Contrast Exploits

Back


Id	e1abb6ed-be18-40fd-be58-3d3d84041daf
Rulename	Contrast Exploits
Description	Creates Incidents for Exploit events sourced from the Contrast Protect agent.
Severity	High
Tactics	InitialAccess Exfiltration
Techniques	T1566
Required data connectors	CefAma ContrastProtect ContrastProtectAma
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Contrast Protect/Analytic Rules/ContrastExploits.yaml
Version	1.0.2
Arm template	e1abb6ed-be18-40fd-be58-3d3d84041daf.json

KQL

let extract_data=(a:string, k:string) {
  parse_urlquery(replace(@';', @'&', a))["Query Parameters"][k]
};

CommonSecurityLog 
| where DeviceVendor == "Contrast Security"
| where AdditionalExtensions contains "EXPLOITED"
| extend DeviceProduct
| extend SourceIP
| extend DeviceVersion
| extend Activity
| extend ApplicationProtocol
| extend RequestURL
| extend RequestMethod
| extend Rule = extract_data(AdditionalExtensions, 'pri')

YAML

tactics:
- InitialAccess
- Exfiltration
relevantTechniques:
- T1566
version: 1.0.2
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Contrast Protect/Analytic Rules/ContrastExploits.yaml
id: e1abb6ed-be18-40fd-be58-3d3d84041daf
description: |
    'Creates Incidents for Exploit events sourced from the Contrast Protect agent.'
name: Contrast Exploits
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: ContrastProtect
- dataTypes:
  - CommonSecurityLog
  connectorId: ContrastProtectAma
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma
severity: High
status: Available
query: |
  let extract_data=(a:string, k:string) {
    parse_urlquery(replace(@';', @'&', a))["Query Parameters"][k]
  };

  CommonSecurityLog 
  | where DeviceVendor == "Contrast Security"
  | where AdditionalExtensions contains "EXPLOITED"
  | extend DeviceProduct
  | extend SourceIP
  | extend DeviceVersion
  | extend Activity
  | extend ApplicationProtocol
  | extend RequestURL
  | extend RequestMethod
  | extend Rule = extract_data(AdditionalExtensions, 'pri')  
queryFrequency: 5m
queryPeriod: 5m
customDetails:
  Agent: DeviceProduct
  Application: ApplicationProtocol
  Attack: Activity
  AgentVersion: DeviceVersion
  Details: AdditionalExtensions
kind: Scheduled
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: SourceIP
  entityType: IP
- fieldMappings:
  - identifier: Url
    columnName: RequestURL
  entityType: URL
- fieldMappings:
  - identifier: Name
    columnName: ApplicationProtocol
  entityType: CloudApplication
- fieldMappings:
  - identifier: Name
    columnName: Activity
  - identifier: Category
    columnName: Rule
  entityType: Malware
triggerThreshold: 0

ARM