Custom Rules use case examples
There are several common Custom Rules use cases:
- Detection of Unprivileged Authorization Granted
- Log Field Presence Indicator
- Credential Dumping Detection
Detection of unprivileged authorization granted
The following Custom Rules use case triggers a threat Detection when a k8 pod is granted permission using an account with insufficient privileges:
General Settings
The Custom Rule TYPE is "Threat" and the Priority SCHEDULE depends the user's specific use case circumstances.
Search Query
The following query searches Hot and Warm storage for Google Cloud Activity Logs with the auth_granted field showing a value of "true" and the auth_permission field showing a value that identifies a specific authorization policy and the resource_name field showing a value that confirms an unprivileged authorization event has occurred:
data_source:google_cloud_activity_logs AND auth_granted:true AND
auth_permission:"io.k8s.policy.v1beta1.podsecuritypolicies.patch" AND
resource_name:"policy/v1beta1/podsecuritypolicies/gce.unprivileged-addon"
The query is grouped by src_ip4.
Trigger Conditions
The rule is set to trigger an outcome when the Search Query matches more than five times:
query_a:>5
Outcomes
The TRIGGER is a "Detection" ATTRIBUTED TO "src_ip4" with a SEVERITY of "High". The DETECTION NAME is"Unauthorized access to k8 pod".
Log field event presence Indicator
The following Custom Rules use case triggers an "Indicator" when one of three Fortinet even log field event IDs are present:
General Settings
The Custom Rule TYPE is "Indicator" and the Priority SCHEDULE depends the user's specific use case circumstances.
Search Query
The following query searches Hot and Warm log storage for any one of three Fortinet event log fields:
data_source:fortinet_logs AND event_id:(43009 OR 320003 OR 00014)
The query is grouped by src_ip4.
Trigger Conditions
The rule is set to trigger an outcome when the Search Query matches one instance:
query_a:>0
Outcomes
The TRIGGER is an "Indicator" ATTRIBUTED TO "src_ip4" with the Indicator notification sent to the rule author.
Credential dumping detection
The following Custom Rules use case triggers a threat Detection when Windows Task Manager is used to dump memory space:
General Settings
The Custom Rule TYPE is "Threat" and the Priority SCHEDULE depends the user's specific use case circumstances.
Search Query
The following query searches Sysmon logs in Hot and Warm storage for a specific event code and a value showing a .dmp file with lsass in its name produced by taskmgr.exe:
data_source:sysmon AND event_code=11 AND target_file_name="*lsass*.dmp" AND
image="C:\\Windows\\*\\taskmgr.exe
Trigger Conditions
The rule is set to trigger an outcome when the Search Query matches one instance:
query_a:>0
Outcomes
The TRIGGER is a "Detection" ATTRIBUTED TO "src_ip4" with a SEVERITY of "High". The DETECTION NAME is"Credential Dumping Detected".