Solutions/CyberArkEPM/Analytic Rules/CyberArkEPMUnexpectedExecutableLocation.yaml

id: c1fcbbd7-74f8-4f32-8116-0a533ebd3878
name: CyberArkEPM - Unexpected executable location
description: |
  'Detects program run from unexpected location.'
severity: Medium
requiredDataConnectors:
  - connectorId: CyberArkEPM
    dataTypes:
      - CyberArkEPM
queryFrequency: 30m
queryPeriod: 30m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Execution
  - DefenseEvasion
relevantTechniques:
  - T1204
  - T1036
query: | 
  let susp_exe_folders = dynamic([@'\tmp\', @'\TEMP\', @'/tmp/', @'\Users\Public\', @'\$Recycle.bin', @'\Windows\Fonts\', @'$']);
  CyberArkEPM
  | where EventSubType != 'AttackAttempt'
  | where ActingProcessName has_any (susp_exe_folders)
  | project EventEndTime, EventMessage, ActorUsername, ActingProcessFileInternalName
  | extend AccountCustomEntity = ActorUsername
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountCustomEntity
version: 1.0.0
kind: Scheduled