CYFIRMA - Attack Surface - Weak Certificate Exposure - High Rule

Back


Id	3b5a1c0e-7f3a-4d47-8416-6c0b8b91e9ce
Rulename	CYFIRMA - Attack Surface - Weak Certificate Exposure - High Rule
Description	“This alert indicates that a weak or insecure SSL/TLS certificate has been detected on a public-facing asset monitored by Cyfirma. Such certificates do not meet modern encryption standards and are considered insecure, especially for handling sensitive transactions. This exposure increases the risk of man-in-the-middle attacks and loss of data integrity or confidentiality. Immediate remediation is advised by replacing weak certificates with strong, industry-compliant ones.”
Severity	High
Tactics	DefenseEvasion ResourceDevelopment Reconnaissance InitialAccess CredentialAccess
Techniques	T1553 T1588 T1595 T1190 T1552
Required data connectors	CyfirmaAttackSurfaceAlertsConnector
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyfirma Attack Surface/Analytic Rules/ASCertificatesHighRule.yaml
Version	1.0.0
Arm template	3b5a1c0e-7f3a-4d47-8416-6c0b8b91e9ce.json

KQL

// High Severity Weak Certificate Exposure Detected
let timeFrame = 5m;
CyfirmaASCertificatesAlerts_CL
| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())
| extend
    Description=description,
    FirstSeen=first_seen,
    LastSeen=last_seen,
    ValidFrom=valid_from,
    ValidTo=valid_to,
    RiskScore=risk_score,
    Domain=sub_domain,
    TopDomain=top_domain,
    Protocols=protocols,
    SelfSigned=self_signed,
    AlertUID=alert_uid,
    UID=uid,
    CertificateData= cert_data,
    CertificateHash=cert_hash,
    IssuedBy=issued_by,
    IssuedTo=issued_to,
    ProviderName='CYFIRMA',
    ProductName='DeCYFIR/DeTCT'
| project
    TimeGenerated,
    Description,
    Domain,
    TopDomain,
    RiskScore,
    FirstSeen,
    LastSeen,
    ValidFrom,
    ValidTo,
    Protocols,
    SelfSigned,
    CertificateData,
    CertificateHash,
    IssuedBy,
    IssuedTo,
    ProviderName,
    ProductName

YAML

requiredDataConnectors:
- connectorId: CyfirmaAttackSurfaceAlertsConnector
  dataTypes:
  - CyfirmaASCertificatesAlerts_CL
tactics:
- DefenseEvasion
- ResourceDevelopment
- Reconnaissance
- InitialAccess
- CredentialAccess
eventGroupingSettings:
  aggregationKind: AlertPerResult
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    lookbackDuration: 5h
    matchingMethod: AllEntities
    reopenClosedIncident: false
description: |
  "This alert indicates that a weak or insecure SSL/TLS certificate has been detected on a public-facing asset monitored by Cyfirma. 
  Such certificates do not meet modern encryption standards and are considered insecure, especially for handling sensitive transactions. 
  This exposure increases the risk of man-in-the-middle attacks and loss of data integrity or confidentiality. 
  Immediate remediation is advised by replacing weak certificates with strong, industry-compliant ones."  
query: |
  // High Severity Weak Certificate Exposure Detected
  let timeFrame = 5m;
  CyfirmaASCertificatesAlerts_CL
  | where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())
  | extend
      Description=description,
      FirstSeen=first_seen,
      LastSeen=last_seen,
      ValidFrom=valid_from,
      ValidTo=valid_to,
      RiskScore=risk_score,
      Domain=sub_domain,
      TopDomain=top_domain,
      Protocols=protocols,
      SelfSigned=self_signed,
      AlertUID=alert_uid,
      UID=uid,
      CertificateData= cert_data,
      CertificateHash=cert_hash,
      IssuedBy=issued_by,
      IssuedTo=issued_to,
      ProviderName='CYFIRMA',
      ProductName='DeCYFIR/DeTCT'
  | project
      TimeGenerated,
      Description,
      Domain,
      TopDomain,
      RiskScore,
      FirstSeen,
      LastSeen,
      ValidFrom,
      ValidTo,
      Protocols,
      SelfSigned,
      CertificateData,
      CertificateHash,
      IssuedBy,
      IssuedTo,
      ProviderName,
      ProductName  
id: 3b5a1c0e-7f3a-4d47-8416-6c0b8b91e9ce
triggerOperator: gt
alertDetailsOverride:
  alertDisplayNameFormat: CYFIRMA - High Severity Weak Certificate Exposure Detected for this Domain  - {{Domain}}
  alertDynamicProperties:
  - alertProperty: ProductName
    value: ProductName
  - alertProperty: ProviderName
    value: ProviderName
  alertDescriptionFormat: CYFIRMA - High Severity Weak Certificate Exposure Detected  - {{Description}}
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyfirma Attack Surface/Analytic Rules/ASCertificatesHighRule.yaml
queryFrequency: 5m
severity: High
entityMappings:
- fieldMappings:
  - columnName: Domain
    identifier: DomainName
  entityType: DNS
- fieldMappings:
  - columnName: TopDomain
    identifier: HostName
  - columnName: Domain
    identifier: DnsDomain
  entityType: Host
name: CYFIRMA - Attack Surface - Weak Certificate Exposure - High Rule
queryPeriod: 5m
relevantTechniques:
- T1553
- T1588
- T1595
- T1190
- T1552
kind: Scheduled
triggerThreshold: 0
version: 1.0.0
customDetails:
  TimeGenerated: TimeGenerated
  CertificateHash: CertificateHash
  TopDomain: TopDomain
  IssuedBy: IssuedBy
  Description: Description
  ValidTo: ValidTo
  ValidFrom: ValidFrom
  LastSeen: LastSeen
  CertificateData: CertificateData
  IssuedTo: IssuedTo
  SelfSigned: SelfSigned
  RiskScore: RiskScore
  Protocols: Protocols
  FirstSeen: FirstSeen
  Domain: Domain

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/3b5a1c0e-7f3a-4d47-8416-6c0b8b91e9ce')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/3b5a1c0e-7f3a-4d47-8416-6c0b8b91e9ce')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "CYFIRMA - High Severity Weak Certificate Exposure Detected  - {{Description}}",
          "alertDisplayNameFormat": "CYFIRMA - High Severity Weak Certificate Exposure Detected for this Domain  - {{Domain}}",
          "alertDynamicProperties": [
            {
              "alertProperty": "ProductName",
              "value": "ProductName"
            },
            {
              "alertProperty": "ProviderName",
              "value": "ProviderName"
            }
          ]
        },
        "alertRuleTemplateName": "3b5a1c0e-7f3a-4d47-8416-6c0b8b91e9ce",
        "customDetails": {
          "CertificateData": "CertificateData",
          "CertificateHash": "CertificateHash",
          "Description": "Description",
          "Domain": "Domain",
          "FirstSeen": "FirstSeen",
          "IssuedBy": "IssuedBy",
          "IssuedTo": "IssuedTo",
          "LastSeen": "LastSeen",
          "Protocols": "Protocols",
          "RiskScore": "RiskScore",
          "SelfSigned": "SelfSigned",
          "TimeGenerated": "TimeGenerated",
          "TopDomain": "TopDomain",
          "ValidFrom": "ValidFrom",
          "ValidTo": "ValidTo"
        },
        "description": "\"This alert indicates that a weak or insecure SSL/TLS certificate has been detected on a public-facing asset monitored by Cyfirma. \nSuch certificates do not meet modern encryption standards and are considered insecure, especially for handling sensitive transactions. \nThis exposure increases the risk of man-in-the-middle attacks and loss of data integrity or confidentiality. \nImmediate remediation is advised by replacing weak certificates with strong, industry-compliant ones.\"\n",
        "displayName": "CYFIRMA - Attack Surface - Weak Certificate Exposure - High Rule",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "DNS",
            "fieldMappings": [
              {
                "columnName": "Domain",
                "identifier": "DomainName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "TopDomain",
                "identifier": "HostName"
              },
              {
                "columnName": "Domain",
                "identifier": "DnsDomain"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyfirma Attack Surface/Analytic Rules/ASCertificatesHighRule.yaml",
        "query": "// High Severity Weak Certificate Exposure Detected\nlet timeFrame = 5m;\nCyfirmaASCertificatesAlerts_CL\n| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())\n| extend\n    Description=description,\n    FirstSeen=first_seen,\n    LastSeen=last_seen,\n    ValidFrom=valid_from,\n    ValidTo=valid_to,\n    RiskScore=risk_score,\n    Domain=sub_domain,\n    TopDomain=top_domain,\n    Protocols=protocols,\n    SelfSigned=self_signed,\n    AlertUID=alert_uid,\n    UID=uid,\n    CertificateData= cert_data,\n    CertificateHash=cert_hash,\n    IssuedBy=issued_by,\n    IssuedTo=issued_to,\n    ProviderName='CYFIRMA',\n    ProductName='DeCYFIR/DeTCT'\n| project\n    TimeGenerated,\n    Description,\n    Domain,\n    TopDomain,\n    RiskScore,\n    FirstSeen,\n    LastSeen,\n    ValidFrom,\n    ValidTo,\n    Protocols,\n    SelfSigned,\n    CertificateData,\n    CertificateHash,\n    IssuedBy,\n    IssuedTo,\n    ProviderName,\n    ProductName\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "DefenseEvasion",
          "InitialAccess",
          "Reconnaissance",
          "ResourceDevelopment"
        ],
        "techniques": [
          "T1190",
          "T1552",
          "T1553",
          "T1588",
          "T1595"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}