Analytic rule catalog
CYFIRMA - Attack Surface - Configuration High Rule
Back
| Id | 30206b45-75d2-4c6a-87c5-f0861c1f2870 |
| Rulename | CYFIRMA - Attack Surface - Configuration High Rule |
| Description | This alert is generated when CYFIRMA detects a critical misconfiguration in a public-facing asset or service. Such misconfigurations may include exposed admin interfaces, default credentials, open directory listings, or insecure protocols, which significantly increase the attack surface." |
| Severity | High |
| Tactics | InitialAccess Discovery Persistence Execution DefenseEvasion CredentialAccess Collection Reconnaissance |
| Techniques | T1190 T1087 T1046 T1136 T1059 T1566 T1070 T1027 T1505 T1555 T1114 T1595 |
| Required data connectors | CyfirmaAttackSurfaceAlertsConnector |
| Kind | Scheduled |
| Query frequency | 5m |
| Query period | 5m |
| Trigger threshold | 0 |
| Trigger operator | gt |
| Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyfirma%20Attack%20Surface/Analytic%20Rules/ASConfigurationsHighRule.yaml |
| Version | 1.0.1 |
| Arm template | 30206b45-75d2-4c6a-87c5-f0861c1f2870.json |
// High Severity - Attack Surface - Misconfiguration Detected
let timeFrame = 5m;
CyfirmaASConfigurationAlerts_CL
| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())
| extend
Description=description,
FirstSeen=first_seen,
LastSeen=last_seen,
RiskScore=risk_score,
Domain=sub_domain,
TopDomain=top_domain,
NetworkIP=ip,
AlertUID=alert_uid,
UID=uid,
Softwares=software,
WebAppFirewall=web_app_firewall,
ClickJackingDefence=click_jacking_defence,
ContentSecurityPolicy=content_security_policy,
CookieXssProtection=cookie_xss_protection,
DataInjectionDefence=data_injection_defence,
DomainStatus=domain_status,
MissingEPPCodes=missing_epp_codes,
SecureCookie=secure_cookie,
SetCookieHttpsOnly=set_cookie_https_only,
XFrameOptions=x_frame_options,
X_XssProtection=x_xss_protection,
ProviderName='CYFIRMA',
ProductName='DeCYFIR/DeTCT'
| project
TimeGenerated,
Description,
Domain,
TopDomain,
RiskScore,
FirstSeen,
LastSeen,
NetworkIP,
AlertUID,
UID,
Softwares,
WebAppFirewall,
ClickJackingDefence,
ContentSecurityPolicy,
CookieXssProtection,
DataInjectionDefence,
DomainStatus,
MissingEPPCodes,
SecureCookie,
SetCookieHttpsOnly,
XFrameOptions,
X_XssProtection,
ProviderName,
ProductName
queryFrequency: 5m
entityMappings:
- fieldMappings:
- columnName: Domain
identifier: DomainName
entityType: DNS
- fieldMappings:
- columnName: TopDomain
identifier: HostName
- columnName: Domain
identifier: DnsDomain
entityType: Host
- fieldMappings:
- columnName: NetworkIP
identifier: Address
entityType: IP
incidentConfiguration:
createIncident: true
groupingConfiguration:
lookbackDuration: PT5H
matchingMethod: AllEntities
enabled: false
reopenClosedIncident: false
triggerThreshold: 0
triggerOperator: gt
severity: High
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyfirma%20Attack%20Surface/Analytic%20Rules/ASConfigurationsHighRule.yaml
eventGroupingSettings:
aggregationKind: AlertPerResult
alertDetailsOverride:
alertDisplayNameFormat: 'CYFIRMA - High Risk Misconfiguration Identified in Assets - Domain: {{Domain}} , IP: {{NetworkIP}} '
alertDynamicProperties:
- alertProperty: ProductName
value: ProductName
- alertProperty: ProviderName
value: ProviderName
alertDescriptionFormat: 'CYFIRMA - High Risk Misconfiguration Identified in Assets - {{Description}} '
query: |
// High Severity - Attack Surface - Misconfiguration Detected
let timeFrame = 5m;
CyfirmaASConfigurationAlerts_CL
| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())
| extend
Description=description,
FirstSeen=first_seen,
LastSeen=last_seen,
RiskScore=risk_score,
Domain=sub_domain,
TopDomain=top_domain,
NetworkIP=ip,
AlertUID=alert_uid,
UID=uid,
Softwares=software,
WebAppFirewall=web_app_firewall,
ClickJackingDefence=click_jacking_defence,
ContentSecurityPolicy=content_security_policy,
CookieXssProtection=cookie_xss_protection,
DataInjectionDefence=data_injection_defence,
DomainStatus=domain_status,
MissingEPPCodes=missing_epp_codes,
SecureCookie=secure_cookie,
SetCookieHttpsOnly=set_cookie_https_only,
XFrameOptions=x_frame_options,
X_XssProtection=x_xss_protection,
ProviderName='CYFIRMA',
ProductName='DeCYFIR/DeTCT'
| project
TimeGenerated,
Description,
Domain,
TopDomain,
RiskScore,
FirstSeen,
LastSeen,
NetworkIP,
AlertUID,
UID,
Softwares,
WebAppFirewall,
ClickJackingDefence,
ContentSecurityPolicy,
CookieXssProtection,
DataInjectionDefence,
DomainStatus,
MissingEPPCodes,
SecureCookie,
SetCookieHttpsOnly,
XFrameOptions,
X_XssProtection,
ProviderName,
ProductName
tactics:
- InitialAccess
- Discovery
- Persistence
- Execution
- DefenseEvasion
- CredentialAccess
- Collection
- Reconnaissance
queryPeriod: 5m
customDetails:
RiskScore: RiskScore
SecurityPolicy: ContentSecurityPolicy
LastSeen: LastSeen
X_XssProtection: X_XssProtection
Softwares: Softwares
DomainStatus: DomainStatus
TimeGenerated: TimeGenerated
CookieXssProtection: CookieXssProtection
AlertUID: AlertUID
WebAppFirewall: WebAppFirewall
SecureCookie: SecureCookie
ClickJackingDefence: ClickJackingDefence
SetCookieHttpsOnly: SetCookieHttpsOnly
XFrameOptions: XFrameOptions
FirstSeen: FirstSeen
InjectionDefence: DataInjectionDefence
MissingEPPCodes: MissingEPPCodes
UID: UID
relevantTechniques:
- T1190
- T1087
- T1046
- T1136
- T1059
- T1566
- T1070
- T1027
- T1505
- T1555
- T1114
- T1595
name: CYFIRMA - Attack Surface - Configuration High Rule
requiredDataConnectors:
- connectorId: CyfirmaAttackSurfaceAlertsConnector
dataTypes:
- CyfirmaASConfigurationAlerts_CL
id: 30206b45-75d2-4c6a-87c5-f0861c1f2870
version: 1.0.1
description: |
This alert is generated when CYFIRMA detects a critical misconfiguration in a public-facing asset or service.
Such misconfigurations may include exposed admin interfaces, default credentials, open directory listings, or insecure protocols, which significantly increase the attack surface."
kind: Scheduled
status: Available
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/30206b45-75d2-4c6a-87c5-f0861c1f2870')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/30206b45-75d2-4c6a-87c5-f0861c1f2870')]",
"properties": {
"alertDetailsOverride": {
"alertDescriptionFormat": "CYFIRMA - High Risk Misconfiguration Identified in Assets - {{Description}} ",
"alertDisplayNameFormat": "CYFIRMA - High Risk Misconfiguration Identified in Assets - Domain: {{Domain}} , IP: {{NetworkIP}} ",
"alertDynamicProperties": [
{
"alertProperty": "ProductName",
"value": "ProductName"
},
{
"alertProperty": "ProviderName",
"value": "ProviderName"
}
]
},
"alertRuleTemplateName": "30206b45-75d2-4c6a-87c5-f0861c1f2870",
"customDetails": {
"AlertUID": "AlertUID",
"ClickJackingDefence": "ClickJackingDefence",
"CookieXssProtection": "CookieXssProtection",
"DomainStatus": "DomainStatus",
"FirstSeen": "FirstSeen",
"InjectionDefence": "DataInjectionDefence",
"LastSeen": "LastSeen",
"MissingEPPCodes": "MissingEPPCodes",
"RiskScore": "RiskScore",
"SecureCookie": "SecureCookie",
"SecurityPolicy": "ContentSecurityPolicy",
"SetCookieHttpsOnly": "SetCookieHttpsOnly",
"Softwares": "Softwares",
"TimeGenerated": "TimeGenerated",
"UID": "UID",
"WebAppFirewall": "WebAppFirewall",
"X_XssProtection": "X_XssProtection",
"XFrameOptions": "XFrameOptions"
},
"description": "This alert is generated when CYFIRMA detects a critical misconfiguration in a public-facing asset or service. \nSuch misconfigurations may include exposed admin interfaces, default credentials, open directory listings, or insecure protocols, which significantly increase the attack surface.\"\n",
"displayName": "CYFIRMA - Attack Surface - Configuration High Rule",
"enabled": true,
"entityMappings": [
{
"entityType": "DNS",
"fieldMappings": [
{
"columnName": "Domain",
"identifier": "DomainName"
}
]
},
{
"entityType": "Host",
"fieldMappings": [
{
"columnName": "TopDomain",
"identifier": "HostName"
},
{
"columnName": "Domain",
"identifier": "DnsDomain"
}
]
},
{
"entityType": "IP",
"fieldMappings": [
{
"columnName": "NetworkIP",
"identifier": "Address"
}
]
}
],
"eventGroupingSettings": {
"aggregationKind": "AlertPerResult"
},
"incidentConfiguration": {
"createIncident": true,
"groupingConfiguration": {
"enabled": false,
"lookbackDuration": "PT5H",
"matchingMethod": "AllEntities",
"reopenClosedIncident": false
}
},
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyfirma%20Attack%20Surface/Analytic%20Rules/ASConfigurationsHighRule.yaml",
"query": "// High Severity - Attack Surface - Misconfiguration Detected\nlet timeFrame = 5m;\nCyfirmaASConfigurationAlerts_CL\n| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())\n| extend\n Description=description,\n FirstSeen=first_seen,\n LastSeen=last_seen,\n RiskScore=risk_score,\n Domain=sub_domain,\n TopDomain=top_domain,\n NetworkIP=ip,\n AlertUID=alert_uid,\n UID=uid,\n Softwares=software,\n WebAppFirewall=web_app_firewall,\n ClickJackingDefence=click_jacking_defence,\n ContentSecurityPolicy=content_security_policy,\n CookieXssProtection=cookie_xss_protection,\n DataInjectionDefence=data_injection_defence,\n DomainStatus=domain_status,\n MissingEPPCodes=missing_epp_codes,\n SecureCookie=secure_cookie,\n SetCookieHttpsOnly=set_cookie_https_only,\n XFrameOptions=x_frame_options,\n X_XssProtection=x_xss_protection,\n ProviderName='CYFIRMA',\n ProductName='DeCYFIR/DeTCT'\n| project\n TimeGenerated,\n Description,\n Domain,\n TopDomain,\n RiskScore,\n FirstSeen,\n LastSeen,\n NetworkIP,\n AlertUID,\n UID,\n Softwares,\n WebAppFirewall,\n ClickJackingDefence,\n ContentSecurityPolicy,\n CookieXssProtection,\n DataInjectionDefence,\n DomainStatus,\n MissingEPPCodes,\n SecureCookie,\n SetCookieHttpsOnly,\n XFrameOptions,\n X_XssProtection,\n ProviderName,\n ProductName\n",
"queryFrequency": "PT5M",
"queryPeriod": "PT5M",
"severity": "High",
"status": "Available",
"subTechniques": [],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"Collection",
"CredentialAccess",
"DefenseEvasion",
"Discovery",
"Execution",
"InitialAccess",
"Persistence",
"Reconnaissance"
],
"techniques": [
"T1027",
"T1046",
"T1059",
"T1070",
"T1087",
"T1114",
"T1136",
"T1190",
"T1505",
"T1555",
"T1566",
"T1595"
],
"templateVersion": "1.0.1",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}