Detection rules › Kusto Query Language

Caramel Tsunami Actor IOC - July 2021

Source: upstream

'Identifies a match across IOC's related to an actor tracked by Microsoft as Caramel Tsunami'

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1546` Event Triggered Execution
Privilege Escalation	`T1546` Event Triggered Execution

Event coverage

Provider	Event ID	Title
Security-Auditing	4688	A new process has been created.

Stages and Predicates

Stage 1: `source`

WindowsEvent

Stage 2: `where`

and
  or
    EventData match "file_path1"
    EventData match "file_path2"
    EventData match "file_path3"
    EventData match "reg add"
    EventData match "reg_key"
  EventID eq "4688"

Stage 3: `extend`

Stage 4: `extend`

Stage 5: `extend`

Stage 6: `where`

or
  and
    CommandLine match "file_path2"
    CommandLine match "reg add"
    CommandLine match "reg_key"
  CommandLine match "file_path1"
  CommandLine match "file_path3"
  NewProcessName match "file_path1"
  NewProcessName match "file_path3"
  ParentProcessName match "file_path1"
  ParentProcessName match "file_path3"

Stage 7: `extend`

Stage 8: `extend`

Stage 9: `extend`

Stage 10: `project`

Stage 11: `extend`

Stage 12: `extend`

Stage 13: `extend`

Stage 14: `extend`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`file_path1` `file_path2` `file_path3` `reg add` `reg_key`
`EventData`	match	`file_path1` `file_path2` `file_path3` `reg add` `reg_key`
`EventID`	eq	`4688`
`NewProcessName`	match	`file_path1` `file_path3`
`ParentProcessName`	match	`file_path1` `file_path3`

Caramel Tsunami Actor IOC - July 2021

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: extend

Stage 4: extend

Stage 5: extend

Stage 6: where

Stage 7: extend

Stage 8: extend

Stage 9: extend

Stage 10: project

Stage 11: extend

Stage 12: extend

Stage 13: extend

Stage 14: extend