Critical Risks

Back


Id	1eebfaf3-40e1-4bc2-9f42-049b7b8ceb60
Rulename	Critical Risks
Description	This query searches for all the exploited risks that RidgeBot identified
Severity	High
Tactics	Execution InitialAccess PrivilegeEscalation
Techniques	T1189 T1059 T1053 T1548
Required data connectors	CefAma RidgeBotDataConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/RidgeSecurity/Analytic Rules/RidgeSecurity_Risks.yaml
Version	1.0.1
Arm template	1eebfaf3-40e1-4bc2-9f42-049b7b8ceb60.json

KQL

CommonSecurityLog
| where DeviceVendor == "RidgeSecurity"
| where DeviceEventClassID == "4001"
| order by TimeGenerated desc

YAML

id: 1eebfaf3-40e1-4bc2-9f42-049b7b8ceb60
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/RidgeSecurity/Analytic Rules/RidgeSecurity_Risks.yaml
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: DeviceVendor
  entityType: Account
- fieldMappings:
  - identifier: Address
    columnName: Computer
  entityType: IP
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: RidgeBotDataConnector
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma
queryFrequency: 1h
queryPeriod: 1h
status: Available
query: |
  CommonSecurityLog
  | where DeviceVendor == "RidgeSecurity"
  | where DeviceEventClassID == "4001"
  | order by TimeGenerated desc   
name: Critical Risks
kind: Scheduled
tactics:
- Execution
- InitialAccess
- PrivilegeEscalation
severity: High
relevantTechniques:
- T1189
- T1059
- T1053
- T1548
triggerThreshold: 0
version: 1.0.1
description: |
    This query searches for all the exploited risks that RidgeBot identified

ARM