{ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "workspaceResourceId": { "type": "string", "metadata": { "description": "Log Analytics workspace resource ID" } } }, "variables": { "workspaceName": "[last(split(parameters('workspaceResourceId'), '/'))]" }, "resources": [ { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-auth-001'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Authentication Failure", "description": "Detects individual authentication failure events. While a single failure\nmay be benign, these events are the building blocks for brute force and\ncredential spray correlation rules.\n", "severity": "Medium", "enabled": false, "query": "# Rule: Authentication Failure\n# ID: a5bd8123-efcd-5b32-b876-d25249e8eb1e\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"auth_failure\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "CredentialAccess" ], "techniques": [ "T1110" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-auth-002'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Brute Force Indicator", "description": "Detects high-severity authentication failures that may indicate active\nbrute force attempts. These single-event indicators are enriched by\nWitFoo's lead rule engine to flag repeated failures.\n", "severity": "High", "enabled": false, "query": "# Rule: Brute Force Indicator\n# ID: 8aab7806-a54b-59a6-9a1b-9970f42ec97d\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"auth_failure\" and (severityLabel in~ (\"high\", \"critical\"))", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "CredentialAccess" ], "techniques": [ "T1110.001" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-auth-003'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Credential Access Attempt", "description": "Detects credential access attempts including credential dumping, token theft,\nand keystroke logging indicators classified by WitFoo's artifact enrichment.\n", "severity": "High", "enabled": false, "query": "# Rule: Credential Access Attempt\n# ID: be26a7dc-4b66-55bc-aa4b-e0069b960f9c\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"credential_access\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "CredentialAccess" ], "techniques": [ "T1003" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-auth-004'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Privilege Escalation", "description": "Detects privilege escalation events where a user or process gains elevated\naccess beyond their normal permissions. This is a critical security event\nthat may indicate exploitation of vulnerabilities or misconfigurations.\n", "severity": "High", "enabled": false, "query": "# Rule: Privilege Escalation\n# ID: d134c547-be64-589a-94eb-fe05969ead09\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"privilege_escalation\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "PrivilegeEscalation" ], "techniques": [ "T1068" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-auth-005'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Administrative Account Activity", "description": "Detects activity by administrative or high-privilege accounts. While not\ninherently malicious, tracking admin actions provides audit trail for\ncompliance and helps identify compromised privileged accounts.\n", "severity": "Medium", "enabled": false, "query": "# Rule: Administrative Account Activity\n# ID: 42447905-4754-53b3-9772-dbe5b8c3d8b7\n# Generated by WitFoo Sigma Converter\n\n(userName contains \"admin\" or userName contains \"root\" or userName contains \"Administrator\") and (severityLabel in~ (\"high\", \"critical\"))", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "Persistence" ], "techniques": [ "T1078.002" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-auth-006'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Malicious Session Detection", "description": "Detects sessions classified as malicious by WitFoo's behavioral analysis.\nThis includes sessions exhibiting characteristics of account takeover,\nsession hijacking, or unauthorized access after credential compromise.\n", "severity": "High", "enabled": false, "query": "# Rule: Malicious Session Detection\n# ID: 0827c275-02b9-5e34-9258-d6ad77f373e7\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"malicious_session\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "DefenseEvasion" ], "techniques": [ "T1078" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-auth-007'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Defense Evasion Activity", "description": "Detects defense evasion techniques including log tampering, security tool\ndisabling, indicator removal, and other actions intended to avoid detection\nby security monitoring systems.\n", "severity": "High", "enabled": false, "query": "# Rule: Defense Evasion Activity\n# ID: 2f252d3e-23b1-50f6-9eba-b8165067769d\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"defense_evasion\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "DefenseEvasion" ], "techniques": [ "T1562" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-auth-008'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Service Discovery Activity", "description": "Detects service discovery and network enumeration activity that may indicate\nreconnaissance by an attacker who has gained initial access. Includes port\nscanning, service fingerprinting, and network mapping.\n", "severity": "Medium", "enabled": false, "query": "# Rule: Service Discovery Activity\n# ID: 8c303506-bd68-5cd6-a98f-944d27bf0e6c\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"service_discovery\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "Discovery" ], "techniques": [ "T1046" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-cloud-001'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Cloud Privilege Escalation", "description": "Detects privilege escalation events in cloud environments including\nIAM role assumption, service account key creation, and permission\nboundary modifications.\n", "severity": "High", "enabled": false, "query": "# Rule: Cloud Privilege Escalation\n# ID: af72779c-1803-5f8c-8a5f-4a9552583bec\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"privilege_escalation\" and (streamName contains \"aws\" or streamName contains \"azure\" or streamName contains \"gcp\" or streamName contains \"cloud\")", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "PrivilegeEscalation" ], "techniques": [ "T1078.004" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-cloud-002'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Cloud Configuration Change", "description": "Detects infrastructure configuration changes in cloud environments that\nmay weaken security posture, including security group modifications,\nfirewall rule changes, and logging configuration alterations.\n", "severity": "High", "enabled": false, "query": "# Rule: Cloud Configuration Change\n# ID: 1c1ef0ad-ed2c-5d21-a627-1da2bc33e2b0\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"config_change\" and (streamName contains \"aws\" or streamName contains \"azure\" or streamName contains \"gcp\" or streamName contains \"cloud\")", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "DefenseEvasion" ], "techniques": [ "T1562.007" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-cloud-003'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Cloud API Abuse", "description": "Detects anomalous cloud API call patterns that may indicate compromised\ncredentials, unauthorized automation, or adversary reconnaissance of\ncloud infrastructure.\n", "severity": "High", "enabled": false, "query": "# Rule: Cloud API Abuse\n# ID: ff214e11-8ed2-52fa-b12f-14b5ef347644\n# Generated by WitFoo Sigma Converter\n\n(streamName contains \"aws_cloudtrail\" or streamName contains \"azure_activity\" or streamName contains \"gcp_audit\") and (severityLabel in~ (\"high\", \"critical\"))", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "Execution" ], "techniques": [ "T1106" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-cloud-004'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Phishing Email Detection", "description": "Detects phishing emails identified by email security gateways or\nWitFoo's threat intelligence enrichment. Phishing is one of the most\ncommon initial access vectors for cyber attacks.\n", "severity": "High", "enabled": false, "query": "# Rule: Phishing Email Detection\n# ID: 7a933235-06ec-555f-96ba-3371a531c0e3\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"phishing_email\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "InitialAccess" ], "techniques": [ "T1566" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-cloud-005'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Phishing Link Click", "description": "Detects when a user clicks on a phishing link, indicating potential\ncredential compromise or malware delivery. This is a high-priority event\nrequiring immediate user notification and credential reset evaluation.\n", "severity": "High", "enabled": false, "query": "# Rule: Phishing Link Click\n# ID: f95d4319-a649-5635-be85-f488d8b357c9\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"phishing_click\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "InitialAccess" ], "techniques": [ "T1204.001" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-cloud-006'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Policy Violation", "description": "Detects security policy violations including acceptable use violations,\ndata handling policy breaches, and compliance control failures detected\nby DLP, CASB, or policy enforcement tools.\n", "severity": "Medium", "enabled": false, "query": "# Rule: Policy Violation\n# ID: 0eeb4864-956e-5a11-8cd4-20e3176fe7ae\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"policy_violation\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "DefenseEvasion" ], "techniques": [ "T1078" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-comp-001'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: IDS Event Detection", "description": "Detects intrusion detection system (IDS) alerts forwarded through WitFoo's\nartifact pipeline. These are network-based or host-based IDS signatures\nthat matched suspicious or malicious traffic patterns.\n", "severity": "High", "enabled": false, "query": "# Rule: IDS Event Detection\n# ID: 79c8f7cf-8a02-5ce5-ac03-d1817c3ae0fc\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"ids_event\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "InitialAccess" ], "techniques": [ "T1190" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-comp-002'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: IPS Action Taken", "description": "Detects intrusion prevention system (IPS) events where protective action\nwas taken (block, drop, reset). These indicate the IPS actively prevented\na detected attack from succeeding.\n", "severity": "High", "enabled": false, "query": "# Rule: IPS Action Taken\n# ID: b557ee31-1109-58a0-8d48-f5f61961ceb1\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"ids_action\" or (action contains \"block\" or action contains \"drop\" or action contains \"reset\" or action contains \"deny\")", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "InitialAccess" ], "techniques": [ "T1190" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-comp-003'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Content Filter Match", "description": "Detects content filtering events where web content, email content, or\nfile content matched a DLP or content inspection policy. May indicate\nsensitive data exposure or policy violations.\n", "severity": "Medium", "enabled": false, "query": "# Rule: Content Filter Match\n# ID: a538c551-98dd-5619-9864-680006f6246e\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"content_filter\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "CommandAndControl" ], "techniques": [ "T1071" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-comp-004'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Indicator of Compromise Match", "description": "Detects matches against known indicators of compromise (IOCs) from threat\nintelligence feeds. This includes IP addresses, domain names, file hashes,\nand URLs associated with known threat actors or malware campaigns.\n", "severity": "High", "enabled": false, "query": "# Rule: Indicator of Compromise Match\n# ID: cbff388c-58e8-5ada-9528-20bf07c52d9d\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"ioc_match\" or stixIndicatorIds matches regex \".+\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "CommandAndControl" ], "techniques": [ "T1071" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-comp-005'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Indicator of Misconfiguration Match", "description": "Detects indicators of misconfiguration (IOMs) that may create security\nvulnerabilities. Includes open ports, weak encryption, missing patches,\nand non-compliant configurations detected by vulnerability scanners\nor configuration audit tools.\n", "severity": "Medium", "enabled": false, "query": "# Rule: Indicator of Misconfiguration Match\n# ID: 4005ffe7-c887-5239-a0a6-65076fd215bb\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"iom_match\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "DefenseEvasion" ], "techniques": [ "T1562" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-dlp-001'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Data Staging Activity", "description": "Detects data staging activity where an adversary collects and stages data\nin preparation for exfiltration. This may include copying files to a\ncentral location, archiving data, or staging data on network shares.\n", "severity": "High", "enabled": false, "query": "# Rule: Data Staging Activity\n# ID: 5d7a00bb-45a8-5123-918e-fbce8d521dcc\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"data_staging\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "Collection" ], "techniques": [ "T1074" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-dlp-002'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Data Exfiltration", "description": "Detects data exfiltration events where sensitive data is being transferred\nto unauthorized external destinations. This is a critical alert requiring\nimmediate investigation and response.\n", "severity": "High", "enabled": false, "query": "# Rule: Data Exfiltration\n# ID: 4a9c6988-4b05-51d0-b019-fa76a56d3a5a\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"data_exfiltration\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "Exfiltration" ], "techniques": [ "T1041" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-dlp-003'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Data Destruction", "description": "Detects data destruction events including unauthorized file deletion,\ndisk wiping, and database truncation. May indicate a disgruntled insider,\nransomware cleanup phase, or adversary covering tracks.\n", "severity": "High", "enabled": false, "query": "# Rule: Data Destruction\n# ID: 0310bb40-a034-52b0-a7c1-8ebc25af5328\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"data_destruction\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "Impact" ], "techniques": [ "T1485" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-dlp-004'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Large Outbound Data Transfer", "description": "Detects large outbound data transfers that exceed typical thresholds,\npotentially indicating data exfiltration via network protocols. Focuses\non client-originated bytes to external destinations.\n", "severity": "High", "enabled": false, "query": "# Rule: Large Outbound Data Transfer\n# ID: f0efba8d-32db-549d-950d-b339bf124348\n# Generated by WitFoo Sigma Converter\n\nclientBytes >= 52428800", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "Exfiltration" ], "techniques": [ "T1048" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-dlp-005'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Suspicious HTTP POST Exfiltration", "description": "Detects large HTTP POST requests to external servers that may indicate\ndata exfiltration via web protocols. Attackers commonly use HTTP/HTTPS\nPOST to exfiltrate data as it blends with normal web traffic.\n", "severity": "High", "enabled": false, "query": "# Rule: Suspicious HTTP POST Exfiltration\n# ID: e71fe11b-3ac4-5762-9689-f129d2ae9207\n# Generated by WitFoo Sigma Converter\n\naction contains \"POST\" and clientBytes >= 10485760", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "Exfiltration" ], "techniques": [ "T1048.003" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-dlp-006'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Unauthorized File Transfer", "description": "Detects file transfer activity to destinations not on the approved list,\nincluding FTP, SCP, and other file transfer protocols carrying potentially\nsensitive data to unauthorized servers.\n", "severity": "High", "enabled": false, "query": "# Rule: Unauthorized File Transfer\n# ID: b66c2977-3f6b-5d5f-a90b-f199836711a2\n# Generated by WitFoo Sigma Converter\n\n(protocol contains \"FTP\" or protocol contains \"SCP\" or protocol contains \"SFTP\") or ((serverPort in~ (\"21\", \"22\", \"69\")) and fileName matches regex \".+\")", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "Exfiltration" ], "techniques": [ "T1041" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-ids-001'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Suricata High Severity Alert", "description": "Detects high-severity Suricata IDS alerts (severity 1-2) forwarded through\nWitFoo's artifact pipeline. These represent the most critical network-based\nthreat detections requiring immediate investigation.\n", "severity": "High", "enabled": false, "query": "# Rule: Suricata High Severity Alert\n# ID: 13044d28-8b43-5eb6-9dab-11cd610bfb7e\n# Generated by WitFoo Sigma Converter\n\nstreamName contains \"suricata\" and (severityCode in~ (\"1\", \"2\"))", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "InitialAccess" ], "techniques": [ "T1190" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-ids-002'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Suricata ATT&CK Mapped Alert", "description": "Detects Suricata alerts that have been enriched with MITRE ATT&CK technique\nmappings, indicating that the IDS signature corresponds to a known adversary\ntechnique. These are higher-confidence detections with tactical context.\n", "severity": "High", "enabled": false, "query": "# Rule: Suricata ATT&CK Mapped Alert\n# ID: ce08894a-1962-51b2-8370-da3a61953bb2\n# Generated by WitFoo Sigma Converter\n\nstreamName contains \"suricata\" and attackTechniqueIds matches regex \"T\\\\d{4}\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "Execution" ], "techniques": [ "T1059" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-ids-003'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Zeek Notice Event", "description": "Detects Zeek (formerly Bro) notice events, which are higher-level network\nanalysis findings including protocol violations, certificate anomalies,\nand behavioral detections from Zeek's scripting engine.\n", "severity": "High", "enabled": false, "query": "# Rule: Zeek Notice Event\n# ID: 4dc0777c-148e-55cf-855a-2a88fcc7f7fc\n# Generated by WitFoo Sigma Converter\n\nstreamName contains \"zeek_notice\" or streamName contains \"zeek_weird\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "Discovery" ], "techniques": [ "T1046" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-ids-004'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Deprecated TLS Version Usage", "description": "Detects usage of deprecated TLS versions (TLS 1.0 and TLS 1.1) that are\nno longer considered secure. These connections may be targeted for\ndowngrade attacks and violate modern compliance requirements.\n", "severity": "Medium", "enabled": false, "query": "# Rule: Deprecated TLS Version Usage\n# ID: 67a095d3-2652-56e8-95af-19e63ba1f20c\n# Generated by WitFoo Sigma Converter\n\n(streamName contains \"zeek_ssl\" or streamName contains \"tls\") and (message contains \"TLSv1.0\" or message contains \"TLSv1.1\" or message contains \"SSLv3\" or message contains \"SSLv2\")", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "CommandAndControl" ], "techniques": [ "T1573" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-ids-005'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Anomalous Network Behavior", "description": "Detects anomalous network behavior events that deviate from established\nbaselines. These behavioral anomalies may indicate novel attacks, insider\nthreats, or compromised systems exhibiting unusual communication patterns.\n", "severity": "Medium", "enabled": false, "query": "# Rule: Anomalous Network Behavior\n# ID: 7d8315be-17f4-5a48-ba1c-565e88a3680f\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"anomalous_behavior\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "CommandAndControl" ], "techniques": [ "T1071" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-infra-001'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Service Disruption", "description": "Detects service disruption events including denial of service indicators,\nservice outages, and availability degradation. May indicate active DDoS\nattacks, resource exhaustion, or infrastructure failures.\n", "severity": "High", "enabled": false, "query": "# Rule: Service Disruption\n# ID: c3875f59-ef02-50ad-aaa6-cc39dd56d049\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"service_disruption\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "Impact" ], "techniques": [ "T1499" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-infra-002'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Degraded Hardware Alert", "description": "Detects hardware health degradation alerts from infrastructure monitoring\nsystems. Includes disk failures, memory errors, CPU thermal events, and\npower supply issues that may affect system availability.\n", "severity": "Medium", "enabled": false, "query": "# Rule: Degraded Hardware Alert\n# ID: 9c2fd067-2bde-5277-b736-500b2d549772\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"degraded_hardware\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "Impact" ], "techniques": [ "T1499" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-infra-003'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Degraded Service Alert", "description": "Detects service health degradation including increased latency, elevated\nerror rates, connection pool exhaustion, and service dependency failures\nreported by application performance monitoring tools.\n", "severity": "Medium", "enabled": false, "query": "# Rule: Degraded Service Alert\n# ID: cf160da6-924f-5c99-99d6-f9978d0ddbc4\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"degraded_service\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "Impact" ], "techniques": [ "T1499" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-infra-004'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Financial System Anomaly", "description": "Detects anomalous activity in financial systems including unauthorized\ntransaction patterns, accounting system modifications, and payment\nprocessing irregularities that may indicate fraud or data manipulation.\n", "severity": "High", "enabled": false, "query": "# Rule: Financial System Anomaly\n# ID: aa7de010-3e25-50e4-b43e-978e93da0c4e\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"financial_anomaly\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "Impact" ], "techniques": [ "T1565" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-infra-005'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Infrastructure Exploit Attempt", "description": "Detects exploit attempts targeting infrastructure components including\nweb servers, application servers, databases, and network devices. Matches\nevents classified as exploit attempts with associated CVE identifiers.\n", "severity": "High", "enabled": false, "query": "# Rule: Infrastructure Exploit Attempt\n# ID: 89099789-c049-554d-8e43-b5233eee7d83\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"exploit_attempt\" or cve matches regex \"^CVE-\\\\d{4}-\\\\d+\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "InitialAccess" ], "techniques": [ "T1190" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-mal-001'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Malicious Behavior Detection", "description": "Detects events classified as malicious behavior by WitFoo's enrichment engine.\nThis covers a broad range of malware indicators including suspicious process\nexecution, anomalous system calls, and behavioral analysis triggers.\n", "severity": "High", "enabled": false, "query": "# Rule: Malicious Behavior Detection\n# ID: d4d56bc1-240b-58e9-a427-d06211773eee\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"malicious_behavior\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "Execution" ], "techniques": [ "T1027" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-mal-002'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Botnet Connection", "description": "Detects connections to known botnet command-and-control infrastructure.\nWitFoo's threat intelligence enrichment classifies these connections\nbased on IOC matching and behavioral patterns.\n", "severity": "High", "enabled": false, "query": "# Rule: Botnet Connection\n# ID: bced670e-b1e7-5b9f-9968-917bb708c126\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"botnet_connection\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "CommandAndControl" ], "techniques": [ "T1071.001" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-mal-003'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Ransomware Download Indicator", "description": "Detects ransomware payload download activity identified by WitFoo's\nenrichment engine. This is the initial delivery phase of a ransomware\nattack chain, before encryption begins.\n", "severity": "High", "enabled": false, "query": "# Rule: Ransomware Download Indicator\n# ID: 11444b32-1bd8-56d1-817f-e9a82457cf64\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"ransomware_download\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "Impact", "InitialAccess" ], "techniques": [ "T1486" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-mal-004'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Ransomware Encryption Activity", "description": "Detects active ransomware encryption behavior. This critical alert indicates\nthat ransomware is actively encrypting files on the network. Immediate\nincident response action is required.\n", "severity": "High", "enabled": false, "query": "# Rule: Ransomware Encryption Activity\n# ID: 35ddd011-c568-5bf7-8bc1-3c2c48cb9e01\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"ransomware_encryption\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "Impact" ], "techniques": [ "T1486" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-mal-005'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Malicious Software Detection", "description": "Detects malicious software identified by endpoint protection platforms\n(EPP) or endpoint detection and response (EDR) solutions forwarding\nalerts through WitFoo's artifact ingestion pipeline.\n", "severity": "High", "enabled": false, "query": "# Rule: Malicious Software Detection\n# ID: 33db94d5-bc40-55e5-a122-803f79293d9e\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"malicious_software\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "Execution" ], "techniques": [ "T1204" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-mal-006'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Blacklisted Process Execution", "description": "Detects execution of processes on the organization's blacklist. These are\nknown-bad executables, prohibited tools, or applications that violate\nsecurity policy.\n", "severity": "High", "enabled": false, "query": "# Rule: Blacklisted Process Execution\n# ID: c8597820-be6a-5d34-85dc-e3a2166e2a18\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"blacklisted_process\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "Execution" ], "techniques": [ "T1059" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-mal-007'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Threat Event Detection", "description": "Detects generic threat events identified by security tools forwarded\nthrough WitFoo's ingestion pipeline. Covers threats not classified into\nmore specific categories.\n", "severity": "High", "enabled": false, "query": "# Rule: Threat Event Detection\n# ID: 56287074-cbcd-5d6a-88cc-c7b70db1058a\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"threat_event\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "Execution" ], "techniques": [ "T1204" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-mal-008'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Endpoint Protection Alert", "description": "Detects alerts forwarded from endpoint protection platforms (EPP/EDR)\nthrough WitFoo's artifact pipeline. These include antivirus detections,\nbehavioral blocks, and exploit prevention alerts.\n", "severity": "Medium", "enabled": false, "query": "# Rule: Endpoint Protection Alert\n# ID: 0505792a-a79b-5fcb-96ee-bb82d8f9e895\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"endpoint_protection\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "Execution" ], "techniques": [ "T1027" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-net-001'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: DNS Tunneling Detection", "description": "Detects potential DNS tunneling activity indicated by unusually long DNS query\ndomain names (>100 characters), which may indicate data exfiltration or C2\ncommunication via DNS protocol.\n", "severity": "High", "enabled": false, "query": "# Rule: DNS Tunneling Detection\n# ID: c09dc03e-23e0-5d3c-a605-5d9eb632b6c5\n# Generated by WitFoo Sigma Converter\n\nprotocol =~ \"DNS\" and fqdn matches regex \".{100,}\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "CommandAndControl", "Exfiltration" ], "techniques": [ "T1071.004", "T1048" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-net-002'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: C2 Beaconing Activity", "description": "Detects potential command-and-control beaconing by identifying connections\nto external servers classified as botnet or C2 activity by WitFoo lead rules.\nRegular-interval check-ins are a hallmark of malware C2 communication.\n", "severity": "High", "enabled": false, "query": "# Rule: C2 Beaconing Activity\n# ID: 8e769ed8-4f63-516c-b5e1-69a8b05f3c5d\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"botnet_connection\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "CommandAndControl" ], "techniques": [ "T1071.001" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-net-003'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Unusual Port Activity", "description": "Detects network connections on non-standard ports that may indicate evasion\ntechniques, backdoor communication, or misconfigurations. Focuses on\nhigh-numbered ephemeral ports used as server-side listeners.\n", "severity": "Medium", "enabled": false, "query": "# Rule: Unusual Port Activity\n# ID: 38f913d0-eb55-5d2e-8aa7-61eefe219d6a\n# Generated by WitFoo Sigma Converter\n\n(protocol contains \"TCP\" or protocol contains \"UDP\") and serverPort matches regex \"^(4[0-9]{4}|[5-9][0-9]{4}|[0-9]{6})$\" and (not((serverPort in~ (\"443\", \"8443\", \"8080\", \"3389\", \"5432\", \"3306\", \"27017\", \"6379\"))))", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "CommandAndControl" ], "techniques": [ "T1571" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-net-004'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Large Data Transfer", "description": "Detects unusually large outbound data transfers that may indicate data\nexfiltration. Triggers when total bytes transferred exceeds 100MB in a\nsingle connection/session.\n", "severity": "High", "enabled": false, "query": "# Rule: Large Data Transfer\n# ID: cc59abbb-24b0-5a9b-b95c-6b02a7e3f1c2\n# Generated by WitFoo Sigma Converter\n\ntotalBytes >= 104857600", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "Exfiltration" ], "techniques": [ "T1048" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-net-005'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Port Scan Detection", "description": "Detects network reconnaissance through port scanning activity. Identified\nby WitFoo's service discovery classification or IDS rule matches indicating\nsystematic port probing.\n", "severity": "High", "enabled": false, "query": "# Rule: Port Scan Detection\n# ID: 94e00767-bc73-54ee-891c-0d1133d0ae12\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"service_discovery\" or (messageType =~ \"ids_event\" and ruleCategory contains \"scan\")", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "Discovery" ], "techniques": [ "T1046" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-net-006'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: ICMP Anomaly Detection", "description": "Detects anomalous ICMP traffic patterns that may indicate ICMP tunneling,\ncovert channels, or network reconnaissance. Large ICMP payloads or unusual\nICMP types can signify data exfiltration or C2 communication.\n", "severity": "Medium", "enabled": false, "query": "# Rule: ICMP Anomaly Detection\n# ID: 6e60bb4d-2021-5b0a-9c2a-f5ac65779aee\n# Generated by WitFoo Sigma Converter\n\nprotocol =~ \"ICMP\" and totalBytes >= 1024", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "CommandAndControl" ], "techniques": [ "T1095" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-net-007'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Non-Standard HTTP/HTTPS Port Usage", "description": "Detects HTTP or HTTPS traffic on non-standard ports, which may indicate\nevasion of network security controls, malware C2 communication, or\nunauthorized web services.\n", "severity": "Medium", "enabled": false, "query": "# Rule: Non-Standard HTTP/HTTPS Port Usage\n# ID: ce3d5805-5e01-5c1d-8cae-3b475200ed9a\n# Generated by WitFoo Sigma Converter\n\n(application contains \"HTTP\" or application contains \"http\") and (not((serverPort in~ (\"80\", \"443\", \"8080\", \"8443\"))))", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "CommandAndControl" ], "techniques": [ "T1571" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-net-008'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Long-Lived Network Connection", "description": "Detects network connections with abnormally long durations that may indicate\npersistent C2 channels, data exfiltration tunnels, or compromised hosts\nmaintaining backdoor connections. Flags connections classified as anomalous\nbehavior by WitFoo enrichment.\n", "severity": "Medium", "enabled": false, "query": "# Rule: Long-Lived Network Connection\n# ID: 4a280e86-419b-5e46-abe9-2df70020709b\n# Generated by WitFoo Sigma Converter\n\nmessageType =~ \"anomalous_behavior\" and (protocol contains \"TCP\" or protocol contains \"SSL\" or protocol contains \"TLS\")", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "CommandAndControl" ], "techniques": [ "T1071" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-net-009'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Suspicious SSL/TLS Certificate", "description": "Detects network connections involving suspicious SSL/TLS certificates,\nincluding self-signed, expired, or certificates with anomalous attributes.\nThese may indicate man-in-the-middle attacks, malware C2 infrastructure,\nor compromised certificate authorities.\n", "severity": "Medium", "enabled": false, "query": "# Rule: Suspicious SSL/TLS Certificate\n# ID: 4fe33f21-5e75-572e-9175-7122b6f849bb\n# Generated by WitFoo Sigma Converter\n\n(streamName contains \"zeek\" and (ruleCategory contains \"SSL\" or ruleCategory contains \"certificate\" or ruleCategory contains \"X509\")) or (messageType =~ \"ids_event\" and (ruleName contains \"certificate\" or ruleName contains \"self-signed\" or ruleName contains \"expired\"))", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "CommandAndControl" ], "techniques": [ "T1071.001" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-net-010'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: Executable File Transfer Over Network", "description": "Detects transfer of executable files over the network, which may indicate\nmalware delivery, lateral movement tool staging, or unauthorized software\ndistribution. Matches common executable extensions and binary content types.\n", "severity": "High", "enabled": false, "query": "# Rule: Executable File Transfer Over Network\n# ID: fccc3daa-2075-5253-9cb7-6237a14a4f1f\n# Generated by WitFoo Sigma Converter\n\nfileName endswith \".exe\" or fileName endswith \".dll\" or fileName endswith \".scr\" or fileName endswith \".bat\" or fileName endswith \".ps1\" or fileName endswith \".vbs\" or fileName endswith \".msi\" or fileName endswith \".elf\" or fileName endswith \".sh\" or fileName endswith \".py\"", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "CommandAndControl", "LateralMovement" ], "techniques": [ "T1105" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-net-011'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: NXDOMAIN/DGA Detection", "description": "Detects high rates of DNS resolution failures (NXDOMAIN) that may indicate\ndomain generation algorithm (DGA) activity used by malware for C2 rendezvous.\nDGA malware generates pseudo-random domain names, most of which fail to resolve.\n", "severity": "High", "enabled": false, "query": "# Rule: NXDOMAIN/DGA Detection\n# ID: c12ff605-8260-5cbb-af5b-8be79d9e36cf\n# Generated by WitFoo Sigma Converter\n\nprotocol =~ \"DNS\" and (action contains \"NXDOMAIN\" or action contains \"nxdomain\" or action contains \"SERVFAIL\")", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "CommandAndControl" ], "techniques": [ "T1568.002" ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules", "apiVersion": "2022-11-01-preview", "name": "[concat(variables('workspaceName'), '/Microsoft.SecurityInsights/', guid('wf-net-012'))]", "kind": "Scheduled", "properties": { "displayName": "WitFoo: SMB Lateral Movement", "description": "Detects SMB (Server Message Block) connections between workstations that may\nindicate lateral movement. Legitimate SMB traffic typically flows from\nworkstations to file servers, not between workstations.\n", "severity": "High", "enabled": false, "query": "# Rule: SMB Lateral Movement\n# ID: 162819cf-fcf8-5cb9-a342-4f1834a388e9\n# Generated by WitFoo Sigma Converter\n\n(serverPort in~ (\"445\", \"139\")) or (streamName contains \"smb\" or streamName contains \"zeek_smb\")", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "triggerOperator": "GreaterThan", "triggerThreshold": 0, "tactics": [ "LateralMovement" ], "techniques": [ "T1021.002" ] } } ] }