{ "version": "Notebook/1.0", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "d7ccc5ca-c8ec-458f-ab0d-564a7ef1d217", "version": "KqlParameterItem/1.0", "name": "Help", "label": "🔎 Guide", "type": 10, "isRequired": true, "jsonData": "[\n {\"value\": \"Yes\", \"label\": \"Yes\", \"selected\":true},\n {\"value\": \"No\", \"label\": \"No\"}\n]", "timeContext": { "durationMs": 86400000 }, "value": "No" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 7" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "### Guide: Hash Correlation \n\nRecorded Future’s Hash Correlation Workbook helps you detect malicious hashes within your environment by correlating your logs with Recorded Future Hash Risk Lists.\n\n### How to Correlate hashs\n\nTo correlate hashes, follow the steps below:\n\n1. In the **Hash Logs Table** dropdown, select a log table that contains hash logs.\n\t* If a particular log table is not listed in the dropdown, ensure it is enabled in your environment.\n2. In the **Log field with hashes** dropdown, select the log field that holds the hashs to be correlated.\n\t* The workbook can correlate hashes in the format: `b0a0c7ae387c00161f4cc26405600b1a`.\n3. Select a Recorded Future Hash Risk List for correlation.\n4. If necessary, adjust the values in the **Logs from** and **Data from** dropdowns to match your requirements.\n5. Done\n\n---\n\n#### Log table with examples of correlatable log fields\n| Table \t \t| Field |\n| ----------- \t \t| ----------- |\n| CommonSecurityLog | FileHash |\n| SecurityEvent \t| FileHash |", "style": "info" }, "name": "text - 0" } ] }, "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "name": "group - 15" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "### Hashes (from logs)" }, "customWidth": "50", "name": "text - 2" }, { "type": 1, "content": { "json": "### Recorded Future Risk List" }, "customWidth": "50", "name": "text - 3" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "b91b8b5b-10cf-4106-99e2-793eb0d72dce", "version": "KqlParameterItem/1.0", "name": "Hash_Logs_Time_Range", "label": "Logs from", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 1209600000 } }, { "id": "3300ad41-acbc-4ebd-900a-c6ab250b7c73", "version": "KqlParameterItem/1.0", "name": "Hash_Logs_Table", "label": "Hash Logs Table", "type": 2, "description": "Log Table to correlate Hashes Against", "isRequired": true, "query": "search \"*\" \n| where TimeGenerated {Hash_Logs_Time_Range:query}\n| summarize count() by $table | sort by count_ desc | where $table != \"ThreatIntelIndicators\" | project $table\n", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "EndpointProtection_HASH_CL" }, { "id": "f4f77ada-b97c-4a82-9421-20a58fb7ce26", "version": "KqlParameterItem/1.0", "name": "Hash_Logs_Field", "label": "Log Field with Hashes", "type": 2, "description": "Select the field containing the Hash that you want to correlate against", "isRequired": true, "query": "{Hash_Logs_Table:value}\n| getschema\n| where DataType == \"System.String\"\n| project ColumnName", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "Hash_s" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "parameters - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "95e78560-1e69-437c-8226-7b0f8c4dc199", "version": "KqlParameterItem/1.0", "name": "Threat_Intelligence_Time_Range", "label": "Data from", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] }, "value": { "durationMs": 1209600000 } }, { "id": "e7c7e2ea-f5b3-4505-b64c-b18ca8561168", "version": "KqlParameterItem/1.0", "name": "RF_Risk_list", "label": "Risk List", "type": 2, "description": "Which Hash Risk List do you want to correlate against", "isRequired": true, "query": "ThreatIntelIndicators\n| where TimeGenerated {Threat_Intelligence_Time_Range:query}\n| where ObservableKey contains'file:hashes'\n| where isnotempty(ObservableValue)\n| where Data.description contains \"Recorded Future\"\n| summarize count() by tostring(Data.description)\n| project output = strcat('\"', Data_description, '\"')\n", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "\"Recorded Future - HASH - Observed in Underground Virus Testing Sites\"" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "parameters - 1" } ], "exportParameters": true }, "name": "group - 10" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\n### Guide: Detected Hashes Per Day\n\nThe chart displays the number of correlation detections per day between hash logs and Recorded Future's hash Risk lists.", "style": "info" }, "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "name": "text - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ThreatIntelIndicators\r\n| where TimeGenerated {Threat_Intelligence_Time_Range:query} \r\n| where Data.description == {RF_Risk_list:value}\r\n| where isnotempty(Tags)\r\n| extend ObservableValue = tolower(ObservableValue)\r\n| join (\r\n {Hash_Logs_Table:value}\r\n | where TimeGenerated {Hash_Logs_Time_Range:query}\r\n // renaming time column so it is clear the log this came from\r\n | extend Hash_TimeGenerated = TimeGenerated\r\n)\r\non $left.ObservableValue == $right.{Hash_Logs_Field:value}\r\n| summarize Correlation_Matches=count() by bin(Hash_TimeGenerated, 1d)\r\n| render barchart", "size": 0, "title": "Detected File Hashes Per Day", "noDataMessage": "No detected hashes", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 1" } ] }, "name": "group - 11" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\n### Guide: Detected Hashs\n\nThe Detected Hashs table lists hashs from the correlated logs that have been matched with Recorded Future Hash Risk Lists.\n\n**Table Columns**\n\n* **Risk Score:** The Recorded Future Risk Score for the Hashe (IOC), ranging from 1 to 99, with 99 being the highest level of severity.\n* **Hash:** The detected hash.\n* **Detected:** The time when the log was correlated with a Risk List.\n* **Log Created:** The time when the log event itself was created.\n* **Threat Classification:** The type of threat associated with the hash (IOC).", "style": "info" }, "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "name": "text - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ThreatIntelIndicators\r\n| where TimeGenerated {Threat_Intelligence_Time_Range:query}\r\n| where Data.description contains {RF_Risk_list:value}\r\n| where isnotempty(Tags)\r\n| extend ObservableValue = tolower(ObservableValue)\r\n| join (\r\n {Hash_Logs_Table:value}\r\n | where TimeGenerated {Hash_Logs_Time_Range:query}\r\n // renaming time column so it is clear the log this came from\r\n | extend Hash_TimeGenerated = TimeGenerated\r\n)\r\non $left.ObservableValue == $right.{Hash_Logs_Field:value}\r\n| project [\"Risk Score\"]=Confidence, Hash=ObservableValue, Detected = format_datetime(TimeGenerated, 'yyyy-MM-dd HH:mm:ss'), [\"Log Created\"] = format_datetime(Hash_TimeGenerated, 'yyyy-MM-dd HH:mm:ss'), [\"Threat Classification\"]=tostring(Data.indicator_types)\r\n| summarize [\"Log Created\"]=max([\"Log Created\"]) by Hash, [\"Risk Score\"], Detected, [\"Threat Classification\"]\r\n| project [\"Risk Score\"], Hash, Detected, [\"Log Created\"], [\"Threat Classification\"]\r\n| sort by [\"Risk Score\"] desc\r\n", "size": 0, "title": "Detected Hashes", "noDataMessage": "No detected hashes", "exportedParameters": [ { "fieldName": "Hash", "parameterName": "MaliciousHashMatch", "parameterType": 5 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Risk", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "90", "representation": "redBright", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "65", "representation": "orange", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "25", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ] } } ] } }, "customWidth": "70", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ThreatIntelIndicators\r\n| where TimeGenerated {Threat_Intelligence_Time_Range:query}\r\n| where Data.description contains {RF_Risk_list:value}\r\n| where isnotempty(Tags)\r\n| extend ObservableValue = tolower(ObservableValue)\r\n| join (\r\n {Hash_Logs_Table:value}\r\n | where TimeGenerated {Hash_Logs_Time_Range:query}\r\n // renaming time column so it is clear the log this came from\r\n | extend Hash_TimeGenerated = TimeGenerated\r\n)\r\non $left.ObservableValue == $right.{Hash_Logs_Field:value}\r\n| project Risk=Confidence, ObservableValue, Data.indicator_types, Tags\r\n| extend Evidence=parse_json(Tags)\r\n| mv-expand Evidence = parse_json(tostring(Evidence))\r\n// Capitalize the first letter in each rule, the we get the rule from 'Evidence['rule']'\r\n| extend Rule=strcat(toupper(substring(Evidence['rule'], 0, 1)), substring(Evidence['rule'], 1))| summarize count() by tostring(Rule)\r\n| sort by count_ desc\r\n\r\n", "size": 0, "title": "Top Triggered Risk Rules", "noDataMessage": "No triggered Risk Rules", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "orange" } } ], "labelSettings": [ { "columnId": "count_", "label": "Count" } ] } }, "customWidth": "30", "name": "query - 2" }, { "type": 1, "content": { "json": "### Detected Hashes: Evidence Details\n\nTo view evidence details, click a row (hash) in the Detected Hashes table." }, "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ThreatIntelIndicators\n| where TimeGenerated {Threat_Intelligence_Time_Range:query}\n| where Data.description contains {RF_Risk_list:value}\n| extend ObservableValue = tolower(ObservableValue)\n| where ObservableValue == \"{MaliciousHashMatch}\"\n| where isnotempty(Tags)\n//| where ExpirationDateTime > now()\n| extend Evidence=parse_json(Tags)\n| take 1\n| mv-expand Evidence = parse_json(tostring(Evidence))\n// Capitalize the first letter in each rule, the we get the rule from 'Evidence['rule']'\r\n | project Rule=strcat(toupper(substring(Evidence['rule'], 0, 1)), substring(Evidence['rule'], 1)), Criticality = Evidence['criticality'], Evidence_String = Evidence['evidencestring']\n| sort by toint(Criticality) desc", "size": 1, "noDataMessage": "No evidence details to show", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "MaliciousHashMatch", "comparison": "isNotEqualTo" }, "name": "query - 5" }, { "type": 1, "content": { "json": "\n### Source data from {Hash_Logs_Table:value}\n\nTo view source data of correlated hash, click a row (hash) in the Detected Hashes table." }, "name": "text - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{Hash_Logs_Table:value}\n| where TimeGenerated {Hash_Logs_Time_Range:query}\n| where {Hash_Logs_Field:value} == \"{MaliciousHashMatch}\"\n", "size": 1, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "MaliciousHashMatch", "comparison": "isNotEqualTo" }, "name": "query - 6" } ] }, "name": "group - 8" } ], "styleSettings": { "paddingStyle": "wide" }, "fromTemplateId": "sentinel-RecordedFutureHashCorrelationWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }