Securityalert A History File Has Been Cleared
KQL detection rule by ep3p · MIT
No description provided
let _ExpectedCommandLinesRegex = toscalar(
_GetWatchlist("Activity-ExpectedSignificantActivity")
| where Activity == "HistoryFileClearedCommand"
| summarize RegEx = make_list(Auxiliar)
| project RegEx = strcat(@'^(', strcat_array(RegEx, '|'), @')$')
);
SecurityAlert
| where AlertName has "A history file has been cleared" and ProviderName == "Azure Security Center"
| summarize arg_min(TimeGenerated, *) by SystemAlertId
| extend ExtendedProperties = todynamic(ExtendedProperties)
| extend
Computer = tostring(ExtendedProperties["Compromised Host"]),
Account = tostring(ExtendedProperties["User Name"]),
Process = tostring(ExtendedProperties["Suspicious Process"]),
CommandLine = tostring(ExtendedProperties["Suspicious Command Line"])
| where not(CommandLine matches regex _ExpectedCommandLinesRegex)
// Clean Entities
| extend Entities = replace_regex(Entities, @'(\,\"\w+\"\:\{\"\$ref\"\:\"\d+\"\}|\"\w+\"\:\{\"\$ref\"\:\"\d+\"\}\,|\,\{\"\$ref\"\:\"\d+\"\})|\"\$id\"\:\"\d+\"\,', '')
| summarize
TimeGenerated = min(TimeGenerated),
StartTime = min(StartTime),
EndTime = max(EndTime),
Processes = make_set(Process, 250),
CommandLines = make_set(CommandLine, 250),
AlertLinks = make_set(AlertLink, 250),
Entities = make_set(todynamic(Entities)),
take_any(RemediationSteps, Tactics, Techniques)
by AlertName, AlertSeverity, Description, ResourceId = tolower(ResourceId), Computer, Account
| project
TimeGenerated,
AlertName,
AlertSeverity,
Description,
RemediationSteps,
ResourceId,
StartTime,
EndTime,
Computer,
Account,
Processes,
CommandLines,
AlertLinks,
Tactics,
Techniques,
Entities