Vulerabilities

Back


Id	d096643d-6789-4c74-8893-dd3fc8a94069
Rulename	Vulerabilities
Description	This query searches for all the vulerabilities that RidgeBot identified
Severity	High
Tactics	Execution InitialAccess PrivilegeEscalation
Techniques	T1189 T1059 T1053 T1548
Required data connectors	CefAma RidgeBotDataConnector
Kind	Scheduled
Query frequency	12h
Query period	12h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/RidgeSecurity/Analytic Rules/RidgeSecurity_Vulnerabilities.yaml
Version	1.0.1
Arm template	d096643d-6789-4c74-8893-dd3fc8a94069.json

KQL

CommonSecurityLog
| where DeviceVendor == "RidgeSecurity"
| where DeviceEventClassID startswith "40"
| order by LogSeverity

YAML

version: 1.0.1
severity: High
name: Vulerabilities
query: |
  CommonSecurityLog
  | where DeviceVendor == "RidgeSecurity"
  | where DeviceEventClassID startswith "40"
  | order by LogSeverity  
status: Available
tactics:
- Execution
- InitialAccess
- PrivilegeEscalation
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/RidgeSecurity/Analytic Rules/RidgeSecurity_Vulnerabilities.yaml
relevantTechniques:
- T1189
- T1059
- T1053
- T1548
queryPeriod: 12h
triggerOperator: gt
description: |
    This query searches for all the vulerabilities that RidgeBot identified
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: RidgeBotDataConnector
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: DeviceVendor
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: Computer
queryFrequency: 12h
kind: Scheduled
id: d096643d-6789-4c74-8893-dd3fc8a94069

ARM