Contrast ADR - Exploited Attack Event

ContrastADRAttackEvents_CL
| where result =~ "exploited"

alertDetailsOverride:
  alertDisplayNameFormat: '{{result}} {{rule}} from {{sourceIp}} '
  alertDescriptionFormat: '{{result}}  on {{request_headers_referer}}  endpoint of {{application_name}} '
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: sourceIp
  entityType: IP
- fieldMappings:
  - identifier: HostName
    columnName: host_hostname
  entityType: Host
id: ae4f67a6-0713-4a26-ae61-284e67b408c1
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ContrastADR/Analytic%20Rules/Contrast_ADR_Exploited_Attack_Event.yaml
triggerOperator: gt
tactics:
- InitialAccess
- Execution
- DefenseEvasion
- LateralMovement
- CommandAndControl
kind: Scheduled
requiredDataConnectors:
- dataTypes:
  - ContrastADRAttackEvents_CL
  connectorId: ContrastADRCCF
queryPeriod: 5m
eventGroupingSettings:
  aggregationKind: AlertPerResult
severity: High
relevantTechniques:
- T1190
- T1059
- T1055
- T1210
- T1008
triggerThreshold: 0
version: 1.0.1
customDetails:
  TargetHost: host_hostname
  AttackRule: rule
  AttackedEndpoint: request_headers_referer
  Environment: environment
  AttackResult: result
  ApplicationName: application_name
name: Contrast ADR - Exploited Attack Event
status: Available
query: |
  ContrastADRAttackEvents_CL
  | where result =~ "exploited"
description: |
  'Detects successful exploitation of security vulnerabilities across all environments as identified by Contrast ADR. This rule captures confirmed exploited attacks that bypassed application security controls and require security team investigation.'
queryFrequency: 5m
incidentConfiguration:
  groupingConfiguration:
    enabled: true
    lookbackDuration: PT1H
    reopenClosedIncident: false
    groupByEntities:
    - IP
    - Host
    matchingMethod: Selected
  createIncident: true

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/ae4f67a6-0713-4a26-ae61-284e67b408c1')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/ae4f67a6-0713-4a26-ae61-284e67b408c1')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "{{result}}  on {{request_headers_referer}}  endpoint of {{application_name}} ",
          "alertDisplayNameFormat": "{{result}} {{rule}} from {{sourceIp}} "
        },
        "alertRuleTemplateName": "ae4f67a6-0713-4a26-ae61-284e67b408c1",
        "customDetails": {
          "ApplicationName": "application_name",
          "AttackedEndpoint": "request_headers_referer",
          "AttackResult": "result",
          "AttackRule": "rule",
          "Environment": "environment",
          "TargetHost": "host_hostname"
        },
        "description": "'Detects successful exploitation of security vulnerabilities across all environments as identified by Contrast ADR. This rule captures confirmed exploited attacks that bypassed application security controls and require security team investigation.'\n",
        "displayName": "Contrast ADR - Exploited Attack Event",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "sourceIp",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "host_hostname",
                "identifier": "HostName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByEntities": [
              "IP",
              "Host"
            ],
            "lookbackDuration": "PT1H",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ContrastADR/Analytic%20Rules/Contrast_ADR_Exploited_Attack_Event.yaml",
        "query": "ContrastADRAttackEvents_CL\n| where result =~ \"exploited\"\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CommandAndControl",
          "DefenseEvasion",
          "Execution",
          "InitialAccess",
          "LateralMovement"
        ],
        "techniques": [
          "T1008",
          "T1055",
          "T1059",
          "T1190",
          "T1210"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}