Critical Risks

Back


Id	1eebfaf3-40e1-4bc2-9f42-049b7b8ceb60
Rulename	Critical Risks
Description	This query searches for all the exploited risks that RidgeBot identified
Severity	High
Tactics	Execution InitialAccess PrivilegeEscalation
Techniques	T1189 T1059 T1053 T1548
Required data connectors	CefAma RidgeBotDataConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/RidgeSecurity/Analytic Rules/RidgeSecurity_Risks.yaml
Version	1.0.1
Arm template	1eebfaf3-40e1-4bc2-9f42-049b7b8ceb60.json

KQL

CommonSecurityLog
| where DeviceVendor == "RidgeSecurity"
| where DeviceEventClassID == "4001"
| order by TimeGenerated desc

YAML

kind: Scheduled
triggerOperator: gt
triggerThreshold: 0
description: |
    This query searches for all the exploited risks that RidgeBot identified
queryFrequency: 1h
id: 1eebfaf3-40e1-4bc2-9f42-049b7b8ceb60
severity: High
name: Critical Risks
queryPeriod: 1h
status: Available
query: |
  CommonSecurityLog
  | where DeviceVendor == "RidgeSecurity"
  | where DeviceEventClassID == "4001"
  | order by TimeGenerated desc   
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/RidgeSecurity/Analytic Rules/RidgeSecurity_Risks.yaml
tactics:
- Execution
- InitialAccess
- PrivilegeEscalation
version: 1.0.1
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: DeviceVendor
  entityType: Account
- fieldMappings:
  - identifier: Address
    columnName: Computer
  entityType: IP
requiredDataConnectors:
- connectorId: RidgeBotDataConnector
  dataTypes:
  - CommonSecurityLog
- connectorId: CefAma
  dataTypes:
  - CommonSecurityLog
relevantTechniques:
- T1189
- T1059
- T1053
- T1548

ARM