Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Critical Risks

Back
Id1eebfaf3-40e1-4bc2-9f42-049b7b8ceb60
RulenameCritical Risks
DescriptionThis query searches for all the exploited risks that RidgeBot identified
SeverityHigh
TacticsExecution
InitialAccess
PrivilegeEscalation
TechniquesT1189
T1059
T1053
T1548
Required data connectorsCefAma
RidgeBotDataConnector
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/RidgeSecurity/Analytic Rules/RidgeSecurity_Risks.yaml
Version1.0.1
Arm template1eebfaf3-40e1-4bc2-9f42-049b7b8ceb60.json
Deploy To Azure
CommonSecurityLog
| where DeviceVendor == "RidgeSecurity"
| where DeviceEventClassID == "4001"
| order by TimeGenerated desc 
queryPeriod: 1h
name: Critical Risks
description: |
    This query searches for all the exploited risks that RidgeBot identified
status: Available
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: RidgeBotDataConnector
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma
kind: Scheduled
id: 1eebfaf3-40e1-4bc2-9f42-049b7b8ceb60
version: 1.0.1
triggerOperator: gt
triggerThreshold: 0
query: |
  CommonSecurityLog
  | where DeviceVendor == "RidgeSecurity"
  | where DeviceEventClassID == "4001"
  | order by TimeGenerated desc   
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/RidgeSecurity/Analytic Rules/RidgeSecurity_Risks.yaml
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: DeviceVendor
  entityType: Account
- fieldMappings:
  - identifier: Address
    columnName: Computer
  entityType: IP
tactics:
- Execution
- InitialAccess
- PrivilegeEscalation
relevantTechniques:
- T1189
- T1059
- T1053
- T1548
queryFrequency: 1h
severity: High
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/1eebfaf3-40e1-4bc2-9f42-049b7b8ceb60')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/1eebfaf3-40e1-4bc2-9f42-049b7b8ceb60')]",
      "properties": {
        "alertRuleTemplateName": "1eebfaf3-40e1-4bc2-9f42-049b7b8ceb60",
        "customDetails": null,
        "description": "This query searches for all the exploited risks that RidgeBot identified\n",
        "displayName": "Critical Risks",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "DeviceVendor",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "Computer",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/RidgeSecurity/Analytic Rules/RidgeSecurity_Risks.yaml",
        "query": "CommonSecurityLog\n| where DeviceVendor == \"RidgeSecurity\"\n| where DeviceEventClassID == \"4001\"\n| order by TimeGenerated desc \n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Execution",
          "InitialAccess",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1053",
          "T1059",
          "T1189",
          "T1548"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}