Contrast ADR - Exploited Attack Event

ContrastADRAttackEvents_CL
| where result =~ "exploited"

tactics:
- InitialAccess
- Execution
- DefenseEvasion
- LateralMovement
- CommandAndControl
requiredDataConnectors:
- dataTypes:
  - ContrastADRAttackEvents_CL
  connectorId: ContrastADRCCF
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    groupByEntities:
    - IP
    - Host
    matchingMethod: Selected
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: PT1H
queryPeriod: 5m
kind: Scheduled
severity: High
customDetails:
  Environment: environment
  ApplicationName: application_name
  TargetHost: host_hostname
  AttackedEndpoint: request_headers_referer
  AttackResult: result
  AttackRule: rule
queryFrequency: 5m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ContrastADR/Analytic%20Rules/Contrast_ADR_Exploited_Attack_Event.yaml
triggerThreshold: 0
description: |
  'Detects successful exploitation of security vulnerabilities across all environments as identified by Contrast ADR. This rule captures confirmed exploited attacks that bypassed application security controls and require security team investigation.'
id: ae4f67a6-0713-4a26-ae61-284e67b408c1
triggerOperator: gt
alertDetailsOverride:
  alertDescriptionFormat: '{{result}}  on {{request_headers_referer}}  endpoint of {{application_name}} '
  alertDisplayNameFormat: '{{result}} {{rule}} from {{sourceIp}} '
status: Available
relevantTechniques:
- T1190
- T1059
- T1055
- T1210
- T1008
version: 1.0.1
name: Contrast ADR - Exploited Attack Event
eventGroupingSettings:
  aggregationKind: AlertPerResult
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: sourceIp
    identifier: Address
- entityType: Host
  fieldMappings:
  - columnName: host_hostname
    identifier: HostName
query: |
  ContrastADRAttackEvents_CL
  | where result =~ "exploited"

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/ae4f67a6-0713-4a26-ae61-284e67b408c1')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/ae4f67a6-0713-4a26-ae61-284e67b408c1')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "{{result}}  on {{request_headers_referer}}  endpoint of {{application_name}} ",
          "alertDisplayNameFormat": "{{result}} {{rule}} from {{sourceIp}} "
        },
        "alertRuleTemplateName": "ae4f67a6-0713-4a26-ae61-284e67b408c1",
        "customDetails": {
          "ApplicationName": "application_name",
          "AttackedEndpoint": "request_headers_referer",
          "AttackResult": "result",
          "AttackRule": "rule",
          "Environment": "environment",
          "TargetHost": "host_hostname"
        },
        "description": "'Detects successful exploitation of security vulnerabilities across all environments as identified by Contrast ADR. This rule captures confirmed exploited attacks that bypassed application security controls and require security team investigation.'\n",
        "displayName": "Contrast ADR - Exploited Attack Event",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "sourceIp",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "host_hostname",
                "identifier": "HostName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByEntities": [
              "IP",
              "Host"
            ],
            "lookbackDuration": "PT1H",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ContrastADR/Analytic%20Rules/Contrast_ADR_Exploited_Attack_Event.yaml",
        "query": "ContrastADRAttackEvents_CL\n| where result =~ \"exploited\"\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CommandAndControl",
          "DefenseEvasion",
          "Execution",
          "InitialAccess",
          "LateralMovement"
        ],
        "techniques": [
          "T1008",
          "T1055",
          "T1059",
          "T1190",
          "T1210"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}