Securityalert Rare Svchost Service Group Executed
KQL detection rule by ep3p · MIT
No description provided
SecurityAlert
| where AlertName has "Rare SVCHOST service group executed" and ProviderName == "Azure Security Center"
| summarize arg_min(TimeGenerated, *) by SystemAlertId
| extend ExtendedProperties = todynamic(ExtendedProperties)
| extend
Account = tostring(ExtendedProperties["user name"]),
AccountSID = tostring(ExtendedProperties["User SID"]),
AccountLogonId = tostring(ExtendedProperties["account logon id"]),
ProcessName = tostring(ExtendedProperties["process name"]),
CommandLine = tostring(ExtendedProperties["command line"]),
ProcessId = tostring(ExtendedProperties["process id"]),
ParentProcess = tostring(ExtendedProperties["parent process"]),
ParentProcessId = tostring(ExtendedProperties["parent process id"]),
ResourceType = tostring(ExtendedProperties["resourceType"]),
Computer = CompromisedEntity
// Clean Entities
| extend Entities = replace_regex(Entities, @'(\,\"\w+\"\:\{\"\$ref\"\:\"\d+\"\}|\"\w+\"\:\{\"\$ref\"\:\"\d+\"\}\,|\,\{\"\$ref\"\:\"\d+\"\})|\"\$id\"\:\"\d+\"\,', '')
| summarize
TimeGenerated = min(TimeGenerated),
StartTime = min(StartTime),
EndTime = max(EndTime),
AccountLogonIds = make_set(AccountLogonId, 250),
ProcessNames = make_set(ProcessName, 250),
CommandLines = make_set(CommandLine, 250),
ProcessIds = make_set(ProcessId, 250),
ParentProcesses = make_set(ParentProcess, 250),
ParentProcessIds = make_set(ParentProcessId, 250),
AlertLinks = make_set(AlertLink, 250),
Entities = make_set(todynamic(Entities)),
take_any(RemediationSteps, Tactics, Techniques)
by AlertName, AlertSeverity, Description, ResourceId = tolower(ResourceId), Computer, Account, AccountSID, ResourceType
| project
TimeGenerated,
AlertName,
AlertSeverity,
Description,
RemediationSteps,
ResourceId,
ResourceType,
StartTime,
EndTime,
Computer,
Account,
AccountSID,
AccountLogonIds,
ProcessNames,
CommandLines,
ProcessIds,
ParentProcesses,
ParentProcessIds,
AlertLinks,
Tactics,
Techniques,
Entities