Contrast Exploits

Back


Id	e1abb6ed-be18-40fd-be58-3d3d84041daf
Rulename	Contrast Exploits
Description	Creates Incidents for Exploit events sourced from the Contrast Protect agent.
Severity	High
Tactics	InitialAccess Exfiltration
Techniques	T1566
Required data connectors	CefAma ContrastProtect ContrastProtectAma
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Contrast Protect/Analytic Rules/ContrastExploits.yaml
Version	1.0.2
Arm template	e1abb6ed-be18-40fd-be58-3d3d84041daf.json

KQL

let extract_data=(a:string, k:string) {
  parse_urlquery(replace(@';', @'&', a))["Query Parameters"][k]
};

CommonSecurityLog 
| where DeviceVendor == "Contrast Security"
| where AdditionalExtensions contains "EXPLOITED"
| extend DeviceProduct
| extend SourceIP
| extend DeviceVersion
| extend Activity
| extend ApplicationProtocol
| extend RequestURL
| extend RequestMethod
| extend Rule = extract_data(AdditionalExtensions, 'pri')

YAML

relevantTechniques:
- T1566
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: SourceIP
    identifier: Address
- entityType: URL
  fieldMappings:
  - columnName: RequestURL
    identifier: Url
- entityType: CloudApplication
  fieldMappings:
  - columnName: ApplicationProtocol
    identifier: Name
- entityType: Malware
  fieldMappings:
  - columnName: Activity
    identifier: Name
  - columnName: Rule
    identifier: Category
version: 1.0.2
id: e1abb6ed-be18-40fd-be58-3d3d84041daf
severity: High
kind: Scheduled
queryFrequency: 5m
description: |
    'Creates Incidents for Exploit events sourced from the Contrast Protect agent.'
requiredDataConnectors:
- connectorId: ContrastProtect
  dataTypes:
  - CommonSecurityLog
- connectorId: ContrastProtectAma
  dataTypes:
  - CommonSecurityLog
- connectorId: CefAma
  dataTypes:
  - CommonSecurityLog
triggerOperator: gt
name: Contrast Exploits
tactics:
- InitialAccess
- Exfiltration
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Contrast Protect/Analytic Rules/ContrastExploits.yaml
triggerThreshold: 0
queryPeriod: 5m
query: |
  let extract_data=(a:string, k:string) {
    parse_urlquery(replace(@';', @'&', a))["Query Parameters"][k]
  };

  CommonSecurityLog 
  | where DeviceVendor == "Contrast Security"
  | where AdditionalExtensions contains "EXPLOITED"
  | extend DeviceProduct
  | extend SourceIP
  | extend DeviceVersion
  | extend Activity
  | extend ApplicationProtocol
  | extend RequestURL
  | extend RequestMethod
  | extend Rule = extract_data(AdditionalExtensions, 'pri')  
status: Available
customDetails:
  Attack: Activity
  Agent: DeviceProduct
  Details: AdditionalExtensions
  AgentVersion: DeviceVersion
  Application: ApplicationProtocol

ARM