ex!ST|hw{ zybj-bkdM?Cf;`ot$Uo>kZsBn< zAdo`tEOGwy2Wguv!Ffk@jKM<+5>3o8wAj%Todql8VSIfToFcBa)?F{>r`HA+Qkbq0 z@EYU_C&|FVcqEEJEPt&h^M~ZlQoG^I14(P#U?0SOOI(9mlEld{4g_5PMqc}$evXBU z0h`9_VZfGRXT_AK$~kH{!J?!dV@_p;GB58a;)CKburR}TA0ZhcA-|)@)SnVe;cUOw z#>;Wzf3IfMA$?m50&gzuD(d}aoYm4Z!CE3c_F_T!{26oP$Bb)8{{iPw>VAS%yzJfm;hHWYgE9F8v?rP1HRP){>! zcb@9eipM=%BZixvPe+r5v-2?&@;pG5r@Y+ecdO|K0-`}`h683U{WO4wrRcf5P%wNm zvU;FmCNk9>!6(Z=@g0yM(DnaBEzVSfO zB)3#gzNKhnJNUw18)%R@YAJ)kFg_XOD;%S`A^aI|s&wifT=WS?!!pp~mRI_5y{GI} zZ>NK7Y;PEksX#!ol*Tjw;aCwTJvk_pl^)JG6fRU7 zvCjVq9^Q6;$R2TO#CNAp5LQ1}K8+vhmB|z3YSR-ZR>pC(t=_{xarvtT2s3-n2Q*+R zXP7AsB5)SxPjA)FsmS?y_`ToX9@$Fju~r&p=~7dibj@Ol1_SY~FNI^h?oFlT-qRDk z=o2lqUj7*NJpImxUt#F8rq#G$^?Z7i%l;@eO z>?XXu*mm*$A?&~?HIAK8YtA?z?929r&hVvbsXlfqgr|A0BZftm<~U%F%g5-UxM=OF zRV?*{MqtyuNf^pIq*Hj?bniNO)#|q4(@xx;Ul;tw>0oTTbeJ*EP9)k#?dN*rx#E7{ zr3IWtueXEQ-4S}Ba*>uvEF`GBw4RJH_e%4gOp_OLXk_Q3RB1<(-%yisyuz?}so5vz zdhn-3Apx2_jqWBHS#-KD{DahRXjIKu2#b1w{jZ&6Hz|V3>P7nUJ36sB7jjdG35w~d zhLTn&c?p(W;Q%MTePI98Usk^0O%tIu9Uq9t;>{suiP5WzPOfg9?x-vopSDegCj+Zh zW|^%^myKbeHlJSt?UJ7hp|)>vp*AdZDVY72L->73?rj4Iw~0`DGOU5>1%j!h*r@^o z=5hI3S23aP&0SK?n`UX;+mC$F*yH_Z^CHmCo~^Z0*xX8tFSgixD`1BBaTsD0}P zZ=C#7=7A?-e_9y&4<+B?8z_u9Hz;c_q zA%q*gAB5V$Ib5ZEtu@5!UwDID=cNl*E_XAn-5mxm&sGcPCxgb-1+nd)nQ{)xEMsNw z__Jz#)EareXM!!SDwQ^*|E_8WSv{ok&N+-=iw=9>`$8z4%;x2zTZjD~qm5~)bJJZ5 zKT$`CP0Q5DtSm~)v`mjZ`12KiK;@#AH~2G-Ik?iHehA@)?+2k~Na-9QSKP6cJ0keY zw?J4>Ha%4wrZZ>8)~&5F?#@=~HnWrKqi)gS{CnlbwlmI+D`#JxQiAqOVF)mZ?_@*{ z6^)YBuCvNxb2%%G?AlGj$_@SYY|wRguJijveDpiFfXywUo$JcQ-mTN}u?4@vqq0uE z-h<0zdb47ui`&AkH4O3w^TTy@ZKbn%M}8NxWy7;FLX2kX{0ifw-0;yA?|&mY|3y^) z7qQBmiIG&Zb8G#&$GNl=Ry`BjW8}QKy?uhvn)Mwyz3EeYQavCzd~%(_Vpr?=_)y$^ zQ@3r4?O%6(bFu9jb=GORyCk!9o7J{@b@O8XZynFdS#{rk0ck9Dz5fNcw;5#)y6V}z zWQOk87*-i^TV4##+h;jLV6u9tpojesvDl%aIcBj1X#VNb`~zuyZ@9my?$yu+qLHPT zt+-MnoOwOqB$;i<=fV$}A{Ajvp+Ga7`DqOq@sA2R`~{Oy!Y$I6Fc2DWd$~MS_ z|4>v<3Po<^tRN*@DO$w0Nv9B^L3`U*Y_^**4x!93d!((I(OzZBW-O~HIf@Xo0sW+K z$6ag7r^{}8u)l93gW268JlnKHy zvG-}Lm&c~ul_M!Px;DBYkDHG_hwk7{cfZ{#E_r*5Bi2+&%4kjK?V+*l25poTiV{Yc zpBoxM#d~y&1PccV|4O!JHF1_qw;LY|=8hi9h|9p225dTiw|145u`)({Wb80C!q(Iq z@FReO?yUck00Qel(}`0A0M^Y4s>WDMB0U0(UvLn43_m{x(`$+q7ZPK3gj)S#`DO%# z9q*dVD3~W(76xT%3GAbkIZs5c1yD*b=(Rs+bt3c42EEhtKEp&d1Y>1zTG(J2=MjhXQxT z3N0>0HOx7OFklW@dGtQO0x`fZO@>Dxz9O_9=o+wINk4_hsOzeTF+-#l=RcEYPMEjY zD_k`WeG$TH9a@6RVyW#zIAIOLPfq+oG+eOM(mIPdcF@lyQ;iSy(8t-^g>#|FYk*!Q z^-ZQEj5FI2I++@dHL>>YvM>1hs9X)})w}8Cu7=9pKz#agrTX`d$O)f4QP(>6||VB2lw)HsSFnG*M8D;8MC5jpGWAp-H1>?oH!VOj_wSHcr(<(K|Bx!PnV`gC1|B<2 z67(XV%gznKWbN;5xQp=M%Tnzp1?($PH`uD_5ZN7h>eO5&N9zS}jBeQ{g}HYW$c|%>IzKCk(MiSVkjzysPQ>1bIc{M3Do zUou$mkV%I?2Ebm?dpsK+A!qC&=_lWV5$yzR$a^xRAX)_ikib{h8Um8H9`Y4vM5Wb( zUMen;Fqk;h9t+D2hPg69v&Cxapj8Ree?CZkXA*y|~_{jAfRO5JJ^1-nUbR6bL(Z23(CE-@o zfg9=LHxjt`wbVNd%hBz8ufIKG#A+(`!;eNEVZ1u;1La;GP5y3y|Y zILV35U^>X~nhXf`BC>+P&72zl80g}%;A8(uqB+QSO@v5$a0L_ZudGkvSGPRMAfrMEufru`iZ3hJeVKwDGaVA8rvXTN#e1x zo+FZ&MFNrHR9zM(^pI-`A4V8p@|03}p>3l8z#*^K=|VJo)p1 zYI6rJwisa1P^-r#;M8+}EG0?)@qB68e@s}+J_1NA91P8NAX35tuGd@W9_EFpN_zXR z;X+o(1_jBd(<=@+zFZw@9Sh{0;T~i4MeP$e30J#PF9BKz8stVJi51Zt@D6nuC>08#&P!5kTz$Q zfeN2+p&-VAr4f)mYc1zwG0$tDfK?$QNv3g*OddZ9!?wfRY&q5~kq<76743-SqHcbe zl^cg|U$#^NocHe59}}^F0tkN$-;wiZFCvn*Rdv^huXT=|@EFK|U*iTZ^A;EqMSldzeLi@& z`mTw%T}Sbl$iri7Q=R@IeJyb;e@TIfzXQe0Wmm^94X(Q`T3~?2?q>OL6imfljigP|9@k`ZT-1 z^eFCh5F{TtKte*%W`SVGr8)kWPh{rdJPWsk2UttQq>RA=Tn#j7f2KwN#UNGt>^U*G zZ5RGj*oyzz>-3L8YDDs9>R=LURF6-Wb|hZkED{jj?pDYGYQs>~4c7ws^?0BZn(8>h zl`FLF8^PNUBB{ACR!cZ545hV9EaST8Dj0aoklBinCdoPzTardHk?;?QqgfR~XPKWw zZ$`mmyyRfIW?@Q=2)`YO331)eHDV?0Ig(`h{^P7mfmhmXQkv_~n~5}x+C@I2rhG8S zAY{1_Wc*=*ik?VS+1uXsWAZ-ha>1_ly8R`-(>pViR4lkpfs*^bKw^dvG9ZOJjsj&z zLf$3hd*+M67d^dWTYx`e`uQ&SSUh;2Ws3S6l`w{kNlM3p3r>ulo#lPFzHL zSj0J1jEF|-1S(Z6MD(GP#Jsphkf<6Y=81{5Ch#1v9+Df;eBhP`&eQcO1oN2Sby_f? zBji&s_4^hy62;wJ8i0N%T%Z;*iy%*NQ)o3eOlH)P#hEF(hds4lXb=w8P?J{}n9aZx zk@;v5CWbm)I+?&IaGOCQlDV9#VZ;Dq1Pm*f_lWv{0DM+{57FKj{P&?FDX<%o^&FP* z3}xY=nKCj zh0l_6nZoud;=A`SfjBka8OdCus2s2oq94LPO$n5{2fhg=e_nwKfWoJd40s3MgNK48 z9d!e=jN3dTDN-fWF7C!r(2l|(kRPnuWZR;R>X0%SFVyWPbL40BNW;xSZ_G*fi9~bO z2o5O^Tzcxc^=!-2(1_UlA2O^c!#YysG9Y$6h-#G(dAh22jAyj3)JI0d{FhNcABu_a zYeKoFNJ9o8_xD*2Em9(Q_X=#(3B4v{x1zbImRyv-2^z25*+Z_bT8Q{#yVGEHZ@a2kXT=T z574b@x}~-pOFpTuQK_G6B9-b;Rd%%1-xIS>IZr24z1jTqU#l7J!O&J+Bu8qiF0=PZ z;qRS=auOM;FqXwMbQKo(k>T|{6nH0+;~0;Nq~FPvcqbAU8y*x=JGjZ!wX+lIqQ_jHTOW6l)q+SlbvMV#rQ8E5!>RyuZwOULFv2m($j> z{=9Q?se}Wi=0hmfmR%AP3?^Oo2w$`cCslvjGmyn<2eS811u2Yjc}ZNj=RU`_AE>(1 zpL*pU$Jz|I_`zR!)F#%5?+Fz(KH%!-FI&Dph*XK|^_o(lm@7kuWiE=Zi)DbXi&hop z_^^SZhKlG|k3wyz+noPjH%=4whA}nqw_K%N)}=s`MfElmVR{tE-8AJ?%=C61Ah+8K zh}-F(y!AP8fPQ)c#?0KA8=}1iIisLNdAAR^t}XfVyt~EY)4f?R(o37^_g;X3 z`HM>Rg1>|15G5a98y^Ra-dgbK+W>BqR?U`piE#2fMAw>4AofnyL6{8TVB(>jP56Lv=mWbi^~fd8}d(d8-Z)O9&9 zZ*_D1FtYJf1GYs;_-JQX?Lg22jFDHv@RsVyR z039hjrO@ z7;5r~20Zg9!Fk${s~GB+)U!U~*;keZuuy@Zz~-NM0Z%BA&Okg>@{MD#9Km@?lxo3w z-(B(z?ho3j3`dOe=${{^^5L=|_Qfr>5p|cD9$(D?r({?$JHc zvGZx;44hc_Xq|q=wY5>2W@cr9c9da#(wXlv^l;-udM=4|^r75$1O%4kgdg z$a3k}TTwZr-T2aFTdjw~!=NZ8=%m~vBU5#dAM1|qT=$Ydq$i^Rvi1>s!1Rt)2m|oY z10qhdiO5$49cI$rS2`ZtXN+OErARZNx@hqt6)MW%#~f)<8E11AyQ$}CD%n~yqbWT` z-_yg-=Yl9_>ATIi0+<1F5eXJSf^#Q@(O%%KkO3BY=IUNfO&=J}F4J zIohmr1c~hT`hXF@QBo3uA{Zzn<&o^;GDK_|Up&1{A;BTYUk#WvRAQtXlcB`3GIX_& zUg!45B!Tg+ylsXaX?pV`6nXWL&Wc-HZdWs0+%|uDF!R;-&k54D{?P4I>&u|vbw@xR z!q)eR2yaxj<%sNIEjg59-~JhEse$0DDL`!Ar{3jHi2mpO9E6&9X8e7dA&Mj$izqV2 zSOR%OKo;12pG#3PmzpK35eRm(Lqw^p2cofDDn(o?Y2q1Pu~AUtGFWLgNn+r5g0X%~ zos&h9RFlv?@TlqP)tc5VYrrG;6zA}PFqvI=Hcmz45i7eSaw_T>Drm1MSkUS(`C>=Q zY+}Wi^~~uBYn}*Mjhn-gn&?fV^sfKX!b6=5@4fW~hlx@-up{}A6%9i2<0H9$-A+rZ zdh0ZI@lcl#>e1%jLih0&VU5gGy<}l)?$BMmNaDNrf`)plKbGFo8eoKKe5`UL3KzWD zSP2aDgzi9coz-6dVjE3s0=`FaOL!?W_xTz4agC_!tq%UCLVOWg8t@VImYyPdof@5j zFQt1Ax${bWF%#2ESHN@Le<>;cE@}|U z#Zo|{8WD(m7;y~JB3OfWg4}q>5j75ZEkof-<4%YjCP-A78BXY5-<{`ZrGNx!z# zBvg>JcdfE{t?&t@@#u#3Sxt7iP6NB*;Zpc0q7Ig4NcWwdeu?@QEFWT({hA{W0>x}Z z4yb|!;49(&iz3NMcr7|IxhTItL<3M^;Ke?i2wPrg+qZ-9IekYWWsw3~-d>;KmNa6Z zsR$8c5)>GzIm{JSJ&e#42va+@3a$vGi zp|;}z!E>Kkptmak7^aCs+O3pi0A7?nx7-wf9c17)6t4X?vGG2=c90+R10t^EfkyXI zNDAnPN>uT2>?>^KT=tA4?ID~JWW)EsH2>`GuaGzVLPgdK5sJ$!@>Dfw_$6)4Z?5|b zazw7O2jwJ>U-+A6^h6wlEdM2Ji*nkY!Nue=CKcWdA&qql!t@%pU~N_!LAeLb8^59$ zLems-ors110emzHJ9;D$N(>UO*d}1&C_f?1`BPRfchkg#V<-jgR949R4eBjeJj`p~ zBkB5mzRbR^?JLWFb-Sz{Uzd`5&JFj!*++Ar$Nwk{c>j+=eck&WRJ2Nv6G{Et ze-zUDZ2&#~qYw(@M8)oTR?4s^A26?Z=xfHCBH~?J%TY0 zveAfciX6V(UQBV|L0)~whjriqC#qfuy(?9e$Zz=I0Sf3uy$7e@uRsq>Z^$NVI7wPu zW3H1Bk>HEV#?~T?J9;@E%UClyJDlmtDS|g7aRJZK-ewGnOBNQV^YmHuvFQ#Fk`loP zs-gCO@FjpVfY2ji|JD|7OSMZo(JB?;Q7hzaZHTXSkFo}~xx@Xq!!Big@~I8Fw>_}w z@H!8&w=IV3PiGn91>J{^@*@v)7wJ}Br%nQ(26Si4Ob+ z9Qc+88?y}u4y0;r7zTo6Cb?it3lQdGKN>oiC=O!hW2+s4kX;qQyCoe7QRDWCkfzLS zFB2Rs%W2+MfeI;Rm6;gHIshHz{dCUpI4@dJ@5e?<=-q6O;k`_vhRzb5)~z@(9zq7Z z@RsA_A`ovsp~UyULMQ%im4THs75m%sR1TstjHFg63&GPS!)ilj2N(D(DjYW;Vz!PP z)yji5q+~wNrucz}W359`j2xVGA|S?5|M3WC&Ak98p_9?6_&d`sbU}BV&Dx_Dgp6gZ z#5NfsDhAtTZ1e4;=+F6LtXUHhA4^=B{@D|YyB;<#7g&_+!-0nzprdQ%f>EFh zPAi%PK!g!;4o5xkz)>O!6g_6R!meK=^I0iyg?~h?f6p)fB+ldA)E8u9fvnD-#RWA~ z$!*6!OT?=%5EJ|=&X^k#_~H(fT9)$;@qRJjApdB?8)THrb*H`^-u1HWl+O&mT1D|u z0sku5p5W7pUN86_t{yUw)$Rs^8R@PnV9dNooRKEGc^>EJdX)XLb}bsAZ!+yNB0yUs zd6k8UkZaTqr6R0j^trO5o2*C;OfgQ}QAe;$S}~aGXPHBMI2pH_I#-ks1uw!~V7BcN z;0XwaA0WQ8ccfCmZ>^1gOSjk3T`j9N0^eMQAb;xiR(d~h^XUlm%B#=$G3yBY&O3wt z$96~He{9#}AGk15tDZw8*Zld%w%T2j3+O+#J1?MaXq()1EdxNW->Q~@+)geDmVu}k z@1;$maI9LKrN%0nRfKC|wizZFtfGdu&)bPPz>Wn7ptLoIvF)qpu*>&#%E)X!)`o9| zBdq4*z43OSKi5i)+Aww6pGH!=(=Vd^0XC_daQvHQQ*xysDc zR+?UbSd?JihVF;f?^*U27Ew$p4lsJw(VJ&V7U2?Q=LJW%&|!i@(FQ-GW#M&#rc3{r zM&*vx7~Pu-!{}|rH19@$YiNzon*$n7fzAU^cd7-C+nNtbn{uZ4U0Q|Ju(;Y=Y+T1S zH}cH+7ExcfaZA94ZYx-BeR4ZC2VC!oG!;AQSLGnjj(qlcP6XL5VG(|7O(em`SdJGR zOjFtH#jeBPf{dt8w5GeGE&4xccxZ0+@ebxS3%r$BJ{q}6TVEl#idg@NUBkeA)GN^d zzgZ*2rzhH=nq-dflBM6|93g@p6e4zoTHUSU53-Y?kKeRyX(_sqdB{sWezm!>0Df!j zs@c@Cv8Ups?oIO@xkA~sJb>R2cNa>*#L}d{DMjvLsS|r2)Wi}Mntb*4F8QYZNsV0~ z7);IA{^a=4ltm_bgJM<`vbOxHTe5U%^~2&?Yhc650&}5Mwid`)3vTYu6cpZF(DV`d z>|}YllR0;0iC(fUgt@1C0^4-``P$sw{r3%!hl68&r<0YX#&xrV8Y37Ma`ELoFS24& z;lY)nlTe6kVveFVAhT|uqkoPPzZ1*_gEgXs?nhPpHkLYFb;I|mS}@mY!281Tb3YA= zT3gH1N{uT+eFp@DRBL??xgy!Kxflk%S+CCOhKZY+EI{K%oa>Kww7hGy-Qm8|QS6^P z#tQk7UUEB1-I3jWuMlpfyqF^HGG}dyS(pX2tppfWBBnyzIsGvgL)1rUt-#V<-_L4A zM?Eek{uS+N`#fQ%jt?w+T+$sRGWv228lDgh+*gS)-v*Savan{sC^_1LD)#JgXbHvI z?8ir>>F4*4l|NBsVbbaAF11Zb>shj=UEDM+5iNZ6rKpOW?$S-bKV^cJuE$8Ti?a92 zL(P&N%pO+e-~or!SmhOz5UgQKFU>)BQXx29S#PPoQ8Ho0`t8!E21?idb;`gDgoVgs zknnquhOrUVxS59{l_HcuR_3S40XUu1Vfw&~5C`d~?5K)bN&ukg zn#8ud;tke7=yjl_p}Pg0b~(~;>jfImL-o+IfHN){izC42&(pR#U5gzpW$A1#BzqFgFN( zl?a|~)<&Xaw~ii9mH%G7r7p(ST`GxrjsGSyLNzhJ<1lj6mVm?o<-TBau7tb$hScDJ z+Abs4BsX~m#X)9oeQ_BFv#@AuNG&Q_s`3IwXVi9&OcBr~(uyrZX6?ngnqQL5AEf4m zuPKH3Yi=E#IB#HrIUi!W&fEoxkj+eo=GJx}_%T-8;|L+M+1HRRku6SO&lBH~Dx@Ws zG!Nxx&hv8-S(A%Oc+k2DHzQv@n$@3ql@wh@(x7 zFV2DWIV79JUC{a?_D@#7@;-cb$r>iiVXK>B(tF(cr zR#7?T(wdDFS{vSZR+U1rQ2_)z(np3;ypDAJGNQ6+b-&Ve}497ZdA1ZTY{_h>(#l_)n zfw{)`p*bGuXQGA#Ps_h}yL)@>g8Iijo)yjk}R*7Y=--CRoUoBmgTv|VDb{jq@mkrOg|2BR=ypunC<;om06}5 zLCHFpu@4-6ZtL>qcKT~85ufU@Q+UKU8t>gc^ut*3Z8BjhrEs8Pi@2ySp(RxjvOy^; z3UhsAj~{?h;GCb0^W)gE1(S_r8bq0|o$Vk9Ue#^STryF@`%>XL@SCh8U+JZYF zovH;`+HYT#)AjqF_JD|8=desQ_|#~j+{2jN@*&%3!s?}|(b|Z&(lYK+rd>BuXVQ{M z&?wS%EcIo(x z2p!6F&5V)y+6KO`+eo-xD-A4Gh|m)mSZV>aBHUP^#@o*m-<*rcO0ri{`k)?QJ@kB- zeSB_bwgH)oyJuL_&3-@hK$XkZMPZ`O734R$_)+5;>Z9Fr<_?&}I7zgj@mA9G-91Zm zeU(Q?HG|_PXiMHGGnqB-Pebv1N7h8C+xPliGCL6vRadU7gynh%0cGf6Juj~a0Y4cg|mzIoAO7s`sw4t^W3$o z=h$ufa&sW7R2$g5IvgLm^skdMaOMd7noB^-!xGV_>ZkttiB#o4$Rn`$(=bMNkTY%9 z-^ocgWcoQdl^9#N!{7M(68ytP5=40Q zZQ$T#=SK>xWGjw8#Mzw=N~^ew*h*@|SQU&p_NKEMe7mCz^spv)SC!^KXmG&V-DI;ZYEwW|NAb?e+Zd+!1+elrf-gr(UX6Eih)Q1W(E@|N+18n9`=pNL9#BMVr@ zX}}@r(!EIVRPvsgWy&vgQS!dr%ZGE0Id~m2m^QZVi@~TFwb$2eZml%XZN|Z|TMj8D z_HiPjkqmjWGH5^&1aglFw%jDdu3m6k=C9jejMzRuqCQa^w*Ydu9d)Q*@Hm^zu8_su z+g9vvEsHm8dk?ICK1bghYC~0Z>dx~UV+85Yz92pTh?OZ_dY@Mg+F+-2_+XiNU-Ajp z?RqloiuEq2K-QJ@XKrY)XB&1(o-gK2G#bCx*BHq=)@`w{@s?7qE0t)sLRS& zzUBF*Ha>y5HQV!Bw?;4vg#ns3UEH8LMhYo7=^0Hk`X|{$x~5a}3GVRCB~oj1c<9-H z*ct2_g2W-xImO#{zWEMW&B2E60u$5nKuA>Q?ykQKQr%cpe>F9gKhk_&RSq{2IqI}K zXC9Yi^`Ljp^|!_?cdM1gAr)t4;k5_pGguZPBD`J+91dzhl<8euy9ts$_7j!bqVX!_ z0i+g-6d@zI7j|9cx9F5Pp}th!w_yMN&BKMvWOCFd0@)cE5bO5TFls`5W!Qq`!#(Kg z+i8NI#%=R=I2%H4rpvcz=@^_x8qT>z)|d`D@y}Uvv{oEw9uXS!tD$D6>jc+nH?-z+hP!=t9tPZ$mVanv{`6BRLOF>hG1p=w zKF6G9S`SpAndCTSMRmcx|@G9TA%jNnr-8VyaqUaLlJz-$LL%9t!-ZEl5e|9 zh`RG*ij@E(SJo=&elNqr8|3z$U|=P|iPAE+Pq9G22HT?j5Fo@qGxz=`LE`4-{^z`8 zb0!Svp+TLMC11CGj2xDAZZ#4cdyGVbnwW&HAj^NcZKtux>L39|ag-rJPdr>-l=q)M zv$>nNowSOG)0lvrm$1BgPwnt?eMrfOT-gBi9TvgjsSSTw4wo!MeO33%Uu2_lMxvOU zvwmbqTftq3M&{xKB1aHW7$;Wg*H(RTtl!T0pAbXLwR^|S?=HK2zD$oqG6MPVKTw75 zPvHssNf0sei;KVOED<;Nx--S4ebzY2aDNKoN*xM%(U7o5B?+FmS-j`=5vd4kLN&0* zMINKy_NovqE58aedYM`FGfYt^vBksgLb#d&oy`|TvqaQ}*+%lAyHrt$*iYeL-1Iov z^2+=538UJ`k>vdNi!xNZQ^cYp)e|ViUYiaT3T9umkibN-?9+g)xyrA9R&^3@=G#16 zv1W_XT|}g=okgNG-+1P1PgBKzOiCu8J=0hB19+z==L{MB!R~^rthHC^v_#r;^sf)G zH@jJFbXl>KU1MBt$Ut8AC;NO#X^`D8pd)~gh{IB+-#F`-c zy;;BJ5(KeU-rJ39h_cuY>DSh6zL+0fbPvCObP1w9SetzxYD+yJfh!Ix#6lgnMvnEE zet3KQT2z;uU9vnhO;7zH88NUGG~ zx7Q{P!>6HpN_m&?7K8=ep>__Njg6?;VY#U}`sq6=i}+r=5;b9iYFIaCg}3IaJLaSt zJSev=$#opPX^2+ST`VZ$rw-`NHOpV6C%P7BdirZQ5oc1=Ahe=1er`@pqQ+U zpRuD?(a+e@@}LG@E_H9kcUU+|%WC&31S9N?Ei!m{Nt2$^1zhe+-_+RST{06}ar)kS z3${DJ@9hLQiXCHY9exS^Lj$7rLcCZXZ}BcobYF;}D+61eOM2FoTL3_5HUykxehJGv z+!iG{RdA-@=RYq-dU+g+F^if|18*^4UL~XwUx_n5t4*b+*j5m~(4I}<`ss?D$;l^9 zGtMsf#f36pT5DG6U*mhA`3OH#l|(@LJIirqGTfzJq4+(e9afM5I)6K}qfd9GzO66) z&D7+cyeR;Etwq+4SZo@Bj8u;{v-?p@P0E;SSZ@G5K~(Z69sg0@$8hDnZqv)&bSz+Gd%qX2n4szs~Bx(wFO6Mh#}SVf4g*Q zL|>wjVR91m*z!Uzew!ahd60J*bW9AkR|gExrAN!i4m8O3kIq#eQzR8_5m6h;uB`3S zr+YnMFx#*0$+h;+`1K=#H)|JMD=S zFMnoqClt~ipwwf8vO@bg!A$M0k4X2h|Co&v?DYdXy7ub^&&#w)2dpkT%6wOT5h7fXVnHK8f>Xi`LY$VC(u|WrOFQ zOg5{Pk=m(dtpN*ml*WNOkyr$1?aL=ftWaqT++;D8HG_DkEy6*hr;-@dzt7n*( zIAZ^Rspz;ZbOkcVrS{Zy1ufK0$LYb~;mQ_^lrRd$qdh}kqxO@AcYYgJMGwzqWw(Kf z^3GJ2$K6>!cVz^X)VJUPL{}(MqKfbHD?DC+hjebQR~5}=ZF2|w8mU*SiCI-c%ko5% z1=w0yI3yg9T_A+!NP(uul(r=J9kA0AWBTM4*=rA`SB>|kr*HP3W4w~oJ92`Ui=S2*bYZ@FuhHn28P z=BG@NshC<9bD3Av{UCO8rp-?s&#IqF7rpQ0E)As94_l9_!f%Kp`^i;OnBU*)UHklO zRK9%7hg&W8$M^?J%2B^v7`Lb4Ublwlr+FM%gPkHx)-4wPM4I)Wr0Bx=KNMwRd0}`t z_k!{M?oH~)=B_X9v?^BMTP=pkNt%+dD)cIbTQ!qTx%f@$#`C8*|K`n`cZ z&-5&(Bg+4p4gtI2Dy%7JSfq{Qv=~?>aRtw@j!s5%u)q&;{t$^g%JW5jd6`;*yc~c^ z07fUMSKGQ|x*SdmPCCGP3Hv4+4hR%h@bN$HSYE}~d8NSRL_W3|K#Z*Daj^X(Bv*2)2zNf51m!CLrg$T0(LIE!O+LaV0%`Jt$p8QnlttZ;|TX zcQh4Ak6ZewMOtvnd3-78h=0y3VeWgaVuuEIJMyy@4-<_;fidIU`mtw8R@k8S=m8H+ zI+~#Dl4)f!cE72vg0^4@do8?)aN7jq$s>CeKU+HwtWMLmZqsyQj`W)Gmp_t`$-u(v zae_O~QQejBwJJrsw6k;}QP4IM4Pcle6m?W?ZFKH6U+1MK%6a?jFfjF5;1@TWPW$rX z{=T{X+)@#;n@6|#qW*XjsR&1+2V7lqvGCSbF|*Q4)rgIK4@9iRGdr7c2*F7PN zlP9*DV_zHb8%>= zi>5h>`d?pQhXKK-!FV0Ct^&0Y{8sR~O&j<0fjy81l;8l_2y1j4-GH+Qpv%tsr^erL zIj@nutd6@|te5%f!%{f%bsg#jD;BRFmrD#j)bZLk?y$xI;U z*Q#Np(0u${<>;plkNdomsCZ!_Y6nLD+Xk|@kajKpJ>0105K`h8SfqgFzKMg5Xg06} zE#g>nt!}o!cAbsD7=Sf%CB!v6gu%a3k|Hw%Kv{)sDWJLB1M3;34ji*^iBx;%WV&_i z7J|BS6xD|n-l5P;h~eZYji)@3_j8otmw`t~Y+e5ehsL7!!ZR}h2~oNe1o6VA`9xLI z*@$|WNaEN|8WF{~5Mi}&6^8t(M(FpAzSFe5xXle<3eplZ!hWwJkX)nh+N3(+{=zdes zjL$3VgHl#}L?|#fWFTkBaEO&ZA@)pNPRZ9DX_h|cb#5n#e`h2sB~q>wj9<35O&RfQ z%SV%1?xYLRyZjp^+-PM2xF;%5cL!6X#pligG)q9CS5bQ`?xf zo-?%2*$A!@9lETbISZ4s&C-oUBmk#e+O=4>i%B_e0Jh zeLb|-xgWx8IM7Ae+rq>DLCAKAWyigt?(!0i`lP|s;mA0J^kw4#@D|dqPy*Sr+?O&& zfVet)rPv=FT68UUHs0g_pmGM?ztfT(P(Vy>=`W#S5-^hheG~j|cGKNWpng=_w=QUN z@Fl;H3*7tm=IgYdrE;GPiMpRfSN}BM`xEhxWWEbK;xivlO)_HrE!<_9TxIlM6i#K| z5SI!%%)w!2FXkujhTg~4Gm)(GifR#c-Mn@5?1jv7=iIKVWsbP94Q_B96g#uVdRZwf zzRYrg3VZ^d&74n8I@HgRG_*4EuiAo)fNPxN=D*EQ+JHhfU{SFNlE%BIth4p?bNQ+j z>&CWRApj%%9MP{lNX;=6rtTCCr-WkN+FXnUd9<|Lu!LPE3XYBTeKtvwpy7`cLnPsMWZ9 z%bk{iAp%_~Icfe~WfHAQBX}xd2G`UP_#*=ZhuG4KMXEdMpQ`WMsJv=Y5FxpaSEA3Pg-V~+@d+!J2eLZT8eJ4eI403&SVOEaZ(&zQm1ZY2+NE&)g#41OdwlV||^h50u^GyJ9G% zx+_8g(7@n#iZ?ZK`j_U^IAxm%Kl#uD@2!dK9_)A)XZh#|8Cza#x2b*~Rw0`y6%};d z-X25}1DJ2Q>QdmzPSvu(C8#*w8O=M%A2?Q&*g3_Z*l#U|Uo%@F3c*nkP+76Kmrxm1 zXokTw@;<{(L;X80JunKffx{3NJ5i_cLTNgDEa7KcnrswQAI>ZHApeBMGD3rBmodIZ zNtF15ZZI2fXd%C2I?ACb(zvr;7!_w~?nDTPGDtIH7jy%Rg%R1a2Bb-H$#?)OtiBH1 zi6IGO=j0vf#;97K0)`qBzQyPfUku-z;nfljQypiba|R~QaBL6I^8U28*fRFs*MT$s z6bo_L0nveIxJd+1T-NT-Fu*mz>vCzgwq$j8%;O*Yo>Y|c>)~wcGnxnXuZY9@uv~x; zT8?t{YEih9B-1L?y(fUzNO#`PN0h~R0G+A7<66SF6YVvk3=1z#G7;Z%U`S$ex4Zf9 zvE{H=(I+B0e3+`-A*?)e;Ztf-m)0b%=XiX22q+_zI|QEC$Vhkq{_29^H8i%giG#VO zt0a$Ly7^3RzR`OQ7=@qyNmF8bQ%Jr25eEr7l41m@c2~w+hN9Lzp`VHQyPQ6>-GnaXhOvy?If6(eVm2 zj@ma9gYW3HN#N*Q8`iM*)mUbIj#SUG9R=6Tyh-?#hz=bd8=r+-?Rb|-aKwsAV zD(##fp{OlH*8M%im2-6d9?}?g0qe`&y@v!4ik?Db@7_Z~IY+PSX($SX4m4Seeb-+{ zsTnt}cK8@K9`;5Rz+E0yu?KEsQ)A`p4}1F;Ykr9Q?uefH=0}svTww>3DqAf&!`E!| z?tU#i{O&nWQyn7Nsanm~V-uj3J4}yroU8Wn)+_@%l&L$-CKKTvHe`creDRi z^XZ{|)RR}nEUry>yN{^`zocXxL$Uf;9>HxgVD_biZk~aeTVPJchJ>m)# z=Kh*|m3sC!J(HJs^DPRBv@I2y^E5PNu zg3U;dafUIlSmku~hPh@*w;_UYj01oB$?U5#L#RF<8ka*nK@hrH>dlXs-3LmS+4v28 z-i=4#Zk-~q(F@o%u_52IZVf)=>sSYJNC7R5 z#H)ZyZQ`5rj@H2G38k*OwspI>)_u1Jvc{Wu3VVz>3ZlB-;PXFjH%xY%Hz2#A>97jD zxzCPOOO{+YxFba?r;U=Shm0btUQJ@izTs_OH!XM0QdaE2^-l^hy9qp>qp9$Y*Uv3V z+@FA7hdNS9ch*yQtn9#_FXc}n64p*{yxUkNc;o zRAr+;MvaCf)?3csXFo9QM|KowUCUV-##HhUnpbqwJ}ej?#>Y-l8;;V^N?VIn#6zp< zCy)`+&9*Xy*vF2ecQ7Uv{37}y#t6lH2jih7{X>c5KuhoF3Epc4B^PYdwE9BCAeX8* za@65Gx32g!Eb0i!5y7)3ZrbAit^n~Hs_6uu&f-??;{r~-H{8BnA;E5q2J*aH$%xM7 zFbD2;{cbm_`b6M68MWH)gCzgtDj$klHc4N$u$YierHp0*6%Sih#u#z>T9NAfvs7OX z6S4DgKU#brbw8i|?{%BA$R4to!r{|YAn=9q_lKc#Zb==_`nubO8D6SF(Cv5UBL?`S zLmqX}5sNr4_NiJLeR<_;z+{bs-YyKIHqP9M*QqsmoF=>WYzsDhoMMlK8rwm!Pm%|{ zTJoJr+sgUL#H%s=24Z8aQJ!JUXa@CWI1rS=i?*j@dNh zca|tkMQ+JOx*TD(LpcR4h%bvqWjC&hLWRY3DsX1FHQ6b<9V-qS zIl9+KiJ!)5(PiPIjhrX2H)qy-pa?<7sn`6J)_=f89>TWWSUgX5vg}@YwEW0xMHtgN zL(2+N3dQ9+O zu{Qhj7;A&tt#P5xABy#MQ*!*Awhzk5P?oP)yPbCYL-M+=Ec69mmwZk9Lmaz)c~E#> zcJ7<_n(g?QnfUAt-i>;G2t6#tDUGMNo{A&4GL=}0_%>OhSszwDW6@XqS3jto)!>Ng z?w(|IW}X9+8f(&o?H7`N-pxc@g~B^8Fhs8O)j~~M=P!DkdF<_-NHv@^*Aqp>6w-Id(VBN z6lh5KLH++@{3wJS5Vy*nDK_QYa$GeUAQ(EtZxUJ|yFz+o-uzBG8l~BX zs7j0pPuaapddFMInQLqnxvY>zR6!_NEK7!F?N&0gL`c;kW&<51a_(zow8^|L^7V`y zrYV%?OD39{zj*4(@S3bdoXt=4BqwsNe^cFNqAl$LTv#ZZ+)wVWcUY=EEZ4Z9!=va6 zC6{8Iq0JzpTK6Y?!zeSEJ-3ewB{J*(75y^_Es@Pwy8;bkS-E8=(|v#wTB)SVpvP9| z4IWWiAY^X;2d5IPNbES`O&3+2#-gh#&zm;woOSO^bg?P&W(p`VtY!4dE6hRH8C#bc z843_OuCh-F!bJV)Du?SOXKoa)b8JVXlGyfzIrOuj5kaNCyY~dAE_F4Tx8Qfa8(!oV zLSyakb%-jJ#a6x;0@|aGaNW=LBx`?)JRaFRe^j<6tAt$dPx8~+x)c9_S*5oOpRcXm zUQ|>M`dx>w>r_(}O9qRSZ$TKMgdDL&yTimS~nP!;b?1X#y#82`M>qH%kZ*X2EntMC2|}wI(3s^T^imeypy0kCF-gnKLFU&4NAZLn9 zg+H?ZkWEr44gYJ+j81g|$8m-la_9bPTmJ^b`Zr7GrujCyMLYVk_Lk}^N}j0(-m!NI zooLh3B5qoXlxxUc!NY&@=ORvK&nv*s#c>h=Vaguifc%mbHR+eVs>xP9=dW5R;dutL` zDIK9O?Vk7rk8UFPZ}8ttKj0D8XEhzc45c-YsjZ9W(CTx#!XjyXI^B&YZtzAc1WD%7i!hd|S@F5hbq<+7g?=slNen(#8zq+vJL&LV+!y${9&~{sH z(d{VQ)9g&0{!|*w8NF9|d~e&M7z^{D^9Zx)FiDUNm1=H@K!NcHEZ%99Bs9_0^Q`vW zIL#t1CDso~2<#IqYV~|qxYijL{r-n>pFU?{6j_e>aa&TaKe)cqJO2 zIHgD0ps}c^mw=kDXHW|A&`p&Uh0E@h!n0yi8L5?_y9>!}^67b}eL&Y_KdOuS4Ssm~ zlj&_b^{K&hEls2cYD~f$^w--9H!BtKW&C2zz2g*f)DD5Es;i*ARTqX%XsBr?#y7HK z-i%McP6Gm_vM_=b5l{~2lBvd|$YLr$God!?tF-9CwZ1G@$v?;uFNHX4eyN;x=}sDXKKpSC$C5`Em}y{ZC1LN=G=!|7J3*_KLJyO8rc^ z7NonlHTHb339s1&E%({MlA)z{HuwSs{?Shz?Ea0Z(E;vFS<8H#NH6C^-oNG z(hyF(Bvq(xkbtNKI0HzGZtW0BJ)>HeV{2Sk!$0Pl!+P*G<1q*9h!x{IP6jwd#u_+Y zxUT5euy6`b~vr3-T8!}WWn7h_uq7!XcQvIxtUYAJ?MZaTRY~?&Zz}~Ci3qWR2 z?L^5DNCWKvu;kt~d>$p|@%QH>O0X!Q#7u}0!i z@2hT5djHo@&4YxGNCL6gkBA?<;ejA^G&L@Y6h0J_dbDfMI^Ku5WruI{_0b`kl{1xu z_}$W>X|s)7h9;l$v6^gr`g8Gaxv$4yByr zMWr9MMQM-1a9R6haCXF`LR{)0Yn=6B!6VR?J3k8JO7gg_eE@KMizQtRp;yu+%Ln_2 zQChI^_|{(gm=Seikn*+$(dX>C$yjvxauS`7zp2FD)_QH8fMBt~(YeIt z+74usm^jO#+5iD%_UcDrTzu(P>4R(r#| zY7-bT4TL*KzB%XISPb)O1D+)68)!w*SfiOS=9i1rUO{1@{~`E*fG>88_s*CVW@Z$( ztF{F|Amo0hbr>zYq|dIek*(U)ud5k{#6w#Gge@(5KVq{hs14x0FQvnfpFq0Jg@pHX z@SUUI!I4nGgWY1I@c_n`0RHIPD5ZLp@sP!SA8N-4R8sX_c7A*ED~awn%j3Z zANKbJjX0J$vYV#&(MWv!J7gpT@eE7oI}{{b_x#pn5J2FRR0qOfSBs4E9oyP8&sNB! zk>8rjbI550SQD~*>J~!If;SC@1~TWedG&%)_e|TpJztF+yneb0XW*Ez(s_2wU?xI2 ziPG(V+;V{t*YAP6tr<22S`;uD7I;5jAYk=@t!v%=9$yvbOUT&*Ayr+*g}t>3s8;Au z76^JHrNvBD(eTv14yx(dMKN4oeJwIwnx9BnSz9^UPFXoxN|pM}aJ?87RXPhf$_573 zkN@U;$j&j_5Xp+E9e>iH2&A15*5;88LaH{uhRt2+^HarStD9}? zO6Q(QgEAQ{){nmi9Um93LZqa3jPT_;JCqpiAbU(6dyeduH2NoEYjNOtX|8u1k&8lU zJT~X5yQ%g|y_)1`z1RB`e7pC)(`L#pcXZ`YySrwo?EE_g9dEAa)7dK32Ny=0wed8H z<+=Xx^gG95O!Yed&yD~JgsY_U(At@FF+5geT(e-K$`Gv+U&yl1ba}4kmc+ihE;VZy zPKhTRmiUj96LcO<#bc*koNjchHxM4iwjqt-_LB;DU@^sG)}cCT2&M#sx;|7m>msXZ z!LHE__DU|$;XUsf?BYLurF0Iht>HtN9cpkZ;NN%rJrn$9Hmfz6#AY|0+M=*z9Iq9O zFw*9{L|#rZ&yr(83~E1)j2>iW^PKR3|T|}}vHVKW0#YVNR>X=At zI=&kHds9K~6vO3HYg3irjF_KK_CJ8Gp2_cL`52UIU#zyqM zST_hy>#j+E)eJ}$lA5Z`oY}6*ew5$zJYBfKxpox>br%~&Vc|iGws&I3sg>IJCRbD; z*OsE+IH4q~p#Nb@7R0!&t-i{SPlZiB5YHJ`_h|}9eb*d7bf;aw;;l~SVw@7y`0yj- ztxPqx74U>9paGQd1YZRqQGi9>>YpFSXka>p$KGdC*C|;3msW9os7b zp{I=yD`>OLrwYA}B*-dd6&j8Zwk=K=rkKe3XKb&W~xh+{b z!&sZ;YZKQ2pQB{(65nJzmbA#V7G&9t9pXP?vTst3lU6GHR8>r9+D{k7fiJ%yS%<1E zb1bl7y=QIO?5hkC5)n`-_%8G@Sa^5I|E;O&?bZHGNKpn73KQagKUnKs(fGez|I0C3 m|31jSYa;*G2$An+cKr{9WJMWRxW8SX-haXGUc>tD-G2bgi0BXi literal 0 HcmV?d00001 diff --git a/Solutions/Malware Protection Essentials/Package/createUiDefinition.json b/Solutions/Malware Protection Essentials/Package/createUiDefinition.json index 19402047074..719887e5f3f 100644 --- a/Solutions/Malware Protection Essentials/Package/createUiDefinition.json +++ b/Solutions/Malware Protection Essentials/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Malware%20Protection%20Essentials/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nMalware Protection Essentials is a [domain solution](https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fsentinel%2Fsentinel-solutions-catalog%23domain-solutions&data=05%7C01%7Ckavishbakshi%40microsoft.com%7Cbe2a496082b24caa4b8c08da9cefacca%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637994850502413731%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=OJegu%2B2EqD7rmYmK9pm9QniD6YWp5ooloZ6tHzcwVi0%3D&reserved=0) and does not include any data connectors. The content in this solution requires one of the product solutions below , as well as any other connector or data source normalized to the [ASIM](https://aka.ms/AboutASIM).\n\n**Prerequisite :-**\n\n Install one or more of the listed solutions, or develop your custom ASIM parsers to unlock the value provided by this solution.\n 1. Amazon Web Services \n 2. Azure Firewall \n 3. Azure Network Security Groups \n 4. Check Point \n 5. Cisco ASA \n 6. Cisco Meraki Security Events \n 7. Corelight \n 8. Fortinet FortiGate \n 9. Microsoft Defender for IoT \n 10. Microsoft Defender for Cloud \n 11. Microsoft Sysmon For Linux \n 12. Windows Firewall \n 13. Palo Alto PANOS \n 14. Vectra AI Stream \n 15. WatchGuard Firebox \n 16. Zscaler Internet Access \n\n**Underlying Microsoft Technologies used:** \n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs: \n 1. Product solutions as described above \n 2. Logic app for data summarization\n\n**Recommendation :-**\n\nIt is highly recommended to use the **Summarize data** logic app playbook provided with this solution as it will significantly improve the performance of the Workbook, Analytic rules & Hunting queries.\n\n**Workbooks:** 1, **Analytic Rules:** 6, **Hunting Queries:** 6, **Watchlists:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Malware%20Protection%20Essentials/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nMalware Protection Essentials is a [domain solution](https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fsentinel%2Fsentinel-solutions-catalog%23domain-solutions&data=05%7C01%7Ckavishbakshi%40microsoft.com%7Cbe2a496082b24caa4b8c08da9cefacca%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637994850502413731%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=OJegu%2B2EqD7rmYmK9pm9QniD6YWp5ooloZ6tHzcwVi0%3D&reserved=0) and does not include any data connectors. The content in this solution requires one of the product solutions below , as well as any other connector or data source normalized to the [ASIM](https://aka.ms/AboutASIM).\n\n**Prerequisite :-**\n\n Install one or more of the listed solutions, or develop your custom ASIM parsers to unlock the value provided by this solution.\n 1. Amazon Web Services \n 2. Azure Firewall \n 3. Azure Network Security Groups \n 4. Check Point \n 5. Cisco ASA \n 6. Cisco Meraki Security Events \n 7. Corelight \n 8. Fortinet FortiGate \n 9. Microsoft Defender for IoT \n 10. Microsoft Defender for Cloud \n 11. Microsoft Sysmon For Linux \n 12. Windows Firewall \n 13. Palo Alto PANOS \n 14. Vectra AI Stream \n 15. WatchGuard Firebox \n 16. Zscaler Internet Access \n\n**Underlying Microsoft Technologies used:** \n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs: \n 1. Product solutions as described above \n 2. Logic app for data summarization\n\n**Recommendation :-**\n\nIt is highly recommended to use the **Summarize data** logic app playbook provided with this solution as it will significantly improve the performance of the Workbook, Analytic rules & Hunting queries.\n\n**Workbooks:** 1, **Analytic Rules:** 6, **XDR Detections:** 6, **Hunting Queries:** 6, **Watchlists:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -51,6 +51,47 @@ } ], "steps": [ + { + "name": "contentSelection", + "label": "Content selection", + "elements": [ + { + "name": "DeployAnalyticsRule", + "type": "Microsoft.Common.CheckBox", + "label": "DeployAnalyticsRule", + "defaultValue": true, + "toolTip": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." + }, + { + "name": "DeployWorkbook", + "type": "Microsoft.Common.CheckBox", + "label": "DeployWorkbook", + "defaultValue": true, + "toolTip": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." + }, + { + "name": "DeployCustomDetection", + "type": "Microsoft.Common.CheckBox", + "label": "DeployCustomDetection", + "defaultValue": false, + "toolTip": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." + }, + { + "name": "DeployHuntingQuery", + "type": "Microsoft.Common.CheckBox", + "label": "DeployHuntingQuery", + "defaultValue": true, + "toolTip": "Deploy the Microsoft Sentinel hunting queries carried by this solution." + }, + { + "name": "DeployWatchlist", + "type": "Microsoft.Common.CheckBox", + "label": "DeployWatchlist", + "defaultValue": true, + "toolTip": "Deploy the watchlists and their registrations carried by this solution." + } + ] + }, { "name": "workbooks", "label": "Workbooks", @@ -353,7 +394,12 @@ "outputs": { "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]", "location": "[location()]", - "workspace": "[basics('workspace')]" + "workspace": "[basics('workspace')]", + "DeployAnalyticsRule": "[steps('contentSelection').DeployAnalyticsRule]", + "DeployWorkbook": "[steps('contentSelection').DeployWorkbook]", + "DeployCustomDetection": "[steps('contentSelection').DeployCustomDetection]", + "DeployHuntingQuery": "[steps('contentSelection').DeployHuntingQuery]", + "DeployWatchlist": "[steps('contentSelection').DeployWatchlist]" } } } diff --git a/Solutions/Malware Protection Essentials/Package/mainTemplate.json b/Solutions/Malware Protection Essentials/Package/mainTemplate.json index 32235a2ac84..bb57bf3a99c 100644 --- a/Solutions/Malware Protection Essentials/Package/mainTemplate.json +++ b/Solutions/Malware Protection Essentials/Package/mainTemplate.json @@ -43,13 +43,48 @@ "metadata": { "description": "Name for the workbook" } + }, + "DeployAnalyticsRule": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." + } + }, + "DeployWorkbook": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." + } + }, + "DeployCustomDetection": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." + } + }, + "DeployHuntingQuery": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel hunting queries carried by this solution." + } + }, + "DeployWatchlist": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the watchlists and their registrations carried by this solution." + } } }, "variables": { "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "Malware Protection Essentials", - "_solutionVersion": "3.0.1", + "_solutionVersion": "3.2.2", "solutionId": "azuresentinel.azure-sentinel-solution-malwareprotection", "_solutionId": "[variables('solutionId')]", "analyticRuleObject1": { @@ -145,7 +180,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "StartupRegistryModified_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "StartupRegistryModified_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -352,7 +387,8 @@ "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -363,7 +399,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PrintProcessersModified_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "PrintProcessersModified_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -568,7 +604,8 @@ "contentProductId": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", "id": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -579,7 +616,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SuspiciousProcessCreation_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "SuspiciousProcessCreation_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -764,7 +801,8 @@ "contentProductId": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", "id": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -775,7 +813,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BackupDeletionDetected_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "BackupDeletionDetected_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", @@ -958,7 +996,8 @@ "contentProductId": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", "id": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -969,7 +1008,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "WindowsUpdateDisabled_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "WindowsUpdateDisabled_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", @@ -1173,7 +1212,8 @@ "contentProductId": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", "id": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", "version": "[variables('analyticRuleObject5').analyticRuleVersion5]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1184,7 +1224,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "WindowsAllowFirewallRuleAdded_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "WindowsAllowFirewallRuleAdded_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", @@ -1388,7 +1428,8 @@ "contentProductId": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", "id": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", "version": "[variables('analyticRuleObject6').analyticRuleVersion6]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1399,7 +1440,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NewMaliciousScheduledTask_HuntingQueries Hunting Query with template version 3.0.1", + "description": "NewMaliciousScheduledTask_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", @@ -1408,7 +1449,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "Malware_Protection_Essentials_Hunting_Query_1", "location": "[parameters('workspace-location')]", "properties": { @@ -1473,7 +1514,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1484,7 +1526,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileCretaedInStartupFolder_HuntingQueries Hunting Query with template version 3.0.1", + "description": "FileCretaedInStartupFolder_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]", @@ -1493,7 +1535,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "Malware_Protection_Essentials_Hunting_Query_2", "location": "[parameters('workspace-location')]", "properties": { @@ -1558,7 +1600,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1569,7 +1612,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FilesWithRansomwareExtensions_HuntingQueries Hunting Query with template version 3.0.1", + "description": "FilesWithRansomwareExtensions_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]", @@ -1578,7 +1621,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "Malware_Protection_Essentials_Hunting_Query_3", "location": "[parameters('workspace-location')]", "properties": { @@ -1643,7 +1686,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1654,7 +1698,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NewScheduledTaskCreation_HuntingQueries Hunting Query with template version 3.0.1", + "description": "NewScheduledTaskCreation_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]", @@ -1663,7 +1707,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "Malware_Protection_Essentials_Hunting_Query_4", "location": "[parameters('workspace-location')]", "properties": { @@ -1728,7 +1772,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1739,7 +1784,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SystemFilesModifiedByUser_HuntingQueries Hunting Query with template version 3.0.1", + "description": "SystemFilesModifiedByUser_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]", @@ -1748,7 +1793,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "Malware_Protection_Essentials_Hunting_Query_5", "location": "[parameters('workspace-location')]", "properties": { @@ -1813,7 +1858,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1824,7 +1870,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ExecutableInUncommonLocation_HuntingQueries Hunting Query with template version 3.0.1", + "description": "ExecutableInUncommonLocation_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject6').huntingQueryVersion6]", @@ -1833,7 +1879,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "Malware_Protection_Essentials_Hunting_Query_6", "location": "[parameters('workspace-location')]", "properties": { @@ -1898,7 +1944,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',parameters('watchlist1-id'))]", @@ -1916,7 +1963,8 @@ "itemsSearchKey": "FileExtension", "rawContent": "FileExtension,Description,Enabled\r\n_AiraCropEncrypted,AiraCrop Ransomware affecte file,Yes\r\n1cbu1,Princess Locker ransomware affected file,Yes\r\n1txt,Enigma ransomware affected file,Yes\r\n73i87A,Xorist Ransomware affected data,Yes\r\na5zfn,Alma Locker ransomware affected data,Yes\r\naaa,TeslaCrypt ransomware encrypted data,No\r\nabc,TeslaCrypt ransomware encrypted data,Yes\r\nadk,Angry Duck ransomware affected file,Yes\r\naesir,Locky ransomware affected file,Yes\r\nalcatraz,Alcatraz Locker ransomware affected file,Yes\r\nangelamerkel,Angela Merkel ransomware affected file,Yes\r\nAngleWare,HiddenTear/MafiaWare (variant) ransomware affected file,Yes\r\nantihacker2017,Xorist (variant) Ransomware affected file,Yes\r\natlas,Atlas ransomware affected file,Yes\r\naxx,AxCrypt encrypted data,Yes\r\nBarRax,BarRax (HiddenTear variant) ransomware affected file,Yes\r\nbin,Alpha/Alfa ransomware affected data,No\r\nbitstak,Bitstak ransomware affected data,Yes\r\nbraincrypt,Braincrypt ransomware affected file,Yes\r\nbreaking_bad,Files1147@gmail(.)com ransomware affected data,Yes\r\nbript,BadEncriptor ransomware affected file,Yes\r\nbtc,Jigsaw Ransomware affected data,Yes\r\nccc,TeslaCrypt or Cryptowall encrypted data,No\r\nCCCRRRPPP,Unlock92 ransomware affected data,Yes\r\ncerber,Cerber ransomware affected data,Yes\r\ncerber2,Cerber 2 ransomware affected file,Yes\r\ncerber3,Cerber 3 ransomware affected data,Yes\r\ncoded,Anubis ransomware affected file,Yes\r\ncomrade,Comrade ransomware affected file,Yes\r\nconficker,Conficker ransomware affected file,Yes\r\ncoverton,Coverton ransomware affected data,Yes\r\ncovid19,Phishing / ransomware file,Yes\r\ncovid-19,Phishing / ransomware file,Yes\r\ncrab,GandCrab ransomware affected data,Yes\r\ncrinf,DecryptorMax or CryptInfinite ransomware affected data,Yes\r\ncrjoker,CryptoJoker ransomware affected data,Yes\r\ncrptrgr,CryptoRoger ransomware affected data,Yes\r\ncry,CryLocker ransomware affected data,Yes\r\ncryeye,DoubleLocker ransomware affected data,Yes\r\ncryp1,CryptXXX ransomware affected data,Yes\r\ncrypt,Scatter ransomware affected data,Yes\r\ncrypte,Jigsaw (variant) ransomware affected file,Yes\r\ncrypted,Nemucod ransomware affected file,Yes\r\ncryptolocker,CryptoLocker encrypted file,Yes\r\ncryptowall,Encrypted file by Cryptowall ransomware,Yes\r\ncrypz,CryptXXX ransomware affected data,Yes\r\nczvxce,Coverton ransomware affected file,Yes\r\nd4nk,PyL33T ransomware affected file,Yes\r\ndale,Chip ransomware affected file,Yes\r\ndamage,Damage ransomware affected file,Yes\r\ndarkness,Rakhni ransomware affected data,Yes\r\ndCrypt,DummyLocker ransomware affected file,Yes\r\ndeadbolt,Deadbolt ransomware affected file,Yes\r\ndecrypt2017,Globe 3 ransomware affected file,Yes\r\nderp,Derp ransomware renamed file,Yes\r\nDexter,Troldesh (variant) ransomware affected file,Yes\r\ndharma,CrySiS ransomware affected file,Yes\r\ndll,FSociety ransomware affected file,No\r\ndxxd,DXXD ransomware affected file,Yes\r\necc,Cryptolocker or TeslaCrypt virus encrypted file,Yes\r\nedgel,EdgeLocker ransomware affected file,Yes\r\nenc,TorrentLocker ransomware affected file,No\r\nenc,Cryptorium ransomware affected file,No\r\nenciphered,Malware (ransomware) encoded data,Yes\r\nEnCiPhErEd,Xorist Ransomware affected data,Yes\r\nencr,FileLocker ransomware affected file,Yes\r\nencrypt,Alpha ransomware affected data,Yes\r\nencrypted,Various ransomware affected file,Yes\r\nencrypted,Donald Trump ransomware affected file,Yes\r\nencrypted,KeRanger OS X ransomware affected file,Yes\r\nenigma,Coverton ransomware affected data,Yes\r\nevillock,Evil-JS (variant) ransomware affected file,Yes\r\nexotic,Exotic ransomware affected file,Yes\r\nexx,Alpha Crypt encrypted data,Yes\r\nezz,Alpha Crypt virus encrypted data,Yes\r\nfantom,Fantom ransomware affected data,Yes\r\nfile0locked,Evil ransomware affected file,Yes\r\nfucked,Manifestus ransomware affected file,Yes\r\nfun,Jigsaw Ransomware affected data,Yes\r\nfun,Jigsaw (variant) ransomware affected file,Yes\r\ngefickt,Jigsaw (variant) ransomware affected file,Yes\r\nglobe,Globe ransomware affected file,Yes\r\ngood,Scatter ransomware affected data,Yes\r\ngrt,Karmen HiddenTear (variant) ransomware affected file,Yes\r\nha3,El-Polocker affected file,Yes\r\nhelpmeencedfiles,Samas/SamSam ransomware affected file,Yes\r\nherbst,Herbst ransomware affacted data,Yes\r\nhnumkhotep,Globe 3 ransomware affected file,Yes\r\nhush,Jigsaw ransomware affected file,Yes\r\nifuckedyou,SerbRansom ransomware affected file,Yes\r\ninfo,PizzaCrypts Ransomware affected data,Yes\r\nkernel_complete,KeRanger OS X ransomware data,Yes\r\nkernel_pid,KeRanger OS X ransomware data,Yes\r\nkernel_time,KeRanger OS X ransomware,Yes\r\nkeybtc@inbox_com,KeyBTC ransomware affected data,Yes\r\nkimcilware,KimcilWare ransomware affected data,Yes\r\nkkk,Jigsaw Ransomware affected data,Yes\r\nkostya,Kostya ransomware affected file,Yes\r\nkrab,GandCrab v4 ransomware affected data,Yes\r\nkraken,Rakhni ransomware affected file,Yes\r\nkratos,KratosCrypt ransomware affected data,Yes\r\nkyra,Globe ransomware affected file,Yes\r\nlcked,Jigsaw (variant) ransomware affected file,Yes\r\nLeChiffre,LeChiffre ransomware affected data,Yes\r\nlegion,Legion ransomware affected data,Yes\r\nlesli,CryptoMix ransomware affected file,Yes\r\nlock93,Lock93 ransomware affected file,Yes\r\nlocked,Various ransomware affected data,Yes\r\nlocklock,LockLock ransomware affected data,Yes\r\nlocky,Locky ransomware affected data,Yes\r\nlol!,GPCode ransomware affected data,Yes\r\nloli,LOLI RanSomeWare ransomware affected file,Yes\r\nlovewindows,Globe (variant) ransomware affected file,Yes\r\nmadebyadam,Roga ransomware affected file,Yes\r\nmagic,Magic ransomware affected data,Yes\r\nmaya,HiddenTear (variant) ransomware affected file,Yes\r\nMERRY,Merry X-Mas ransomware affected file,Yes\r\nmicro,TeslaCrypt 3.0 ransomware encrypted data,Yes\r\nmole,CryptoMix (variant) ransomware affected data,Yes\r\nmp3,TeslaCrypt 3.0 ransomware encrypted data,No\r\nMRCR1,Merry X-Mas ransomware affected file,Yes\r\nnoproblemwedecfiles​,Samas/SamSam ransomware affected file,Yes\r\nnuclear55,Nuke ransomware affected file,Yes\r\nodcodc,ODCODC ransomware affected file,Yes\r\nodin,Locky ransomware affected file,Yes\r\nonion,Dharma ransomware affected data,Yes\r\noops,Marlboro ransomware affected file,Yes\r\nosiris,Locky (variant) ransomware affected data,Yes\r\np5tkjw,Xorist Ransomware affected data,Yes\r\npadcrypt,PadCrypt ransomware affected data,Yes\r\npaym,Jigsaw Ransomware affected data,Yes\r\npaymrss,Jigsaw Ransomware affected file,Yes\r\npayms,Jigsaw Ransomware affected file,Yes\r\npaymst,Jigsaw Ransomware affected file,Yes\r\npaymts,Jigsaw Ransomware affected file,Yes\r\npayrms,Jigsaw Ransomware affected file,Yes\r\npays,Jigsaw Ransomware affected data,Yes\r\npdcr,PadCrypt Ransomware script,Yes\r\npec,PEC 2017 ransomware affected file,Yes\r\nPEGS1,Merry X-Mas ransomware affected file,Yes\r\nperl,Bart ransomware affected file,Yes\r\nPoAr2w,Xorist Ransomware affected file,Yes\r\npotato,Potato ransomware affected file,Yes\r\npowerfulldecrypt,Samas/SamSam ransomware affected file,Yes\r\npubg,PUBG ransomware affected data,Yes\r\npurge,Globe ransomware affected file,Yes\r\npzdc,Scatter ransomware affected data,Yes\r\nR16m01d05,Ransomware affected data,Yes\r\nr5a,7ev3n ransomware affected file,Yes\r\nraid10,Globe [variant] ransomware affected file,Yes\r\nRARE1,Merry X-Mas ransomware affected file,Yes\r\nrazy,Razy ransomware affected data,Yes\r\nrdm,Radamant ransomware affected file,Yes\r\nrealfs0ciety@sigaint.org.fs0ciety,Fsociety ransomware affected file,Yes\r\nreco,STOP/DJVU ransomware file,Yes\r\nrekt,HiddenTear (variant) ransomware affected file,Yes\r\nrekt,RektLocker ransomware affected data,Yes\r\nremk,STOP Ransomware variant,Yes\r\nrip,KillLocker ransomware affected file,Yes\r\nRMCM1,Merry X-Mas ransomware affected file,Yes\r\nrmd,Zeta ransomware affected file,Yes\r\nrnsmwr,Gremit ransomware affected file,Yes\r\nrokku,Rokku ransomware affected data,Yes\r\nrrk,Radamant v2 ransomware affected file,Yes\r\nruby,Ruby ransomware affected file,Yes\r\nsage,Sage ransomware affected data,Yes\r\nSecureCrypted,Apocalypse ransomware affected file,Yes\r\nserp,Serpent (variant) ransomware affected file,Yes\r\nserpent,Serpent ransomware affected file,Yes\r\nsexy,PayDay ransomware affected files,Yes\r\nshit,Locky ransomware affected file,Yes\r\nspora,Spora ransomware affected file,Yes\r\nstn,Satan ransomware affected file,Yes\r\nsurprise,Surprise ransomware affected data,Yes\r\nszf,SZFLocker ransomware affected data,Yes\r\ntheworldisyours,Samas/SamSam ransomware affected file,Yes\r\nthor,Locky ransomware affected file,Yes\r\nttt,TeslaCrypt 3.0 ransomware encrypted data,Yes\r\nunavailable,Al-Namrood ransomware affected file,Yes\r\nvbransom,VBRansom 7 ransomware affected file,Yes\r\nvenusf,Venus Locker ransomware affected file,Yes\r\nVforVendetta,Samsam (variant) ransomware affected file,Yes\r\nvindows,Vindows Locker ransomware affected file,Yes\r\nvvv,TeslaCrypt 3.0 ransomware encrypted data,Yes\r\nvxlock,vxLock ransomware affected file,Yes\r\nwallet,Globe 3 (variant) ransomware affected file,Yes\r\nwcry,WannaCry ransomware affected file,Yes\r\nwflx,WildFire ransomware affected file,Yes\r\nWhereisyourfiles,Samas/SamSam ransomware affected file,Yes\r\nwindows10,Shade ransomware affected data,Yes\r\nwncry,Wana Decrypt0r 2.0 ransomware affected data,Yes\r\nxxx,TeslaCrypt 3.0 ransomware encrypted file,Yes\r\nxxx,help_dcfile ransomware affected file,Yes\r\nxyz,TeslaCrypt ransomware encrypted data,No\r\nytbl,Troldesh (variant) ransomware affected file,Yes\r\nzcrypt,ZCRYPT ransomware affected data,Yes\r\nzepto,Locky ransomware affected data,Yes\r\nzorro,Zorro ransomware affected file,Yes\r\nzyklon,ZYKLON ransomware affected data,Yes\r\nzzz,TeslaCrypt ransomware encrypted data,Yes\r\nzzzzz,Locky ransomware affected file,Yes\r\n" }, - "apiVersion": "2022-11-01" + "apiVersion": "2022-11-01", + "condition": "[parameters('DeployWatchlist')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1927,7 +1975,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MalwareProtectionEssentialsWorkbook Workbook with template version 3.0.1", + "description": "MalwareProtectionEssentialsWorkbook Workbook with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -2004,19 +2052,20 @@ "contentProductId": "[variables('_workbookcontentProductId1')]", "id": "[variables('_workbookcontentProductId1')]", "version": "[variables('workbookVersion1')]" - } + }, + "condition": "[parameters('DeployWorkbook')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.1", + "version": "3.2.2", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Malware Protection Essentials", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

Malware Protection Essentials is a domain solution and does not include any data connectors. The content in this solution requires one of the product solutions below , as well as any other connector or data source normalized to the ASIM.

\n

Prerequisite :-

\n

Install one or more of the listed solutions, or develop your custom ASIM parsers to unlock the value provided by this solution.

\n
    \n
  1. Amazon Web Services
    2. \n
  2. Azure Firewall
    3. \n
  3. Azure Network Security Groups
    4. \n
  4. Check Point
    5. \n
  5. Cisco ASA
    6. \n
  6. Cisco Meraki Security Events
    7. \n
  7. Corelight
    8. \n
  8. Fortinet FortiGate
    9. \n
  9. Microsoft Defender for IoT
    10. \n
  10. Microsoft Defender for Cloud
    11. \n
  11. Microsoft Sysmon For Linux
    12. \n
  12. Windows Firewall
    13. \n
  13. Palo Alto PANOS
    14. \n
  14. Vectra AI Stream
    15. \n
  15. WatchGuard Firebox
    16. \n
  16. Zscaler Internet Access
    17. \n
\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n
  1. Product solutions as described above
    2. \n
  2. Logic app for data summarization
    3. \n
\n

Recommendation :-

\n

It is highly recommended to use the Summarize data logic app playbook provided with this solution as it will significantly improve the performance of the Workbook, Analytic rules & Hunting queries.

\n

Workbooks: 1, Analytic Rules: 6, Hunting Queries: 6, Watchlists: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

Malware Protection Essentials is a domain solution and does not include any data connectors. The content in this solution requires one of the product solutions below , as well as any other connector or data source normalized to the ASIM.

\n

Prerequisite :-

\n

Install one or more of the listed solutions, or develop your custom ASIM parsers to unlock the value provided by this solution.

\n
    \n
  1. Amazon Web Services
    2. \n
  2. Azure Firewall
    3. \n
  3. Azure Network Security Groups
    4. \n
  4. Check Point
    5. \n
  5. Cisco ASA
    6. \n
  6. Cisco Meraki Security Events
    7. \n
  7. Corelight
    8. \n
  8. Fortinet FortiGate
    9. \n
  9. Microsoft Defender for IoT
    10. \n
  10. Microsoft Defender for Cloud
    11. \n
  11. Microsoft Sysmon For Linux
    12. \n
  12. Windows Firewall
    13. \n
  13. Palo Alto PANOS
    14. \n
  14. Vectra AI Stream
    15. \n
  15. WatchGuard Firebox
    16. \n
  16. Zscaler Internet Access
    17. \n
\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n
  1. Product solutions as described above
    2. \n
  2. Logic app for data summarization
    3. \n
\n

Recommendation :-

\n

It is highly recommended to use the Summarize data logic app playbook provided with this solution as it will significantly improve the performance of the Workbook, Analytic rules & Hunting queries.

\n

Workbooks: 1, Analytic Rules: 6, XDR Detections: 6, Hunting Queries: 6, Watchlists: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -2103,7 +2152,7 @@ { "kind": "Watchlist", "contentId": "[variables('_Ransomware File Extensions')]", - "version": "3.0.1" + "version": "3.2.2" }, { "kind": "Workbook", @@ -2173,6 +2222,36 @@ { "kind": "Solution", "contentId": "zscaler1579058425289.zscaler_internet_access_mss" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-259de2c1-c546-4c6d-a17c-df639722f4d7", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-7edde3d4-9859-4a00-b93c-b19ddda55320", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-dd041e4e-1ee2-41ec-ba4e-82a71d628260", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-fdbcc0eb-44fb-467e-a51d-a91df0780a81", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-056593d4-ca3b-47a7-be9d-d1d0884a1d36", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-f1443a87-78d5-40c3-b051-f468f0f2def0", + "version": "3.2.1" } ] }, @@ -2188,6 +2267,1611 @@ } }, "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "MalwareProtectionEssentials-CD-xdr-259de2c1-c546-4c6d-a-871268a6", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "detectionAction": { + "alertTemplate": { + "customDetails": { + "ProcessCommandLine": "CommandLine", + "ProcessProcessId": "TargetProcessId" + }, + "title": "Detect Malicious Usage of Recovery Tools to Delete Backup Files", + "tactics": [ + { + "techniques": [ + { + "technique": "T1490" + } + ], + "tactic": "Impact" + } + ], + "severity": "high", + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "ntDomainColumn": "NTDomain", + "nameColumn": "Username", + "upnSuffixColumn": "UPNSuffix" + } + ], + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "DvcIpAddr" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DvcDomain", + "nameColumn": "DvcHostname", + "ntDomainColumn": "NTDomain" + } + ] + }, + "description": "This analytic rule detects usage of recovery tools vssadmin, wbadmin, wmic and bcedit to delete backup files or change recovery configuration. Adversaries may use these tools to delete shadow copies and backup files to prevent recovery of files.\nhttps://attack.mitre.org/techniques/T1490/" + } + }, + "queryCondition": { + "queryText": "_ASim_ProcessEvent\n| where TargetProcessFilename has_any ('vssadmin.exe', 'wbadmin.exe', 'wmic.exe')\n| where CommandLine has_all ('delete', 'shadow')\n| union isfuzzy=True\n (_ASim_ProcessEvent\n | where TargetProcessFilename =~ 'bcedit.exe'\n | where CommandLine has_all ('/set', 'recoveryenabled no')\n )\n| project\n TimeGenerated,\n DvcHostname,\n DvcIpAddr,\n DvcDomain,\n TargetUsername,\n TargetUsernameType,\n TargetProcessName,\n TargetProcessId,\n CommandLine\n| extend Username = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\\\')[1]), TargetUsername)\n| extend NTDomain = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\\\')[0]), TargetUsername)\n| extend Username = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[0]), Username)\n| extend UPNSuffix = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[1]), '')" + }, + "displayName": "Detect Malicious Usage of Recovery Tools to Delete Backup Files", + "id": "[if(true(), 'xdr-259de2c1-c546-4c6d-a17c-df639722f4d7', 'xdr-259de2c1-c546-4c6d-a17c-df639722f4d7')]", + "schedule": { + "frequency": "PT1H" + }, + "status": "disabled", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-259de2c1-c546-4c6d-a17c-df639722f4d7", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-259de2c1-c546-4c6d-a17c-df639722f4d7')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'MalwareProtectionEssentials-CD-xdr-259de2c1-c546-4c6d-a-871268a6')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "This analytic rule detects usage of recovery tools vssadmin, wbadmin, wmic and bcedit to delete backup files or change recovery configuration. Adversaries may use these tools to delete shadow copies and backup files to prevent recovery of files.\nhttps://attack.mitre.org/techniques/T1490/", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "detectionAction": { + "alertTemplate": { + "customDetails": { + "ProcessCommandLine": "CommandLine", + "ProcessProcessId": "TargetProcessId" + }, + "title": "Detect Malicious Usage of Recovery Tools to Delete Backup Files", + "tactics": [ + { + "techniques": [ + { + "technique": "T1490" + } + ], + "tactic": "Impact" + } + ], + "severity": "high", + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "ntDomainColumn": "NTDomain", + "nameColumn": "Username", + "upnSuffixColumn": "UPNSuffix" + } + ], + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "DvcIpAddr" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DvcDomain", + "nameColumn": "DvcHostname", + "ntDomainColumn": "NTDomain" + } + ] + }, + "description": "This analytic rule detects usage of recovery tools vssadmin, wbadmin, wmic and bcedit to delete backup files or change recovery configuration. Adversaries may use these tools to delete shadow copies and backup files to prevent recovery of files.\nhttps://attack.mitre.org/techniques/T1490/" + } + }, + "queryCondition": { + "queryText": "_ASim_ProcessEvent\n| where TargetProcessFilename has_any ('vssadmin.exe', 'wbadmin.exe', 'wmic.exe')\n| where CommandLine has_all ('delete', 'shadow')\n| union isfuzzy=True\n (_ASim_ProcessEvent\n | where TargetProcessFilename =~ 'bcedit.exe'\n | where CommandLine has_all ('/set', 'recoveryenabled no')\n )\n| project\n TimeGenerated,\n DvcHostname,\n DvcIpAddr,\n DvcDomain,\n TargetUsername,\n TargetUsernameType,\n TargetProcessName,\n TargetProcessId,\n CommandLine\n| extend Username = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\\\')[1]), TargetUsername)\n| extend NTDomain = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\\\')[0]), TargetUsername)\n| extend Username = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[0]), Username)\n| extend UPNSuffix = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[1]), '')" + }, + "displayName": "Detect Malicious Usage of Recovery Tools to Delete Backup Files", + "id": "[if(true(), 'xdr-259de2c1-c546-4c6d-a17c-df639722f4d7', 'xdr-259de2c1-c546-4c6d-a17c-df639722f4d7')]", + "schedule": { + "frequency": "PT1H" + }, + "status": "disabled", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-259de2c1-c546-4c6d-a17c-df639722f4d7", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-259de2c1-c546-4c6d-a17c-df639722f4d7", + "contentKind": "CustomDetection", + "displayName": "Detect Malicious Usage of Recovery Tools to Delete Backup Files", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-259de2c1-c546-4c6d-a17c-df639722f4d7','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-259de2c1-c546-4c6d-a17c-df639722f4d7','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-259de2c1-c546-4c6d-a17c-df639722f4d7", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "workload": "sentinel", + "dataTypes": [ + "CarbonBlackEvents_CL", + "CiscoSecureEndpoint_CL", + "CommonSecurityLog", + "SecurityAlert", + "SentinelOne_CL" + ] + } + ], + "requiredDataConnectors": [ + { + "connectorId": "CrowdStrikeFalconEndpointProtection", + "dataTypes": [ + "CommonSecurityLog" + ] + }, + { + "connectorId": "MicrosoftThreatProtection", + "dataTypes": [ + "SecurityAlert" + ] + }, + { + "connectorId": "SentinelOne", + "dataTypes": [ + "SentinelOne_CL" + ] + }, + { + "connectorId": "VMwareCarbonBlack", + "dataTypes": [ + "CarbonBlackEvents_CL" + ] + }, + { + "connectorId": "CiscoSecureEndpoint", + "dataTypes": [ + "CiscoSecureEndpoint_CL" + ] + }, + { + "connectorId": "TrendMicroApexOne", + "dataTypes": [ + "TMApexOneEvent" + ] + }, + { + "connectorId": "TrendMicroApexOneAma", + "dataTypes": [ + "TMApexOneEvent" + ] + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "MalwareProtectionEssentials-CD-xdr-7edde3d4-9859-4a00-b-ae267fb3", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "detectionAction": { + "alertTemplate": { + "customDetails": { + "ProcessCommandLine": "ActingProcessCommandLine", + "RegistryValueValue": "RegistryValueData", + "ProcessProcessId": "ActingProcessId", + "RegistryKeyHive": "RegHive", + "RegistryKeyKey": "RegKey", + "RegistryValueValueType": "RegistryValueType" + }, + "title": "Detect Print Processors Registry Driver Key Creation/Modification", + "tactics": [ + { + "techniques": [ + { + "technique": "T1547" + } + ], + "tactic": "Persistence" + } + ], + "severity": "medium", + "entityMappings": { + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DnsDomain", + "nameColumn": "HostName", + "ntDomainColumn": "NTDomain" + } + ], + "registryValues": [ + { + "id": "[if(true(), 'registryValue1', 'registryValue1')]", + "valueNameColumn": "RegistryValue" + } + ], + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "ntDomainColumn": "NTDomain", + "nameColumn": "Username", + "upnSuffixColumn": "UPNSuffix" + } + ] + }, + "description": "This analytic rule detects any registry value creation or modification of print processor registry Driver key. This will load the executable at startup with print spooler service. This could be an indication of a persistence attempt by an adversary." + } + }, + "queryCondition": { + "queryText": "// Print Processor Registry Key RegEx\nlet printProcessorRegistryRegEx = @'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\[A-Za-z0-9]*ControlSet[A-Za-z0-9]*\\\\Control\\\\Print\\\\Environments\\\\Windows\\s[A-Za-z0-9]+\\\\Print Processors\\\\[A-Za-z0-9]+\\\\Driver';\n_ASim_RegistryEvent\n| where EventType in ('RegistryValueSet', 'RegistryKeyCreated')\n| where RegistryKey matches regex printProcessorRegistryRegEx\n| project\n TimeGenerated,\n DvcHostname,\n ActorUsername,\n ActorUsernameType,\n ActingProcessId,\n ActingProcessName,\n ActingProcessCommandLine,\n RegistryKey,\n RegistryValue,\n RegistryValueType,\n RegistryValueData\n| extend HostName = tostring(split(DvcHostname, '.')[0])\n| extend DnsDomain = tostring(strcat_array(array_slice(split(DvcHostname, '.'), 1, -1), '.'))\n| extend Username = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[1]), ActorUsername)\n| extend NTDomain = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[0]), ActorUsername)\n| extend Username = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[0]), Username)\n| extend UPNSuffix = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[1]), '')\n| extend RegHive = tostring(split(RegistryKey, '\\\\')[0]), RegKey = tostring(strcat_array(array_slice(split(RegistryKey, '\\\\'), 1, -1), '\\\\'))" + }, + "displayName": "Detect Print Processors Registry Driver Key Creation/Modification", + "id": "[if(true(), 'xdr-7edde3d4-9859-4a00-b93c-b19ddda55320', 'xdr-7edde3d4-9859-4a00-b93c-b19ddda55320')]", + "schedule": { + "frequency": "PT1H" + }, + "status": "disabled", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-7edde3d4-9859-4a00-b93c-b19ddda55320", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-7edde3d4-9859-4a00-b93c-b19ddda55320')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'MalwareProtectionEssentials-CD-xdr-7edde3d4-9859-4a00-b-ae267fb3')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "This analytic rule detects any registry value creation or modification of print processor registry Driver key. This will load the executable at startup with print spooler service. This could be an indication of a persistence attempt by an adversary.", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "detectionAction": { + "alertTemplate": { + "customDetails": { + "ProcessCommandLine": "ActingProcessCommandLine", + "RegistryValueValue": "RegistryValueData", + "ProcessProcessId": "ActingProcessId", + "RegistryKeyHive": "RegHive", + "RegistryKeyKey": "RegKey", + "RegistryValueValueType": "RegistryValueType" + }, + "title": "Detect Print Processors Registry Driver Key Creation/Modification", + "tactics": [ + { + "techniques": [ + { + "technique": "T1547" + } + ], + "tactic": "Persistence" + } + ], + "severity": "medium", + "entityMappings": { + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DnsDomain", + "nameColumn": "HostName", + "ntDomainColumn": "NTDomain" + } + ], + "registryValues": [ + { + "id": "[if(true(), 'registryValue1', 'registryValue1')]", + "valueNameColumn": "RegistryValue" + } + ], + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "ntDomainColumn": "NTDomain", + "nameColumn": "Username", + "upnSuffixColumn": "UPNSuffix" + } + ] + }, + "description": "This analytic rule detects any registry value creation or modification of print processor registry Driver key. This will load the executable at startup with print spooler service. This could be an indication of a persistence attempt by an adversary." + } + }, + "queryCondition": { + "queryText": "// Print Processor Registry Key RegEx\nlet printProcessorRegistryRegEx = @'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\[A-Za-z0-9]*ControlSet[A-Za-z0-9]*\\\\Control\\\\Print\\\\Environments\\\\Windows\\s[A-Za-z0-9]+\\\\Print Processors\\\\[A-Za-z0-9]+\\\\Driver';\n_ASim_RegistryEvent\n| where EventType in ('RegistryValueSet', 'RegistryKeyCreated')\n| where RegistryKey matches regex printProcessorRegistryRegEx\n| project\n TimeGenerated,\n DvcHostname,\n ActorUsername,\n ActorUsernameType,\n ActingProcessId,\n ActingProcessName,\n ActingProcessCommandLine,\n RegistryKey,\n RegistryValue,\n RegistryValueType,\n RegistryValueData\n| extend HostName = tostring(split(DvcHostname, '.')[0])\n| extend DnsDomain = tostring(strcat_array(array_slice(split(DvcHostname, '.'), 1, -1), '.'))\n| extend Username = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[1]), ActorUsername)\n| extend NTDomain = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[0]), ActorUsername)\n| extend Username = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[0]), Username)\n| extend UPNSuffix = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[1]), '')\n| extend RegHive = tostring(split(RegistryKey, '\\\\')[0]), RegKey = tostring(strcat_array(array_slice(split(RegistryKey, '\\\\'), 1, -1), '\\\\'))" + }, + "displayName": "Detect Print Processors Registry Driver Key Creation/Modification", + "id": "[if(true(), 'xdr-7edde3d4-9859-4a00-b93c-b19ddda55320', 'xdr-7edde3d4-9859-4a00-b93c-b19ddda55320')]", + "schedule": { + "frequency": "PT1H" + }, + "status": "disabled", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-7edde3d4-9859-4a00-b93c-b19ddda55320", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-7edde3d4-9859-4a00-b93c-b19ddda55320", + "contentKind": "CustomDetection", + "displayName": "Detect Print Processors Registry Driver Key Creation/Modification", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-7edde3d4-9859-4a00-b93c-b19ddda55320','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-7edde3d4-9859-4a00-b93c-b19ddda55320','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-7edde3d4-9859-4a00-b93c-b19ddda55320", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "workload": "sentinel", + "dataTypes": [ + "CarbonBlackEvents_CL", + "CiscoSecureEndpoint_CL", + "CommonSecurityLog", + "SecurityAlert", + "SentinelOne_CL" + ] + } + ], + "requiredDataConnectors": [ + { + "connectorId": "CrowdStrikeFalconEndpointProtection", + "dataTypes": [ + "CommonSecurityLog" + ] + }, + { + "connectorId": "MicrosoftThreatProtection", + "dataTypes": [ + "SecurityAlert" + ] + }, + { + "connectorId": "SentinelOne", + "dataTypes": [ + "SentinelOne_CL" + ] + }, + { + "connectorId": "VMwareCarbonBlack", + "dataTypes": [ + "CarbonBlackEvents_CL" + ] + }, + { + "connectorId": "CiscoSecureEndpoint", + "dataTypes": [ + "CiscoSecureEndpoint_CL" + ] + }, + { + "connectorId": "TrendMicroApexOne", + "dataTypes": [ + "TMApexOneEvent" + ] + }, + { + "connectorId": "TrendMicroApexOneAma", + "dataTypes": [ + "TMApexOneEvent" + ] + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "MalwareProtectionEssentials-CD-xdr-dd041e4e-1ee2-41ec-b-b6377a34", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "detectionAction": { + "alertTemplate": { + "customDetails": { + "ProcessCommandLine": "ActingProcessCommandLine", + "RegistryValueValue": "RegistryValueData", + "ProcessProcessId": "ActingProcessId", + "RegistryKeyHive": "RegHive", + "RegistryKeyKey": "RegKey", + "RegistryValueValueType": "RegistryValueType" + }, + "title": "Detect Registry Run Key Creation/Modification", + "tactics": [ + { + "techniques": [ + { + "technique": "T1547" + } + ], + "tactic": "Persistence" + } + ], + "severity": "medium", + "entityMappings": { + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DnsDomain", + "nameColumn": "HostName", + "ntDomainColumn": "NTDomain" + } + ], + "registryValues": [ + { + "id": "[if(true(), 'registryValue1', 'registryValue1')]", + "valueNameColumn": "RegistryValue" + } + ], + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "ntDomainColumn": "NTDomain", + "nameColumn": "Username", + "upnSuffixColumn": "UPNSuffix" + } + ] + }, + "description": "This analytic rule detects any registry value or key creation in the registry run keys. This could be an indication of a persistence attempt by an adversary." + } + }, + "queryCondition": { + "queryText": "// List of startup registry keys to monitor\nlet startupRegistryList = dynamic([\n 'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run',\n 'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce',\n 'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices',\n 'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run',\n 'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Userinit',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Shell',\n 'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows'\n ]);\n_ASim_RegistryEvent\n| where EventType in ('RegistryValueSet', 'RegistryKeyCreated') and RegistryKey has_any (startupRegistryList)\n| project\n TimeGenerated,\n DvcHostname,\n ActorUsername,\n ActorUsernameType,\n ActingProcessId,\n ActingProcessName,\n ActingProcessCommandLine,\n RegistryKey,\n RegistryValue,\n RegistryValueType,\n RegistryValueData\n| extend HostName = tostring(split(DvcHostname, '.')[0])\n| extend DnsDomain = tostring(strcat_array(array_slice(split(DvcHostname, '.'), 1, -1), '.'))\n| extend Username = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[1]), ActorUsername)\n| extend NTDomain = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[0]), ActorUsername)\n| extend Username = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[0]), Username)\n| extend UPNSuffix = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[1]), '')\n| extend RegHive = tostring(split(RegistryKey, '\\\\')[0]), RegKey = tostring(strcat_array(array_slice(split(RegistryKey, '\\\\'), 1, -1), '\\\\'))" + }, + "displayName": "Detect Registry Run Key Creation/Modification", + "id": "[if(true(), 'xdr-dd041e4e-1ee2-41ec-ba4e-82a71d628260', 'xdr-dd041e4e-1ee2-41ec-ba4e-82a71d628260')]", + "schedule": { + "frequency": "PT1H" + }, + "status": "disabled", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-dd041e4e-1ee2-41ec-ba4e-82a71d628260", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-dd041e4e-1ee2-41ec-ba4e-82a71d628260')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'MalwareProtectionEssentials-CD-xdr-dd041e4e-1ee2-41ec-b-b6377a34')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "This analytic rule detects any registry value or key creation in the registry run keys. This could be an indication of a persistence attempt by an adversary.", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "detectionAction": { + "alertTemplate": { + "customDetails": { + "ProcessCommandLine": "ActingProcessCommandLine", + "RegistryValueValue": "RegistryValueData", + "ProcessProcessId": "ActingProcessId", + "RegistryKeyHive": "RegHive", + "RegistryKeyKey": "RegKey", + "RegistryValueValueType": "RegistryValueType" + }, + "title": "Detect Registry Run Key Creation/Modification", + "tactics": [ + { + "techniques": [ + { + "technique": "T1547" + } + ], + "tactic": "Persistence" + } + ], + "severity": "medium", + "entityMappings": { + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DnsDomain", + "nameColumn": "HostName", + "ntDomainColumn": "NTDomain" + } + ], + "registryValues": [ + { + "id": "[if(true(), 'registryValue1', 'registryValue1')]", + "valueNameColumn": "RegistryValue" + } + ], + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "ntDomainColumn": "NTDomain", + "nameColumn": "Username", + "upnSuffixColumn": "UPNSuffix" + } + ] + }, + "description": "This analytic rule detects any registry value or key creation in the registry run keys. This could be an indication of a persistence attempt by an adversary." + } + }, + "queryCondition": { + "queryText": "// List of startup registry keys to monitor\nlet startupRegistryList = dynamic([\n 'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run',\n 'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce',\n 'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices',\n 'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run',\n 'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Userinit',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Shell',\n 'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows'\n ]);\n_ASim_RegistryEvent\n| where EventType in ('RegistryValueSet', 'RegistryKeyCreated') and RegistryKey has_any (startupRegistryList)\n| project\n TimeGenerated,\n DvcHostname,\n ActorUsername,\n ActorUsernameType,\n ActingProcessId,\n ActingProcessName,\n ActingProcessCommandLine,\n RegistryKey,\n RegistryValue,\n RegistryValueType,\n RegistryValueData\n| extend HostName = tostring(split(DvcHostname, '.')[0])\n| extend DnsDomain = tostring(strcat_array(array_slice(split(DvcHostname, '.'), 1, -1), '.'))\n| extend Username = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[1]), ActorUsername)\n| extend NTDomain = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[0]), ActorUsername)\n| extend Username = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[0]), Username)\n| extend UPNSuffix = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[1]), '')\n| extend RegHive = tostring(split(RegistryKey, '\\\\')[0]), RegKey = tostring(strcat_array(array_slice(split(RegistryKey, '\\\\'), 1, -1), '\\\\'))" + }, + "displayName": "Detect Registry Run Key Creation/Modification", + "id": "[if(true(), 'xdr-dd041e4e-1ee2-41ec-ba4e-82a71d628260', 'xdr-dd041e4e-1ee2-41ec-ba4e-82a71d628260')]", + "schedule": { + "frequency": "PT1H" + }, + "status": "disabled", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-dd041e4e-1ee2-41ec-ba4e-82a71d628260", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-dd041e4e-1ee2-41ec-ba4e-82a71d628260", + "contentKind": "CustomDetection", + "displayName": "Detect Registry Run Key Creation/Modification", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-dd041e4e-1ee2-41ec-ba4e-82a71d628260','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-dd041e4e-1ee2-41ec-ba4e-82a71d628260','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-dd041e4e-1ee2-41ec-ba4e-82a71d628260", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "workload": "sentinel", + "dataTypes": [ + "CarbonBlackEvents_CL", + "CiscoSecureEndpoint_CL", + "CommonSecurityLog", + "SecurityAlert", + "SentinelOne_CL" + ] + } + ], + "requiredDataConnectors": [ + { + "connectorId": "CrowdStrikeFalconEndpointProtection", + "dataTypes": [ + "CommonSecurityLog" + ] + }, + { + "connectorId": "MicrosoftThreatProtection", + "dataTypes": [ + "SecurityAlert" + ] + }, + { + "connectorId": "SentinelOne", + "dataTypes": [ + "SentinelOne_CL" + ] + }, + { + "connectorId": "VMwareCarbonBlack", + "dataTypes": [ + "CarbonBlackEvents_CL" + ] + }, + { + "connectorId": "CiscoSecureEndpoint", + "dataTypes": [ + "CiscoSecureEndpoint_CL" + ] + }, + { + "connectorId": "TrendMicroApexOne", + "dataTypes": [ + "TMApexOneEvent" + ] + }, + { + "connectorId": "TrendMicroApexOneAma", + "dataTypes": [ + "TMApexOneEvent" + ] + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "MalwareProtectionEssentials-CD-xdr-fdbcc0eb-44fb-467e-a-8a0a03ba", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "detectionAction": { + "alertTemplate": { + "customDetails": { + "ProcessCommandLine": "CommandLine", + "ProcessProcessId": "TargetProcessId" + }, + "title": "Process Creation with Suspicious CommandLine Arguments", + "tactics": [ + { + "techniques": [ + { + "technique": "T1059" + } + ], + "tactic": "Execution" + } + ], + "severity": "medium", + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "ntDomainColumn": "NTDomain", + "nameColumn": "Username", + "upnSuffixColumn": "UPNSuffix" + } + ], + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "DvcIpAddr" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DvcDomain", + "nameColumn": "DvcHostname", + "ntDomainColumn": "NTDomain" + } + ] + }, + "description": "This analytic rule detects process creation events with base64 encoded command line arguments. This could be an indication of a malicious process being executed." + } + }, + "queryCondition": { + "queryText": "_ASim_ProcessEvent\n| where EventType == 'ProcessCreated'\n| extend CommandLineArgs = strcat_array(array_slice(split(CommandLine, \" \"), 1, -1), \" \")\n| where strlen(CommandLineArgs) > 0\n| where CommandLineArgs contains \"base64\"\n| project\nTimeGenerated,\nDvcHostname,\nDvcIpAddr,\nDvcDomain,\nTargetUsername,\nTargetUsernameType,\nTargetProcessName,\nTargetProcessId,\nCommandLine\n| extend Username = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\\\')[1]), TargetUsername)\n| extend NTDomain = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\\\')[0]), TargetUsername)\n| extend Username = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[0]), Username)\n| extend UPNSuffix = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[1]), '')" + }, + "displayName": "Process Creation with Suspicious CommandLine Arguments", + "id": "[if(true(), 'xdr-fdbcc0eb-44fb-467e-a51d-a91df0780a81', 'xdr-fdbcc0eb-44fb-467e-a51d-a91df0780a81')]", + "schedule": { + "frequency": "PT1H" + }, + "status": "disabled", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-fdbcc0eb-44fb-467e-a51d-a91df0780a81", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-fdbcc0eb-44fb-467e-a51d-a91df0780a81')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'MalwareProtectionEssentials-CD-xdr-fdbcc0eb-44fb-467e-a-8a0a03ba')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "This analytic rule detects process creation events with base64 encoded command line arguments. This could be an indication of a malicious process being executed.", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "detectionAction": { + "alertTemplate": { + "customDetails": { + "ProcessCommandLine": "CommandLine", + "ProcessProcessId": "TargetProcessId" + }, + "title": "Process Creation with Suspicious CommandLine Arguments", + "tactics": [ + { + "techniques": [ + { + "technique": "T1059" + } + ], + "tactic": "Execution" + } + ], + "severity": "medium", + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "ntDomainColumn": "NTDomain", + "nameColumn": "Username", + "upnSuffixColumn": "UPNSuffix" + } + ], + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "DvcIpAddr" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DvcDomain", + "nameColumn": "DvcHostname", + "ntDomainColumn": "NTDomain" + } + ] + }, + "description": "This analytic rule detects process creation events with base64 encoded command line arguments. This could be an indication of a malicious process being executed." + } + }, + "queryCondition": { + "queryText": "_ASim_ProcessEvent\n| where EventType == 'ProcessCreated'\n| extend CommandLineArgs = strcat_array(array_slice(split(CommandLine, \" \"), 1, -1), \" \")\n| where strlen(CommandLineArgs) > 0\n| where CommandLineArgs contains \"base64\"\n| project\nTimeGenerated,\nDvcHostname,\nDvcIpAddr,\nDvcDomain,\nTargetUsername,\nTargetUsernameType,\nTargetProcessName,\nTargetProcessId,\nCommandLine\n| extend Username = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\\\')[1]), TargetUsername)\n| extend NTDomain = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\\\')[0]), TargetUsername)\n| extend Username = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[0]), Username)\n| extend UPNSuffix = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[1]), '')" + }, + "displayName": "Process Creation with Suspicious CommandLine Arguments", + "id": "[if(true(), 'xdr-fdbcc0eb-44fb-467e-a51d-a91df0780a81', 'xdr-fdbcc0eb-44fb-467e-a51d-a91df0780a81')]", + "schedule": { + "frequency": "PT1H" + }, + "status": "disabled", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-fdbcc0eb-44fb-467e-a51d-a91df0780a81", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-fdbcc0eb-44fb-467e-a51d-a91df0780a81", + "contentKind": "CustomDetection", + "displayName": "Process Creation with Suspicious CommandLine Arguments", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-fdbcc0eb-44fb-467e-a51d-a91df0780a81','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-fdbcc0eb-44fb-467e-a51d-a91df0780a81','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-fdbcc0eb-44fb-467e-a51d-a91df0780a81", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "workload": "sentinel", + "dataTypes": [ + "CarbonBlackEvents_CL", + "CiscoSecureEndpoint_CL", + "CommonSecurityLog", + "SecurityAlert", + "SentinelOne_CL" + ] + } + ], + "requiredDataConnectors": [ + { + "connectorId": "CrowdStrikeFalconEndpointProtection", + "dataTypes": [ + "CommonSecurityLog" + ] + }, + { + "connectorId": "MicrosoftThreatProtection", + "dataTypes": [ + "SecurityAlert" + ] + }, + { + "connectorId": "SentinelOne", + "dataTypes": [ + "SentinelOne_CL" + ] + }, + { + "connectorId": "VMwareCarbonBlack", + "dataTypes": [ + "CarbonBlackEvents_CL" + ] + }, + { + "connectorId": "CiscoSecureEndpoint", + "dataTypes": [ + "CiscoSecureEndpoint_CL" + ] + }, + { + "connectorId": "TrendMicroApexOne", + "dataTypes": [ + "TMApexOneEvent" + ] + }, + { + "connectorId": "TrendMicroApexOneAma", + "dataTypes": [ + "TMApexOneEvent" + ] + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "MalwareProtectionEssentials-CD-xdr-056593d4-ca3b-47a7-b-2456e56a", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "detectionAction": { + "alertTemplate": { + "customDetails": { + "ProcessCommandLine": "ActingProcessCommandLine", + "RegistryValueValue": "RegistryValueData", + "ProcessProcessId": "ActingProcessId", + "RegistryKeyHive": "RegHive", + "RegistryKeyKey": "RegKey", + "RegistryValueValueType": "RegistryValueType" + }, + "title": "Detect Windows Allow Firewall Rule Addition/Modification", + "tactics": [ + { + "techniques": [ + { + "technique": "T1562" + } + ], + "tactic": "DefenseEvasion" + } + ], + "severity": "medium", + "entityMappings": { + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DnsDomain", + "nameColumn": "HostName", + "ntDomainColumn": "NTDomain" + } + ], + "registryValues": [ + { + "id": "[if(true(), 'registryValue1', 'registryValue1')]", + "valueNameColumn": "RegistryValue" + } + ], + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "ntDomainColumn": "NTDomain", + "nameColumn": "Username", + "upnSuffixColumn": "UPNSuffix" + } + ] + }, + "description": "This analytic rule detects any registry value creation or modification of Windows firewall registry keys to allow network traffic. This could be an indication of defense evasion by an adversary to allow network traffic to/from a compromised host." + } + }, + "queryCondition": { + "queryText": "// List of Windows Firewall registry keys to monitor\nlet firewallRegistryList = dynamic([\n 'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\SharedAccess\\\\Parameters\\\\FirewallPolicy\\\\RestrictedServices\\\\Static\\\\System',\n 'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\SharedAccess\\\\Parameters\\\\FirewallPolicy\\\\RestrictedServices\\\\Configurable\\\\System',\n 'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\SharedAccess\\\\Defaults\\\\FirewallPolicy\\\\FirewallRules',\n 'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\WindowsFirewall'\n ]);\n_ASim_RegistryEvent\n| where EventType in ('RegistryValueSet', 'RegistryKeyCreated')\n| where RegistryKey has_any (firewallRegistryList) and RegistryValueData has_all ('Action=Allow', 'Active=TRUE')\n| project\n TimeGenerated,\n DvcHostname,\n ActorUsername,\n ActorUsernameType,\n ActingProcessId,\n ActingProcessName,\n ActingProcessCommandLine,\n RegistryKey,\n RegistryValue,\n RegistryValueType,\n RegistryValueData\n| extend HostName = tostring(split(DvcHostname, '.')[0])\n| extend DnsDomain = tostring(strcat_array(array_slice(split(DvcHostname, '.'), 1, -1), '.'))\n| extend Username = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[1]), ActorUsername)\n| extend NTDomain = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[0]), ActorUsername)\n| extend Username = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[0]), Username)\n| extend UPNSuffix = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[1]), '')\n| extend RegHive = tostring(split(RegistryKey, '\\\\')[0]), RegKey = tostring(strcat_array(array_slice(split(RegistryKey, '\\\\'), 1, -1), '\\\\'))" + }, + "displayName": "Detect Windows Allow Firewall Rule Addition/Modification", + "id": "[if(true(), 'xdr-056593d4-ca3b-47a7-be9d-d1d0884a1d36', 'xdr-056593d4-ca3b-47a7-be9d-d1d0884a1d36')]", + "schedule": { + "frequency": "PT1H" + }, + "status": "disabled", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-056593d4-ca3b-47a7-be9d-d1d0884a1d36", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-056593d4-ca3b-47a7-be9d-d1d0884a1d36')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'MalwareProtectionEssentials-CD-xdr-056593d4-ca3b-47a7-b-2456e56a')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "This analytic rule detects any registry value creation or modification of Windows firewall registry keys to allow network traffic. This could be an indication of defense evasion by an adversary to allow network traffic to/from a compromised host.", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "detectionAction": { + "alertTemplate": { + "customDetails": { + "ProcessCommandLine": "ActingProcessCommandLine", + "RegistryValueValue": "RegistryValueData", + "ProcessProcessId": "ActingProcessId", + "RegistryKeyHive": "RegHive", + "RegistryKeyKey": "RegKey", + "RegistryValueValueType": "RegistryValueType" + }, + "title": "Detect Windows Allow Firewall Rule Addition/Modification", + "tactics": [ + { + "techniques": [ + { + "technique": "T1562" + } + ], + "tactic": "DefenseEvasion" + } + ], + "severity": "medium", + "entityMappings": { + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DnsDomain", + "nameColumn": "HostName", + "ntDomainColumn": "NTDomain" + } + ], + "registryValues": [ + { + "id": "[if(true(), 'registryValue1', 'registryValue1')]", + "valueNameColumn": "RegistryValue" + } + ], + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "ntDomainColumn": "NTDomain", + "nameColumn": "Username", + "upnSuffixColumn": "UPNSuffix" + } + ] + }, + "description": "This analytic rule detects any registry value creation or modification of Windows firewall registry keys to allow network traffic. This could be an indication of defense evasion by an adversary to allow network traffic to/from a compromised host." + } + }, + "queryCondition": { + "queryText": "// List of Windows Firewall registry keys to monitor\nlet firewallRegistryList = dynamic([\n 'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\SharedAccess\\\\Parameters\\\\FirewallPolicy\\\\RestrictedServices\\\\Static\\\\System',\n 'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\SharedAccess\\\\Parameters\\\\FirewallPolicy\\\\RestrictedServices\\\\Configurable\\\\System',\n 'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\SharedAccess\\\\Defaults\\\\FirewallPolicy\\\\FirewallRules',\n 'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\WindowsFirewall'\n ]);\n_ASim_RegistryEvent\n| where EventType in ('RegistryValueSet', 'RegistryKeyCreated')\n| where RegistryKey has_any (firewallRegistryList) and RegistryValueData has_all ('Action=Allow', 'Active=TRUE')\n| project\n TimeGenerated,\n DvcHostname,\n ActorUsername,\n ActorUsernameType,\n ActingProcessId,\n ActingProcessName,\n ActingProcessCommandLine,\n RegistryKey,\n RegistryValue,\n RegistryValueType,\n RegistryValueData\n| extend HostName = tostring(split(DvcHostname, '.')[0])\n| extend DnsDomain = tostring(strcat_array(array_slice(split(DvcHostname, '.'), 1, -1), '.'))\n| extend Username = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[1]), ActorUsername)\n| extend NTDomain = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[0]), ActorUsername)\n| extend Username = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[0]), Username)\n| extend UPNSuffix = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[1]), '')\n| extend RegHive = tostring(split(RegistryKey, '\\\\')[0]), RegKey = tostring(strcat_array(array_slice(split(RegistryKey, '\\\\'), 1, -1), '\\\\'))" + }, + "displayName": "Detect Windows Allow Firewall Rule Addition/Modification", + "id": "[if(true(), 'xdr-056593d4-ca3b-47a7-be9d-d1d0884a1d36', 'xdr-056593d4-ca3b-47a7-be9d-d1d0884a1d36')]", + "schedule": { + "frequency": "PT1H" + }, + "status": "disabled", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-056593d4-ca3b-47a7-be9d-d1d0884a1d36", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-056593d4-ca3b-47a7-be9d-d1d0884a1d36", + "contentKind": "CustomDetection", + "displayName": "Detect Windows Allow Firewall Rule Addition/Modification", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-056593d4-ca3b-47a7-be9d-d1d0884a1d36','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-056593d4-ca3b-47a7-be9d-d1d0884a1d36','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-056593d4-ca3b-47a7-be9d-d1d0884a1d36", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "workload": "sentinel", + "dataTypes": [ + "CarbonBlackEvents_CL", + "CiscoSecureEndpoint_CL", + "CommonSecurityLog", + "SecurityAlert", + "SentinelOne_CL" + ] + } + ], + "requiredDataConnectors": [ + { + "connectorId": "CrowdStrikeFalconEndpointProtection", + "dataTypes": [ + "CommonSecurityLog" + ] + }, + { + "connectorId": "MicrosoftThreatProtection", + "dataTypes": [ + "SecurityAlert" + ] + }, + { + "connectorId": "SentinelOne", + "dataTypes": [ + "SentinelOne_CL" + ] + }, + { + "connectorId": "VMwareCarbonBlack", + "dataTypes": [ + "CarbonBlackEvents_CL" + ] + }, + { + "connectorId": "CiscoSecureEndpoint", + "dataTypes": [ + "CiscoSecureEndpoint_CL" + ] + }, + { + "connectorId": "TrendMicroApexOne", + "dataTypes": [ + "TMApexOneEvent" + ] + }, + { + "connectorId": "TrendMicroApexOneAma", + "dataTypes": [ + "TMApexOneEvent" + ] + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "MalwareProtectionEssentials-CD-xdr-f1443a87-78d5-40c3-b-2e08d941", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "detectionAction": { + "alertTemplate": { + "customDetails": { + "ProcessCommandLine": "ActingProcessCommandLine", + "RegistryValueValue": "RegistryValueData", + "ProcessProcessId": "ActingProcessId", + "RegistryKeyHive": "RegHive", + "RegistryKeyKey": "RegKey", + "RegistryValueValueType": "RegistryValueType" + }, + "title": "Detect Windows Update Disabled from Registry", + "tactics": [ + { + "techniques": [ + { + "technique": "T1562" + } + ], + "tactic": "DefenseEvasion" + } + ], + "severity": "medium", + "entityMappings": { + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DnsDomain", + "nameColumn": "HostName", + "ntDomainColumn": "NTDomain" + } + ], + "registryValues": [ + { + "id": "[if(true(), 'registryValue1', 'registryValue1')]", + "valueNameColumn": "RegistryValue" + } + ], + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "ntDomainColumn": "NTDomain", + "nameColumn": "Username", + "upnSuffixColumn": "UPNSuffix" + } + ] + }, + "description": "This analytic rule detects any registry value creation or modification of Windows Update registry keys to disable Windows Update. This could be an indication of defense evasion by an adversary on a compromised host." + } + }, + "queryCondition": { + "queryText": "// List of Windows Firewall registry keys to monitor\nlet windowsUpdateRegistryList = dynamic([\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Policies\\\\Microsoft\\\\Windows\\\\WindowsUpdate',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Policies\\\\Microsoft\\\\Windows\\\\WindowsUpdate\\\\AU'\n ]);\n_ASim_RegistryEvent\n| where EventType in ('RegistryValueSet', 'RegistryKeyCreated')\n| where RegistryKey has_any (windowsUpdateRegistryList)\n| where RegistryValue has_any ('AUOptions', 'NoAutoUpdate') and RegistryValueData == '1'\n| project\n TimeGenerated,\n DvcHostname,\n ActorUsername,\n ActorUsernameType,\n ActingProcessId,\n ActingProcessName,\n ActingProcessCommandLine,\n RegistryKey,\n RegistryValue,\n RegistryValueType,\n RegistryValueData\n| extend HostName = tostring(split(DvcHostname, '.')[0])\n| extend DnsDomain = tostring(strcat_array(array_slice(split(DvcHostname, '.'), 1, -1), '.'))\n| extend Username = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[1]), ActorUsername)\n| extend NTDomain = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[0]), ActorUsername)\n| extend Username = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[0]), Username)\n| extend UPNSuffix = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[1]), '')\n| extend RegHive = tostring(split(RegistryKey, '\\\\')[0]), RegKey = tostring(strcat_array(array_slice(split(RegistryKey, '\\\\'), 1, -1), '\\\\'))" + }, + "displayName": "Detect Windows Update Disabled from Registry", + "id": "[if(true(), 'xdr-f1443a87-78d5-40c3-b051-f468f0f2def0', 'xdr-f1443a87-78d5-40c3-b051-f468f0f2def0')]", + "schedule": { + "frequency": "PT1H" + }, + "status": "disabled", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-f1443a87-78d5-40c3-b051-f468f0f2def0", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-f1443a87-78d5-40c3-b051-f468f0f2def0')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'MalwareProtectionEssentials-CD-xdr-f1443a87-78d5-40c3-b-2e08d941')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "This analytic rule detects any registry value creation or modification of Windows Update registry keys to disable Windows Update. This could be an indication of defense evasion by an adversary on a compromised host.", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "detectionAction": { + "alertTemplate": { + "customDetails": { + "ProcessCommandLine": "ActingProcessCommandLine", + "RegistryValueValue": "RegistryValueData", + "ProcessProcessId": "ActingProcessId", + "RegistryKeyHive": "RegHive", + "RegistryKeyKey": "RegKey", + "RegistryValueValueType": "RegistryValueType" + }, + "title": "Detect Windows Update Disabled from Registry", + "tactics": [ + { + "techniques": [ + { + "technique": "T1562" + } + ], + "tactic": "DefenseEvasion" + } + ], + "severity": "medium", + "entityMappings": { + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DnsDomain", + "nameColumn": "HostName", + "ntDomainColumn": "NTDomain" + } + ], + "registryValues": [ + { + "id": "[if(true(), 'registryValue1', 'registryValue1')]", + "valueNameColumn": "RegistryValue" + } + ], + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "ntDomainColumn": "NTDomain", + "nameColumn": "Username", + "upnSuffixColumn": "UPNSuffix" + } + ] + }, + "description": "This analytic rule detects any registry value creation or modification of Windows Update registry keys to disable Windows Update. This could be an indication of defense evasion by an adversary on a compromised host." + } + }, + "queryCondition": { + "queryText": "// List of Windows Firewall registry keys to monitor\nlet windowsUpdateRegistryList = dynamic([\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Policies\\\\Microsoft\\\\Windows\\\\WindowsUpdate',\n 'HKEY_LOCAL_MACHINE\\\\Software\\\\Policies\\\\Microsoft\\\\Windows\\\\WindowsUpdate\\\\AU'\n ]);\n_ASim_RegistryEvent\n| where EventType in ('RegistryValueSet', 'RegistryKeyCreated')\n| where RegistryKey has_any (windowsUpdateRegistryList)\n| where RegistryValue has_any ('AUOptions', 'NoAutoUpdate') and RegistryValueData == '1'\n| project\n TimeGenerated,\n DvcHostname,\n ActorUsername,\n ActorUsernameType,\n ActingProcessId,\n ActingProcessName,\n ActingProcessCommandLine,\n RegistryKey,\n RegistryValue,\n RegistryValueType,\n RegistryValueData\n| extend HostName = tostring(split(DvcHostname, '.')[0])\n| extend DnsDomain = tostring(strcat_array(array_slice(split(DvcHostname, '.'), 1, -1), '.'))\n| extend Username = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[1]), ActorUsername)\n| extend NTDomain = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\\\')[0]), ActorUsername)\n| extend Username = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[0]), Username)\n| extend UPNSuffix = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[1]), '')\n| extend RegHive = tostring(split(RegistryKey, '\\\\')[0]), RegKey = tostring(strcat_array(array_slice(split(RegistryKey, '\\\\'), 1, -1), '\\\\'))" + }, + "displayName": "Detect Windows Update Disabled from Registry", + "id": "[if(true(), 'xdr-f1443a87-78d5-40c3-b051-f468f0f2def0', 'xdr-f1443a87-78d5-40c3-b051-f468f0f2def0')]", + "schedule": { + "frequency": "PT1H" + }, + "status": "disabled", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-f1443a87-78d5-40c3-b051-f468f0f2def0", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-f1443a87-78d5-40c3-b051-f468f0f2def0", + "contentKind": "CustomDetection", + "displayName": "Detect Windows Update Disabled from Registry", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-f1443a87-78d5-40c3-b051-f468f0f2def0','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-f1443a87-78d5-40c3-b051-f468f0f2def0','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-malwareprotection", + "packageVersion": "3.2.2", + "contentId": "xdr-f1443a87-78d5-40c3-b051-f468f0f2def0", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "workload": "sentinel", + "dataTypes": [ + "CarbonBlackEvents_CL", + "CiscoSecureEndpoint_CL", + "CommonSecurityLog", + "SecurityAlert", + "SentinelOne_CL" + ] + } + ], + "requiredDataConnectors": [ + { + "connectorId": "CrowdStrikeFalconEndpointProtection", + "dataTypes": [ + "CommonSecurityLog" + ] + }, + { + "connectorId": "MicrosoftThreatProtection", + "dataTypes": [ + "SecurityAlert" + ] + }, + { + "connectorId": "SentinelOne", + "dataTypes": [ + "SentinelOne_CL" + ] + }, + { + "connectorId": "VMwareCarbonBlack", + "dataTypes": [ + "CarbonBlackEvents_CL" + ] + }, + { + "connectorId": "CiscoSecureEndpoint", + "dataTypes": [ + "CiscoSecureEndpoint_CL" + ] + }, + { + "connectorId": "TrendMicroApexOne", + "dataTypes": [ + "TMApexOneEvent" + ] + }, + { + "connectorId": "TrendMicroApexOneAma", + "dataTypes": [ + "TMApexOneEvent" + ] + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "pid-2f546ea1-39c2-49b0-af60-f07e4f841c4c-partnercenter", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [] + } + } } ], "outputs": {} diff --git a/Solutions/Malware Protection Essentials/Package/testParameters.json b/Solutions/Malware Protection Essentials/Package/testParameters.json index 0f5a632ebbc..97bfab726a6 100644 --- a/Solutions/Malware Protection Essentials/Package/testParameters.json +++ b/Solutions/Malware Protection Essentials/Package/testParameters.json @@ -36,5 +36,40 @@ "metadata": { "description": "Name for the workbook" } + }, + "DeployAnalyticsRule": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." + } + }, + "DeployWorkbook": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." + } + }, + "DeployCustomDetection": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." + } + }, + "DeployHuntingQuery": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel hunting queries carried by this solution." + } + }, + "DeployWatchlist": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the watchlists and their registrations carried by this solution." + } } } diff --git a/Solutions/Malware Protection Essentials/ReleaseNotes.md b/Solutions/Malware Protection Essentials/ReleaseNotes.md index 28c43343876..7f2bd477ec9 100644 --- a/Solutions/Malware Protection Essentials/ReleaseNotes.md +++ b/Solutions/Malware Protection Essentials/ReleaseNotes.md @@ -1,4 +1,5 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |--------------|---------------------------------|----------------------------------------------| +| 3.2.2 | 20-10-2026 | Added six disabled Defender XDR Custom Detections alongside the existing Microsoft Sentinel content. Defender Workbook drafts remain excluded pending review. | | 3.0.1 | 18-10-2024 | **Analytical Rule** [Process Creation with Suspicious CommandLine Arguments] | | 3.0.0 | 21-12-2023 | Initial Solution Release | diff --git a/Solutions/Malware Protection Essentials/SolutionMetadata.json b/Solutions/Malware Protection Essentials/SolutionMetadata.json index fee85892448..7dbe8c440f3 100644 --- a/Solutions/Malware Protection Essentials/SolutionMetadata.json +++ b/Solutions/Malware Protection Essentials/SolutionMetadata.json @@ -1,20 +1,22 @@ { - "publisherId": "azuresentinel", - "offerId": "azure-sentinel-solution-malwareprotection", - "firstPublishDate": "2023-09-25", - "lastPublishDate": "2023-09-25", - "providers": [ - "Microsoft" - ], - "categories": { - "domains": [ - "Security - Threat Protection" - ] - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - } -} \ No newline at end of file + "trackingId": "pid-2f546ea1-39c2-49b0-af60-f07e4f841c4c-partnercenter", + "publisherId": "azuresentinel", + "offerId": "azure-sentinel-solution-malwareprotection", + "firstPublishDate": "2023-09-25", + "lastPublishDate": "2023-09-25", + "providers": [ + "Microsoft" + ], + "categories": { + "domains": [ + "Security - Threat Protection" + ] + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + }, + "version": "3.2.2" +} diff --git a/Solutions/Malware Protection Essentials/XDR Detections/BackupDeletionDetected.yaml b/Solutions/Malware Protection Essentials/XDR Detections/BackupDeletionDetected.yaml new file mode 100644 index 00000000000..86500f4e6d2 --- /dev/null +++ b/Solutions/Malware Protection Essentials/XDR Detections/BackupDeletionDetected.yaml @@ -0,0 +1,198 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: CrowdStrikeFalconEndpointProtection + dataTypes: + - CommonSecurityLog +- connectorId: MicrosoftThreatProtection + dataTypes: + - SecurityAlert +- connectorId: SentinelOne + dataTypes: + - SentinelOne_CL +- connectorId: VMwareCarbonBlack + dataTypes: + - CarbonBlackEvents_CL +- connectorId: CiscoSecureEndpoint + dataTypes: + - CiscoSecureEndpoint_CL +- connectorId: TrendMicroApexOne + dataTypes: + - TMApexOneEvent +- connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - CarbonBlackEvents_CL + - CiscoSecureEndpoint_CL + - CommonSecurityLog + - SecurityAlert + - SentinelOne_CL + requiredDataConnectors: + - connectorId: CrowdStrikeFalconEndpointProtection + dataTypes: + - CommonSecurityLog + - connectorId: MicrosoftThreatProtection + dataTypes: + - SecurityAlert + - connectorId: SentinelOne + dataTypes: + - SentinelOne_CL + - connectorId: VMwareCarbonBlack + dataTypes: + - CarbonBlackEvents_CL + - connectorId: CiscoSecureEndpoint + dataTypes: + - CiscoSecureEndpoint_CL + - connectorId: TrendMicroApexOne + dataTypes: + - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: 259de2c1-c546-4c6d-a17c-df639722f4d7 + path: Analytic Rules/BackupDeletionDetected.yaml + version: 1.0.0 + querySha256: 3d07f45d3829525e975843cffc777bfa56c52f04572379ababaa7d88b96766a7 + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - isfuzzy unions can still fail semantic binding in Advanced Hunting + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - Process.ProcessId value is retained as customDetails.ProcessProcessId from query column `TargetProcessId`, but its target + output binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.ProcessProcessId column `TargetProcessId` requires runtime output-schema binding verification + - Process.CommandLine value is retained as customDetails.ProcessCommandLine from query column `CommandLine`, but its target + output binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.ProcessCommandLine column `CommandLine` requires runtime output-schema binding verification + - Custom-detail values must remain within the documented combined 4 KB per-alert limit; runtime values are unverified + and the service drops all custom details if exceeded + informational: [] + errors: [] + originalTactics: + - Impact + originalTechniques: + - T1490 + reviewScope: + sourceDocumentSha256: fab91a32e8d98add1aa8582310b6286f6cb892be5918124d880ef0acc7f1879f + targetQuerySha256: c2e6249472903d1e7accd61c7d453d2c493911aae4c4406b7d7a46f6f297ec19 + reviewDecisions: + - reason: isfuzzy unions can still fail semantic binding in Advanced Hunting + decision: accepted + sourceDocumentSha256: fab91a32e8d98add1aa8582310b6286f6cb892be5918124d880ef0acc7f1879f + targetQuerySha256: c2e6249472903d1e7accd61c7d453d2c493911aae4c4406b7d7a46f6f297ec19 + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: false + aggregationWindowDifference: false + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: No summarize/make-series aggregation detected in query; native 4-hour XDR lookback relies on + Defender XDR alert deduplication across hourly runs. + sourceDocumentSha256: fab91a32e8d98add1aa8582310b6286f6cb892be5918124d880ef0acc7f1879f + targetQuerySha256: c2e6249472903d1e7accd61c7d453d2c493911aae4c4406b7d7a46f6f297ec19 + supplementalEntityDetails: + - entityType: Process + entityIndex: 4 + identifier: ProcessId + sourceColumn: TargetProcessId + column: TargetProcessId + status: runtime-binding-pending + customDetailKey: ProcessProcessId + - entityType: Process + entityIndex: 4 + identifier: CommandLine + sourceColumn: CommandLine + column: CommandLine + status: runtime-binding-pending + customDetailKey: ProcessCommandLine + acceptedReviewReasons: + - isfuzzy unions can still fail semantic binding in Advanced Hunting +properties: + id: xdr-259de2c1-c546-4c6d-a17c-df639722f4d7 + displayName: Detect Malicious Usage of Recovery Tools to Delete Backup Files + status: disabled + queryCondition: + queryText: |- + _ASim_ProcessEvent + | where TargetProcessFilename has_any ('vssadmin.exe', 'wbadmin.exe', 'wmic.exe') + | where CommandLine has_all ('delete', 'shadow') + | union isfuzzy=True + (_ASim_ProcessEvent + | where TargetProcessFilename =~ 'bcedit.exe' + | where CommandLine has_all ('/set', 'recoveryenabled no') + ) + | project + TimeGenerated, + DvcHostname, + DvcIpAddr, + DvcDomain, + TargetUsername, + TargetUsernameType, + TargetProcessName, + TargetProcessId, + CommandLine + | extend Username = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\')[1]), TargetUsername) + | extend NTDomain = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\')[0]), TargetUsername) + | extend Username = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[0]), Username) + | extend UPNSuffix = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[1]), '') + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Detect Malicious Usage of Recovery Tools to Delete Backup Files + description: |- + This analytic rule detects usage of recovery tools vssadmin, wbadmin, wmic and bcedit to delete backup files or change recovery configuration. Adversaries may use these tools to delete shadow copies and backup files to prevent recovery of files. + https://attack.mitre.org/techniques/T1490/ + severity: high + entityMappings: + hosts: + - id: host1 + nameColumn: DvcHostname + dnsDomainColumn: DvcDomain + ntDomainColumn: NTDomain + ips: + - id: ip1 + addressColumn: DvcIpAddr + accounts: + - id: account1 + nameColumn: Username + upnSuffixColumn: UPNSuffix + ntDomainColumn: NTDomain + tactics: + - tactic: Impact + techniques: + - technique: T1490 + customDetails: + ProcessProcessId: TargetProcessId + ProcessCommandLine: CommandLine diff --git a/Solutions/Malware Protection Essentials/XDR Detections/PrintProcessersModified.yaml b/Solutions/Malware Protection Essentials/XDR Detections/PrintProcessersModified.yaml new file mode 100644 index 00000000000..1e6cad12084 --- /dev/null +++ b/Solutions/Malware Protection Essentials/XDR Detections/PrintProcessersModified.yaml @@ -0,0 +1,247 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: CrowdStrikeFalconEndpointProtection + dataTypes: + - CommonSecurityLog +- connectorId: MicrosoftThreatProtection + dataTypes: + - SecurityAlert +- connectorId: SentinelOne + dataTypes: + - SentinelOne_CL +- connectorId: VMwareCarbonBlack + dataTypes: + - CarbonBlackEvents_CL +- connectorId: CiscoSecureEndpoint + dataTypes: + - CiscoSecureEndpoint_CL +- connectorId: TrendMicroApexOne + dataTypes: + - TMApexOneEvent +- connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - CarbonBlackEvents_CL + - CiscoSecureEndpoint_CL + - CommonSecurityLog + - SecurityAlert + - SentinelOne_CL + requiredDataConnectors: + - connectorId: CrowdStrikeFalconEndpointProtection + dataTypes: + - CommonSecurityLog + - connectorId: MicrosoftThreatProtection + dataTypes: + - SecurityAlert + - connectorId: SentinelOne + dataTypes: + - SentinelOne_CL + - connectorId: VMwareCarbonBlack + dataTypes: + - CarbonBlackEvents_CL + - connectorId: CiscoSecureEndpoint + dataTypes: + - CiscoSecureEndpoint_CL + - connectorId: TrendMicroApexOne + dataTypes: + - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: 7edde3d4-9859-4a00-b93c-b19ddda55320 + path: Analytic Rules/PrintProcessersModified.yaml + version: 1.0.0 + querySha256: 02bf6e90dea3db0cfc16ac45386b2ad34d92aa26e3650203250fd2967e6c3c74 + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - Process.ProcessId value is retained as customDetails.ProcessProcessId from query column `ActingProcessId`, but its target + output binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.ProcessProcessId column `ActingProcessId` requires runtime output-schema binding verification + - Process.CommandLine value is retained as customDetails.ProcessCommandLine from query column `ActingProcessCommandLine`, + but its target output binding requires runtime-schema verification; custom details do not restore entity identity or + correlation + - Supplemental customDetails.ProcessCommandLine column `ActingProcessCommandLine` requires runtime output-schema binding + verification + - RegistryKey.Hive value is retained as customDetails.RegistryKeyHive from query column `RegHive`, but its target output + binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.RegistryKeyHive column `RegHive` requires runtime output-schema binding verification + - RegistryKey.Key value is retained as customDetails.RegistryKeyKey from query column `RegKey`, but its target output + binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.RegistryKeyKey column `RegKey` requires runtime output-schema binding verification + - RegistryValue.Value value is retained as customDetails.RegistryValueValue from query column `RegistryValueData`, but + its target output binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.RegistryValueValue column `RegistryValueData` requires runtime output-schema binding verification + - RegistryValue.ValueType value is retained as customDetails.RegistryValueValueType from query column `RegistryValueType`, + but its target output binding requires runtime-schema verification; custom details do not restore entity identity or + correlation + - Supplemental customDetails.RegistryValueValueType column `RegistryValueType` requires runtime output-schema binding + verification + - Custom-detail values must remain within the documented combined 4 KB per-alert limit; runtime values are unverified + and the service drops all custom details if exceeded + informational: + - All source MITRE tactics are preserved in source order in authored YAML. V3.1 ARM packaging carries only the first tactic + and its compatible techniques; this classification loss is not validated parity. Direct Graph deployment requires a + single tactic. + errors: [] + originalTactics: + - Persistence + - PrivilegeEscalation + originalTechniques: + - T1547 + reviewScope: + sourceDocumentSha256: 12311a56a6160fb773dad6e72306926bf9f472a021531519df2647e45724b343 + targetQuerySha256: 3a3ee0c747411a48f832c71d17a3c4e6611a7c935f03bd0bb24482958dc35b8f + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: false + aggregationWindowDifference: false + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: No summarize/make-series aggregation detected in query; native 4-hour XDR lookback relies on + Defender XDR alert deduplication across hourly runs. + sourceDocumentSha256: 12311a56a6160fb773dad6e72306926bf9f472a021531519df2647e45724b343 + targetQuerySha256: 3a3ee0c747411a48f832c71d17a3c4e6611a7c935f03bd0bb24482958dc35b8f + supplementalEntityDetails: + - entityType: Process + entityIndex: 3 + identifier: ProcessId + sourceColumn: ActingProcessId + column: ActingProcessId + status: runtime-binding-pending + customDetailKey: ProcessProcessId + - entityType: Process + entityIndex: 3 + identifier: CommandLine + sourceColumn: ActingProcessCommandLine + column: ActingProcessCommandLine + status: runtime-binding-pending + customDetailKey: ProcessCommandLine + - entityType: RegistryKey + entityIndex: 4 + identifier: Hive + sourceColumn: RegHive + column: RegHive + status: runtime-binding-pending + customDetailKey: RegistryKeyHive + - entityType: RegistryKey + entityIndex: 4 + identifier: Key + sourceColumn: RegKey + column: RegKey + status: runtime-binding-pending + customDetailKey: RegistryKeyKey + - entityType: RegistryValue + entityIndex: 5 + identifier: Value + sourceColumn: RegistryValueData + column: RegistryValueData + status: runtime-binding-pending + customDetailKey: RegistryValueValue + - entityType: RegistryValue + entityIndex: 5 + identifier: ValueType + sourceColumn: RegistryValueType + column: RegistryValueType + status: runtime-binding-pending + customDetailKey: RegistryValueValueType +properties: + id: xdr-7edde3d4-9859-4a00-b93c-b19ddda55320 + displayName: Detect Print Processors Registry Driver Key Creation/Modification + status: disabled + queryCondition: + queryText: |- + // Print Processor Registry Key RegEx + let printProcessorRegistryRegEx = @'HKEY_LOCAL_MACHINE\\SYSTEM\\[A-Za-z0-9]*ControlSet[A-Za-z0-9]*\\Control\\Print\\Environments\\Windows\s[A-Za-z0-9]+\\Print Processors\\[A-Za-z0-9]+\\Driver'; + _ASim_RegistryEvent + | where EventType in ('RegistryValueSet', 'RegistryKeyCreated') + | where RegistryKey matches regex printProcessorRegistryRegEx + | project + TimeGenerated, + DvcHostname, + ActorUsername, + ActorUsernameType, + ActingProcessId, + ActingProcessName, + ActingProcessCommandLine, + RegistryKey, + RegistryValue, + RegistryValueType, + RegistryValueData + | extend HostName = tostring(split(DvcHostname, '.')[0]) + | extend DnsDomain = tostring(strcat_array(array_slice(split(DvcHostname, '.'), 1, -1), '.')) + | extend Username = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\')[1]), ActorUsername) + | extend NTDomain = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\')[0]), ActorUsername) + | extend Username = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[0]), Username) + | extend UPNSuffix = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[1]), '') + | extend RegHive = tostring(split(RegistryKey, '\\')[0]), RegKey = tostring(strcat_array(array_slice(split(RegistryKey, '\\'), 1, -1), '\\')) + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Detect Print Processors Registry Driver Key Creation/Modification + description: This analytic rule detects any registry value creation or modification of print processor registry Driver + key. This will load the executable at startup with print spooler service. This could be an indication of a persistence + attempt by an adversary. + severity: medium + entityMappings: + hosts: + - id: host1 + nameColumn: HostName + dnsDomainColumn: DnsDomain + ntDomainColumn: NTDomain + accounts: + - id: account1 + nameColumn: Username + upnSuffixColumn: UPNSuffix + ntDomainColumn: NTDomain + registryValues: + - id: registryValue1 + valueNameColumn: RegistryValue + tactics: + - tactic: Persistence + techniques: + - technique: T1547 + - tactic: PrivilegeEscalation + techniques: + - technique: T1547 + customDetails: + ProcessProcessId: ActingProcessId + ProcessCommandLine: ActingProcessCommandLine + RegistryKeyHive: RegHive + RegistryKeyKey: RegKey + RegistryValueValue: RegistryValueData + RegistryValueValueType: RegistryValueType diff --git a/Solutions/Malware Protection Essentials/XDR Detections/StartupRegistryModified.yaml b/Solutions/Malware Protection Essentials/XDR Detections/StartupRegistryModified.yaml new file mode 100644 index 00000000000..f9b4f46c3aa --- /dev/null +++ b/Solutions/Malware Protection Essentials/XDR Detections/StartupRegistryModified.yaml @@ -0,0 +1,265 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: CrowdStrikeFalconEndpointProtection + dataTypes: + - CommonSecurityLog +- connectorId: MicrosoftThreatProtection + dataTypes: + - SecurityAlert +- connectorId: SentinelOne + dataTypes: + - SentinelOne_CL +- connectorId: VMwareCarbonBlack + dataTypes: + - CarbonBlackEvents_CL +- connectorId: CiscoSecureEndpoint + dataTypes: + - CiscoSecureEndpoint_CL +- connectorId: TrendMicroApexOne + dataTypes: + - TMApexOneEvent +- connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - CarbonBlackEvents_CL + - CiscoSecureEndpoint_CL + - CommonSecurityLog + - SecurityAlert + - SentinelOne_CL + requiredDataConnectors: + - connectorId: CrowdStrikeFalconEndpointProtection + dataTypes: + - CommonSecurityLog + - connectorId: MicrosoftThreatProtection + dataTypes: + - SecurityAlert + - connectorId: SentinelOne + dataTypes: + - SentinelOne_CL + - connectorId: VMwareCarbonBlack + dataTypes: + - CarbonBlackEvents_CL + - connectorId: CiscoSecureEndpoint + dataTypes: + - CiscoSecureEndpoint_CL + - connectorId: TrendMicroApexOne + dataTypes: + - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: dd041e4e-1ee2-41ec-ba4e-82a71d628260 + path: Analytic Rules/StartupRegistryModified.yaml + version: 1.0.0 + querySha256: 86284fafcc39473ab99f786b86508c419394167e96da004f39e854514b9268b7 + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - Process.ProcessId value is retained as customDetails.ProcessProcessId from query column `ActingProcessId`, but its target + output binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.ProcessProcessId column `ActingProcessId` requires runtime output-schema binding verification + - Process.CommandLine value is retained as customDetails.ProcessCommandLine from query column `ActingProcessCommandLine`, + but its target output binding requires runtime-schema verification; custom details do not restore entity identity or + correlation + - Supplemental customDetails.ProcessCommandLine column `ActingProcessCommandLine` requires runtime output-schema binding + verification + - RegistryKey.Hive value is retained as customDetails.RegistryKeyHive from query column `RegHive`, but its target output + binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.RegistryKeyHive column `RegHive` requires runtime output-schema binding verification + - RegistryKey.Key value is retained as customDetails.RegistryKeyKey from query column `RegKey`, but its target output + binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.RegistryKeyKey column `RegKey` requires runtime output-schema binding verification + - RegistryValue.Value value is retained as customDetails.RegistryValueValue from query column `RegistryValueData`, but + its target output binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.RegistryValueValue column `RegistryValueData` requires runtime output-schema binding verification + - RegistryValue.ValueType value is retained as customDetails.RegistryValueValueType from query column `RegistryValueType`, + but its target output binding requires runtime-schema verification; custom details do not restore entity identity or + correlation + - Supplemental customDetails.RegistryValueValueType column `RegistryValueType` requires runtime output-schema binding + verification + - Custom-detail values must remain within the documented combined 4 KB per-alert limit; runtime values are unverified + and the service drops all custom details if exceeded + informational: + - All source MITRE tactics are preserved in source order in authored YAML. V3.1 ARM packaging carries only the first tactic + and its compatible techniques; this classification loss is not validated parity. Direct Graph deployment requires a + single tactic. + errors: [] + originalTactics: + - Persistence + - PrivilegeEscalation + - DefenseEvasion + originalTechniques: + - T1547 + - T1112 + reviewScope: + sourceDocumentSha256: bc180730ff2fd19e267388f18e2f1b0844cfe51c661483f954f32987ecc415cb + targetQuerySha256: 72823d886fbaf9d28a8537c8a8fa16f7898f308d4eb8cd2f3c8b27f01db46b20 + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: false + aggregationWindowDifference: false + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: No summarize/make-series aggregation detected in query; native 4-hour XDR lookback relies on + Defender XDR alert deduplication across hourly runs. + sourceDocumentSha256: bc180730ff2fd19e267388f18e2f1b0844cfe51c661483f954f32987ecc415cb + targetQuerySha256: 72823d886fbaf9d28a8537c8a8fa16f7898f308d4eb8cd2f3c8b27f01db46b20 + supplementalEntityDetails: + - entityType: Process + entityIndex: 3 + identifier: ProcessId + sourceColumn: ActingProcessId + column: ActingProcessId + status: runtime-binding-pending + customDetailKey: ProcessProcessId + - entityType: Process + entityIndex: 3 + identifier: CommandLine + sourceColumn: ActingProcessCommandLine + column: ActingProcessCommandLine + status: runtime-binding-pending + customDetailKey: ProcessCommandLine + - entityType: RegistryKey + entityIndex: 4 + identifier: Hive + sourceColumn: RegHive + column: RegHive + status: runtime-binding-pending + customDetailKey: RegistryKeyHive + - entityType: RegistryKey + entityIndex: 4 + identifier: Key + sourceColumn: RegKey + column: RegKey + status: runtime-binding-pending + customDetailKey: RegistryKeyKey + - entityType: RegistryValue + entityIndex: 5 + identifier: Value + sourceColumn: RegistryValueData + column: RegistryValueData + status: runtime-binding-pending + customDetailKey: RegistryValueValue + - entityType: RegistryValue + entityIndex: 5 + identifier: ValueType + sourceColumn: RegistryValueType + column: RegistryValueType + status: runtime-binding-pending + customDetailKey: RegistryValueValueType +properties: + id: xdr-dd041e4e-1ee2-41ec-ba4e-82a71d628260 + displayName: Detect Registry Run Key Creation/Modification + status: disabled + queryCondition: + queryText: |- + // List of startup registry keys to monitor + let startupRegistryList = dynamic([ + 'HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run', + 'HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce', + 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run', + 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce', + 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx', + 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce', + 'HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce', + 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices', + 'HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices', + 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run', + 'HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run', + 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit', + 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell', + 'HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows' + ]); + _ASim_RegistryEvent + | where EventType in ('RegistryValueSet', 'RegistryKeyCreated') and RegistryKey has_any (startupRegistryList) + | project + TimeGenerated, + DvcHostname, + ActorUsername, + ActorUsernameType, + ActingProcessId, + ActingProcessName, + ActingProcessCommandLine, + RegistryKey, + RegistryValue, + RegistryValueType, + RegistryValueData + | extend HostName = tostring(split(DvcHostname, '.')[0]) + | extend DnsDomain = tostring(strcat_array(array_slice(split(DvcHostname, '.'), 1, -1), '.')) + | extend Username = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\')[1]), ActorUsername) + | extend NTDomain = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\')[0]), ActorUsername) + | extend Username = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[0]), Username) + | extend UPNSuffix = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[1]), '') + | extend RegHive = tostring(split(RegistryKey, '\\')[0]), RegKey = tostring(strcat_array(array_slice(split(RegistryKey, '\\'), 1, -1), '\\')) + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Detect Registry Run Key Creation/Modification + description: This analytic rule detects any registry value or key creation in the registry run keys. This could be an + indication of a persistence attempt by an adversary. + severity: medium + entityMappings: + hosts: + - id: host1 + nameColumn: HostName + dnsDomainColumn: DnsDomain + ntDomainColumn: NTDomain + accounts: + - id: account1 + nameColumn: Username + upnSuffixColumn: UPNSuffix + ntDomainColumn: NTDomain + registryValues: + - id: registryValue1 + valueNameColumn: RegistryValue + tactics: + - tactic: Persistence + techniques: + - technique: T1547 + - tactic: PrivilegeEscalation + techniques: + - technique: T1547 + - tactic: DefenseEvasion + techniques: + - technique: T1112 + customDetails: + ProcessProcessId: ActingProcessId + ProcessCommandLine: ActingProcessCommandLine + RegistryKeyHive: RegHive + RegistryKeyKey: RegKey + RegistryValueValue: RegistryValueData + RegistryValueValueType: RegistryValueType diff --git a/Solutions/Malware Protection Essentials/XDR Detections/SuspiciousProcessCreation.yaml b/Solutions/Malware Protection Essentials/XDR Detections/SuspiciousProcessCreation.yaml new file mode 100644 index 00000000000..04c72d0abf9 --- /dev/null +++ b/Solutions/Malware Protection Essentials/XDR Detections/SuspiciousProcessCreation.yaml @@ -0,0 +1,192 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: CrowdStrikeFalconEndpointProtection + dataTypes: + - CommonSecurityLog +- connectorId: MicrosoftThreatProtection + dataTypes: + - SecurityAlert +- connectorId: SentinelOne + dataTypes: + - SentinelOne_CL +- connectorId: VMwareCarbonBlack + dataTypes: + - CarbonBlackEvents_CL +- connectorId: CiscoSecureEndpoint + dataTypes: + - CiscoSecureEndpoint_CL +- connectorId: TrendMicroApexOne + dataTypes: + - TMApexOneEvent +- connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - CarbonBlackEvents_CL + - CiscoSecureEndpoint_CL + - CommonSecurityLog + - SecurityAlert + - SentinelOne_CL + requiredDataConnectors: + - connectorId: CrowdStrikeFalconEndpointProtection + dataTypes: + - CommonSecurityLog + - connectorId: MicrosoftThreatProtection + dataTypes: + - SecurityAlert + - connectorId: SentinelOne + dataTypes: + - SentinelOne_CL + - connectorId: VMwareCarbonBlack + dataTypes: + - CarbonBlackEvents_CL + - connectorId: CiscoSecureEndpoint + dataTypes: + - CiscoSecureEndpoint_CL + - connectorId: TrendMicroApexOne + dataTypes: + - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: fdbcc0eb-44fb-467e-a51d-a91df0780a81 + path: Analytic Rules/SuspiciousProcessCreation.yaml + version: 1.0.1 + querySha256: f369f6af13562ce0001bf5bb25f9ab540abefff083d5e2773b94125b1a1284b8 + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - Custom-detail values must remain within the documented combined 4 KB per-alert limit; runtime values are unverified + and the service drops all custom details if exceeded + informational: + - Process.ProcessId mismatch is informational because its original value is preserved as customDetails.ProcessProcessId + from query column `TargetProcessId`; supplemental details do not restore entity identity, correlation, or alert parity + - Process.CommandLine mismatch is informational because its original value is preserved as customDetails.ProcessCommandLine + from query column `CommandLine`; supplemental details do not restore entity identity, correlation, or alert parity + - All source MITRE tactics are preserved in source order in authored YAML. V3.1 ARM packaging carries only the first tactic + and its compatible techniques; this classification loss is not validated parity. Direct Graph deployment requires a + single tactic. + errors: [] + originalTactics: + - Execution + - DefenseEvasion + originalTechniques: + - T1059 + - T1027 + reviewScope: + sourceDocumentSha256: cbc7ee063db574c80bd5c99dd98bcff043487bd9336cba3585c362b8d82d30d2 + targetQuerySha256: fb876bc3350b450a14ec559706f2f3ddb7fc55f8faf3d469cc9b8094ec873f9f + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: false + aggregationWindowDifference: false + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: No summarize/make-series aggregation detected in query; native 4-hour XDR lookback relies on + Defender XDR alert deduplication across hourly runs. + sourceDocumentSha256: cbc7ee063db574c80bd5c99dd98bcff043487bd9336cba3585c362b8d82d30d2 + targetQuerySha256: fb876bc3350b450a14ec559706f2f3ddb7fc55f8faf3d469cc9b8094ec873f9f + supplementalEntityDetails: + - entityType: Process + entityIndex: 4 + identifier: ProcessId + sourceColumn: TargetProcessId + column: TargetProcessId + status: available + customDetailKey: ProcessProcessId + - entityType: Process + entityIndex: 4 + identifier: CommandLine + sourceColumn: CommandLine + column: CommandLine + status: available + customDetailKey: ProcessCommandLine +properties: + id: xdr-fdbcc0eb-44fb-467e-a51d-a91df0780a81 + displayName: Process Creation with Suspicious CommandLine Arguments + status: disabled + queryCondition: + queryText: |- + _ASim_ProcessEvent + | where EventType == 'ProcessCreated' + | extend CommandLineArgs = strcat_array(array_slice(split(CommandLine, " "), 1, -1), " ") + | where strlen(CommandLineArgs) > 0 + | where CommandLineArgs contains "base64" + | project + TimeGenerated, + DvcHostname, + DvcIpAddr, + DvcDomain, + TargetUsername, + TargetUsernameType, + TargetProcessName, + TargetProcessId, + CommandLine + | extend Username = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\')[1]), TargetUsername) + | extend NTDomain = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\')[0]), TargetUsername) + | extend Username = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[0]), Username) + | extend UPNSuffix = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[1]), '') + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Process Creation with Suspicious CommandLine Arguments + description: This analytic rule detects process creation events with base64 encoded command line arguments. This could + be an indication of a malicious process being executed. + severity: medium + entityMappings: + hosts: + - id: host1 + nameColumn: DvcHostname + dnsDomainColumn: DvcDomain + ntDomainColumn: NTDomain + ips: + - id: ip1 + addressColumn: DvcIpAddr + accounts: + - id: account1 + nameColumn: Username + upnSuffixColumn: UPNSuffix + ntDomainColumn: NTDomain + tactics: + - tactic: Execution + techniques: + - technique: T1059 + - tactic: DefenseEvasion + techniques: + - technique: T1027 + customDetails: + ProcessProcessId: TargetProcessId + ProcessCommandLine: CommandLine diff --git a/Solutions/Malware Protection Essentials/XDR Detections/WindowsAllowFirewallRuleAdded.yaml b/Solutions/Malware Protection Essentials/XDR Detections/WindowsAllowFirewallRuleAdded.yaml new file mode 100644 index 00000000000..7bade7dc41a --- /dev/null +++ b/Solutions/Malware Protection Essentials/XDR Detections/WindowsAllowFirewallRuleAdded.yaml @@ -0,0 +1,245 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: CrowdStrikeFalconEndpointProtection + dataTypes: + - CommonSecurityLog +- connectorId: MicrosoftThreatProtection + dataTypes: + - SecurityAlert +- connectorId: SentinelOne + dataTypes: + - SentinelOne_CL +- connectorId: VMwareCarbonBlack + dataTypes: + - CarbonBlackEvents_CL +- connectorId: CiscoSecureEndpoint + dataTypes: + - CiscoSecureEndpoint_CL +- connectorId: TrendMicroApexOne + dataTypes: + - TMApexOneEvent +- connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - CarbonBlackEvents_CL + - CiscoSecureEndpoint_CL + - CommonSecurityLog + - SecurityAlert + - SentinelOne_CL + requiredDataConnectors: + - connectorId: CrowdStrikeFalconEndpointProtection + dataTypes: + - CommonSecurityLog + - connectorId: MicrosoftThreatProtection + dataTypes: + - SecurityAlert + - connectorId: SentinelOne + dataTypes: + - SentinelOne_CL + - connectorId: VMwareCarbonBlack + dataTypes: + - CarbonBlackEvents_CL + - connectorId: CiscoSecureEndpoint + dataTypes: + - CiscoSecureEndpoint_CL + - connectorId: TrendMicroApexOne + dataTypes: + - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: 056593d4-ca3b-47a7-be9d-d1d0884a1d36 + path: Analytic Rules/WindowsAllowFirewallRuleAdded.yaml + version: 1.0.0 + querySha256: 9b8f5535691e7e96533a1f5935ea00f283306aaba07734f37d2ed1294f6b665f + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - Process.ProcessId value is retained as customDetails.ProcessProcessId from query column `ActingProcessId`, but its target + output binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.ProcessProcessId column `ActingProcessId` requires runtime output-schema binding verification + - Process.CommandLine value is retained as customDetails.ProcessCommandLine from query column `ActingProcessCommandLine`, + but its target output binding requires runtime-schema verification; custom details do not restore entity identity or + correlation + - Supplemental customDetails.ProcessCommandLine column `ActingProcessCommandLine` requires runtime output-schema binding + verification + - RegistryKey.Hive value is retained as customDetails.RegistryKeyHive from query column `RegHive`, but its target output + binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.RegistryKeyHive column `RegHive` requires runtime output-schema binding verification + - RegistryKey.Key value is retained as customDetails.RegistryKeyKey from query column `RegKey`, but its target output + binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.RegistryKeyKey column `RegKey` requires runtime output-schema binding verification + - RegistryValue.Value value is retained as customDetails.RegistryValueValue from query column `RegistryValueData`, but + its target output binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.RegistryValueValue column `RegistryValueData` requires runtime output-schema binding verification + - RegistryValue.ValueType value is retained as customDetails.RegistryValueValueType from query column `RegistryValueType`, + but its target output binding requires runtime-schema verification; custom details do not restore entity identity or + correlation + - Supplemental customDetails.RegistryValueValueType column `RegistryValueType` requires runtime output-schema binding + verification + - Custom-detail values must remain within the documented combined 4 KB per-alert limit; runtime values are unverified + and the service drops all custom details if exceeded + informational: [] + errors: [] + originalTactics: + - DefenseEvasion + originalTechniques: + - T1562 + reviewScope: + sourceDocumentSha256: 79192571e381e74bed57394cef736a5b88b2b9878348214eff0016b5ae9d795f + targetQuerySha256: f718a97a0d63a107fe9c6d76d210859a68ff5dd3307b8916d2275daae3dc6de2 + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: false + aggregationWindowDifference: false + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: No summarize/make-series aggregation detected in query; native 4-hour XDR lookback relies on + Defender XDR alert deduplication across hourly runs. + sourceDocumentSha256: 79192571e381e74bed57394cef736a5b88b2b9878348214eff0016b5ae9d795f + targetQuerySha256: f718a97a0d63a107fe9c6d76d210859a68ff5dd3307b8916d2275daae3dc6de2 + supplementalEntityDetails: + - entityType: Process + entityIndex: 3 + identifier: ProcessId + sourceColumn: ActingProcessId + column: ActingProcessId + status: runtime-binding-pending + customDetailKey: ProcessProcessId + - entityType: Process + entityIndex: 3 + identifier: CommandLine + sourceColumn: ActingProcessCommandLine + column: ActingProcessCommandLine + status: runtime-binding-pending + customDetailKey: ProcessCommandLine + - entityType: RegistryKey + entityIndex: 4 + identifier: Hive + sourceColumn: RegHive + column: RegHive + status: runtime-binding-pending + customDetailKey: RegistryKeyHive + - entityType: RegistryKey + entityIndex: 4 + identifier: Key + sourceColumn: RegKey + column: RegKey + status: runtime-binding-pending + customDetailKey: RegistryKeyKey + - entityType: RegistryValue + entityIndex: 5 + identifier: Value + sourceColumn: RegistryValueData + column: RegistryValueData + status: runtime-binding-pending + customDetailKey: RegistryValueValue + - entityType: RegistryValue + entityIndex: 5 + identifier: ValueType + sourceColumn: RegistryValueType + column: RegistryValueType + status: runtime-binding-pending + customDetailKey: RegistryValueValueType +properties: + id: xdr-056593d4-ca3b-47a7-be9d-d1d0884a1d36 + displayName: Detect Windows Allow Firewall Rule Addition/Modification + status: disabled + queryCondition: + queryText: |- + // List of Windows Firewall registry keys to monitor + let firewallRegistryList = dynamic([ + 'HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\RestrictedServices\\Static\\System', + 'HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\RestrictedServices\\Configurable\\System', + 'HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Defaults\\FirewallPolicy\\FirewallRules', + 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall' + ]); + _ASim_RegistryEvent + | where EventType in ('RegistryValueSet', 'RegistryKeyCreated') + | where RegistryKey has_any (firewallRegistryList) and RegistryValueData has_all ('Action=Allow', 'Active=TRUE') + | project + TimeGenerated, + DvcHostname, + ActorUsername, + ActorUsernameType, + ActingProcessId, + ActingProcessName, + ActingProcessCommandLine, + RegistryKey, + RegistryValue, + RegistryValueType, + RegistryValueData + | extend HostName = tostring(split(DvcHostname, '.')[0]) + | extend DnsDomain = tostring(strcat_array(array_slice(split(DvcHostname, '.'), 1, -1), '.')) + | extend Username = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\')[1]), ActorUsername) + | extend NTDomain = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\')[0]), ActorUsername) + | extend Username = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[0]), Username) + | extend UPNSuffix = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[1]), '') + | extend RegHive = tostring(split(RegistryKey, '\\')[0]), RegKey = tostring(strcat_array(array_slice(split(RegistryKey, '\\'), 1, -1), '\\')) + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Detect Windows Allow Firewall Rule Addition/Modification + description: This analytic rule detects any registry value creation or modification of Windows firewall registry keys + to allow network traffic. This could be an indication of defense evasion by an adversary to allow network traffic + to/from a compromised host. + severity: medium + entityMappings: + hosts: + - id: host1 + nameColumn: HostName + dnsDomainColumn: DnsDomain + ntDomainColumn: NTDomain + accounts: + - id: account1 + nameColumn: Username + upnSuffixColumn: UPNSuffix + ntDomainColumn: NTDomain + registryValues: + - id: registryValue1 + valueNameColumn: RegistryValue + tactics: + - tactic: DefenseEvasion + techniques: + - technique: T1562 + customDetails: + ProcessProcessId: ActingProcessId + ProcessCommandLine: ActingProcessCommandLine + RegistryKeyHive: RegHive + RegistryKeyKey: RegKey + RegistryValueValue: RegistryValueData + RegistryValueValueType: RegistryValueType diff --git a/Solutions/Malware Protection Essentials/XDR Detections/WindowsUpdateDisabled.yaml b/Solutions/Malware Protection Essentials/XDR Detections/WindowsUpdateDisabled.yaml new file mode 100644 index 00000000000..ff09911965c --- /dev/null +++ b/Solutions/Malware Protection Essentials/XDR Detections/WindowsUpdateDisabled.yaml @@ -0,0 +1,243 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: CrowdStrikeFalconEndpointProtection + dataTypes: + - CommonSecurityLog +- connectorId: MicrosoftThreatProtection + dataTypes: + - SecurityAlert +- connectorId: SentinelOne + dataTypes: + - SentinelOne_CL +- connectorId: VMwareCarbonBlack + dataTypes: + - CarbonBlackEvents_CL +- connectorId: CiscoSecureEndpoint + dataTypes: + - CiscoSecureEndpoint_CL +- connectorId: TrendMicroApexOne + dataTypes: + - TMApexOneEvent +- connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - CarbonBlackEvents_CL + - CiscoSecureEndpoint_CL + - CommonSecurityLog + - SecurityAlert + - SentinelOne_CL + requiredDataConnectors: + - connectorId: CrowdStrikeFalconEndpointProtection + dataTypes: + - CommonSecurityLog + - connectorId: MicrosoftThreatProtection + dataTypes: + - SecurityAlert + - connectorId: SentinelOne + dataTypes: + - SentinelOne_CL + - connectorId: VMwareCarbonBlack + dataTypes: + - CarbonBlackEvents_CL + - connectorId: CiscoSecureEndpoint + dataTypes: + - CiscoSecureEndpoint_CL + - connectorId: TrendMicroApexOne + dataTypes: + - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: f1443a87-78d5-40c3-b051-f468f0f2def0 + path: Analytic Rules/WindowsUpdateDisabled.yaml + version: 1.0.0 + querySha256: 64b135be87b6e21d6f95e9e623b17dd2c7cba8d7c80c93477fffb9c5a98aa054 + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - Process.ProcessId value is retained as customDetails.ProcessProcessId from query column `ActingProcessId`, but its target + output binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.ProcessProcessId column `ActingProcessId` requires runtime output-schema binding verification + - Process.CommandLine value is retained as customDetails.ProcessCommandLine from query column `ActingProcessCommandLine`, + but its target output binding requires runtime-schema verification; custom details do not restore entity identity or + correlation + - Supplemental customDetails.ProcessCommandLine column `ActingProcessCommandLine` requires runtime output-schema binding + verification + - RegistryKey.Hive value is retained as customDetails.RegistryKeyHive from query column `RegHive`, but its target output + binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.RegistryKeyHive column `RegHive` requires runtime output-schema binding verification + - RegistryKey.Key value is retained as customDetails.RegistryKeyKey from query column `RegKey`, but its target output + binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.RegistryKeyKey column `RegKey` requires runtime output-schema binding verification + - RegistryValue.Value value is retained as customDetails.RegistryValueValue from query column `RegistryValueData`, but + its target output binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.RegistryValueValue column `RegistryValueData` requires runtime output-schema binding verification + - RegistryValue.ValueType value is retained as customDetails.RegistryValueValueType from query column `RegistryValueType`, + but its target output binding requires runtime-schema verification; custom details do not restore entity identity or + correlation + - Supplemental customDetails.RegistryValueValueType column `RegistryValueType` requires runtime output-schema binding + verification + - Custom-detail values must remain within the documented combined 4 KB per-alert limit; runtime values are unverified + and the service drops all custom details if exceeded + informational: [] + errors: [] + originalTactics: + - DefenseEvasion + originalTechniques: + - T1562 + reviewScope: + sourceDocumentSha256: 6ea745beeac95b5ef22a5138e58a3885ae480bf7e89649afab71cc6518227c42 + targetQuerySha256: 39060f43c2637704df73fd4481c40bc8cd34c5ec753c652f30add1351e749858 + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: false + aggregationWindowDifference: false + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: No summarize/make-series aggregation detected in query; native 4-hour XDR lookback relies on + Defender XDR alert deduplication across hourly runs. + sourceDocumentSha256: 6ea745beeac95b5ef22a5138e58a3885ae480bf7e89649afab71cc6518227c42 + targetQuerySha256: 39060f43c2637704df73fd4481c40bc8cd34c5ec753c652f30add1351e749858 + supplementalEntityDetails: + - entityType: Process + entityIndex: 3 + identifier: ProcessId + sourceColumn: ActingProcessId + column: ActingProcessId + status: runtime-binding-pending + customDetailKey: ProcessProcessId + - entityType: Process + entityIndex: 3 + identifier: CommandLine + sourceColumn: ActingProcessCommandLine + column: ActingProcessCommandLine + status: runtime-binding-pending + customDetailKey: ProcessCommandLine + - entityType: RegistryKey + entityIndex: 4 + identifier: Hive + sourceColumn: RegHive + column: RegHive + status: runtime-binding-pending + customDetailKey: RegistryKeyHive + - entityType: RegistryKey + entityIndex: 4 + identifier: Key + sourceColumn: RegKey + column: RegKey + status: runtime-binding-pending + customDetailKey: RegistryKeyKey + - entityType: RegistryValue + entityIndex: 5 + identifier: Value + sourceColumn: RegistryValueData + column: RegistryValueData + status: runtime-binding-pending + customDetailKey: RegistryValueValue + - entityType: RegistryValue + entityIndex: 5 + identifier: ValueType + sourceColumn: RegistryValueType + column: RegistryValueType + status: runtime-binding-pending + customDetailKey: RegistryValueValueType +properties: + id: xdr-f1443a87-78d5-40c3-b051-f468f0f2def0 + displayName: Detect Windows Update Disabled from Registry + status: disabled + queryCondition: + queryText: |- + // List of Windows Firewall registry keys to monitor + let windowsUpdateRegistryList = dynamic([ + 'HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate', + 'HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU' + ]); + _ASim_RegistryEvent + | where EventType in ('RegistryValueSet', 'RegistryKeyCreated') + | where RegistryKey has_any (windowsUpdateRegistryList) + | where RegistryValue has_any ('AUOptions', 'NoAutoUpdate') and RegistryValueData == '1' + | project + TimeGenerated, + DvcHostname, + ActorUsername, + ActorUsernameType, + ActingProcessId, + ActingProcessName, + ActingProcessCommandLine, + RegistryKey, + RegistryValue, + RegistryValueType, + RegistryValueData + | extend HostName = tostring(split(DvcHostname, '.')[0]) + | extend DnsDomain = tostring(strcat_array(array_slice(split(DvcHostname, '.'), 1, -1), '.')) + | extend Username = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\')[1]), ActorUsername) + | extend NTDomain = iff(tostring(ActorUsernameType) == 'Windows', tostring(split(ActorUsername, '\\')[0]), ActorUsername) + | extend Username = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[0]), Username) + | extend UPNSuffix = iff(tostring(ActorUsernameType) == 'UPN', tostring(split(ActorUsername, '@')[1]), '') + | extend RegHive = tostring(split(RegistryKey, '\\')[0]), RegKey = tostring(strcat_array(array_slice(split(RegistryKey, '\\'), 1, -1), '\\')) + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Detect Windows Update Disabled from Registry + description: This analytic rule detects any registry value creation or modification of Windows Update registry keys + to disable Windows Update. This could be an indication of defense evasion by an adversary on a compromised host. + severity: medium + entityMappings: + hosts: + - id: host1 + nameColumn: HostName + dnsDomainColumn: DnsDomain + ntDomainColumn: NTDomain + accounts: + - id: account1 + nameColumn: Username + upnSuffixColumn: UPNSuffix + ntDomainColumn: NTDomain + registryValues: + - id: registryValue1 + valueNameColumn: RegistryValue + tactics: + - tactic: DefenseEvasion + techniques: + - technique: T1562 + customDetails: + ProcessProcessId: ActingProcessId + ProcessCommandLine: ActingProcessCommandLine + RegistryKeyHive: RegHive + RegistryKeyKey: RegKey + RegistryValueValue: RegistryValueData + RegistryValueValueType: RegistryValueType