Cynerio - Exploitation Attempt of IoT device

Back


Id	3d853a88-92d2-4aec-a680-2bf7bb560c56
Rulename	Cynerio - Exploitation Attempt of IoT device
Description	Exploitation Attempt of IoT device - Attack detection
Severity	High
Tactics	LateralMovement
Techniques	T0866
Required data connectors	CynerioSecurityEvents
Kind	Scheduled
Query frequency	5h
Query period	5h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cynerio/Analytic Rules/IoTExploitationAttempts.yaml
Version	1.0.0
Arm template	3d853a88-92d2-4aec-a680-2bf7bb560c56.json

KQL

CynerioEvent_CL
| where TimeGenerated > ago(24h)
| where module_s == 'IDS'
| where title_s == 'Exploitation Attempt'

YAML

version: 1.0.0
severity: High
name: Cynerio - Exploitation Attempt of IoT device
query: |
  CynerioEvent_CL
  | where TimeGenerated > ago(24h)
  | where module_s == 'IDS'
  | where title_s == 'Exploitation Attempt'  
eventGroupingSettings:
  aggregationKind: SingleAlert
tactics:
- LateralMovement
triggerThreshold: 0
customDetails:
  ExploitDescription: details_s
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cynerio/Analytic Rules/IoTExploitationAttempts.yaml
relevantTechniques:
- T0866
queryPeriod: 5h
triggerOperator: gt
description: Exploitation Attempt of IoT device - Attack detection
requiredDataConnectors:
- dataTypes:
  - CynerioEvent_CL
  connectorId: CynerioSecurityEvents
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: asset_ip_s
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: dst_ip_s
queryFrequency: 5h
kind: Scheduled
id: 3d853a88-92d2-4aec-a680-2bf7bb560c56

ARM