Critical Risks

Back


Id	1eebfaf3-40e1-4bc2-9f42-049b7b8ceb60
Rulename	Critical Risks
Description	This query searches for all the exploited risks that RidgeBot identified
Severity	High
Tactics	Execution InitialAccess PrivilegeEscalation
Techniques	T1189 T1059 T1053 T1548
Required data connectors	CefAma RidgeBotDataConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/RidgeSecurity/Analytic Rules/RidgeSecurity_Risks.yaml
Version	1.0.1
Arm template	1eebfaf3-40e1-4bc2-9f42-049b7b8ceb60.json

KQL

CommonSecurityLog
| where DeviceVendor == "RidgeSecurity"
| where DeviceEventClassID == "4001"
| order by TimeGenerated desc

YAML

description: |
    This query searches for all the exploited risks that RidgeBot identified
kind: Scheduled
tactics:
- Execution
- InitialAccess
- PrivilegeEscalation
requiredDataConnectors:
- connectorId: RidgeBotDataConnector
  dataTypes:
  - CommonSecurityLog
- connectorId: CefAma
  dataTypes:
  - CommonSecurityLog
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/RidgeSecurity/Analytic Rules/RidgeSecurity_Risks.yaml
severity: High
name: Critical Risks
triggerThreshold: 0
queryPeriod: 1h
query: |
  CommonSecurityLog
  | where DeviceVendor == "RidgeSecurity"
  | where DeviceEventClassID == "4001"
  | order by TimeGenerated desc   
relevantTechniques:
- T1189
- T1059
- T1053
- T1548
id: 1eebfaf3-40e1-4bc2-9f42-049b7b8ceb60
queryFrequency: 1h
status: Available
triggerOperator: gt
version: 1.0.1
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: DeviceVendor
    identifier: FullName
- entityType: IP
  fieldMappings:
  - columnName: Computer
    identifier: Address

ARM