GTI - Zero-Day Vulnerability Detected | Microsoft Sentinel Analytic Rules

Back


Id	ebd03de8-0cee-4923-b510-45337e0aed84
Rulename	GTI - Zero-Day Vulnerability Detected
Description	Detects vulnerabilities ingested from Google Threat Intelligence that are tagged as Zero Day, indicating a vulnerability being exploited before a patch is publicly available. Fires when a matching record is found via the GTIVulnerabilities parser, warranting immediate analyst response.
Severity	High
Tactics	InitialAccess Execution PrivilegeEscalation Impact
Techniques	T1190 T1068 T1203 T1486
Required data connectors	GTIVulnerabilitiesConnector
Kind	Scheduled
Query frequency	10m
Query period	10m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/Vulnerabilities/GTI_ZeroDayVulnerability.yaml
Version	1.0.0
Arm template	ebd03de8-0cee-4923-b510-45337e0aed84.json

KQL

GTIVulnerabilities
| where tolower(tostring(Tags)) has_any ("zero-day", "0day", "0-day", "zero_day", "zero Day")
| extend Cvssv3Score = coalesce(Cvssv3xBaseScore, Cvssv3xTranslatedBaseScore)
| extend
    Vendor       = tostring(Cpes[0].start_cpe.vendor),
    Product      = tostring(Cpes[0].start_cpe.product),
    CpeVersion   = tostring(Cpes[0].start_cpe.version),
    VendorFixUrl = coalesce(tostring(VendorFixReferences[0].url), tostring(VendorFixReferences[0]))
| mv-apply _c = Cpes on (
    where isnotnull(_c.start_cpe)
    | summarize AffectedVendors  = make_set(tostring(_c.start_cpe.vendor)),
                AffectedProducts = make_set(tostring(_c.start_cpe.product))
  )
| project
    TimeGenerated,
    CveId,
    VulnName,
    RiskRating,
    Priority,
    ExploitationState,
    ExploitationConsequence,
    ExploitReleaseDate,
    Cvssv3Score,
    Cvssv4xScore,
    EpssScore,
    EpssPercentile,
    Cvssv4xThreatExploitMaturity,
    RecentActivityRelativeChange,
    Vendor,
    Product,
    CpeVersion,
    AffectedVendors,
    AffectedProducts,
    Description,
    VendorFixUrl,
    VendorFixReferences,
    Tags,
    Type

YAML

relevantTechniques:
- T1190
- T1068
- T1203
- T1486
triggerThreshold: 0
id: ebd03de8-0cee-4923-b510-45337e0aed84
eventGroupingSettings:
  aggregationKind: AlertPerResult
queryPeriod: 10m
triggerOperator: gt
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    matchingMethod: Selected
    groupByCustomDetails:
    - CveId
    lookbackDuration: P1D
alertDetailsOverride:
  alertDisplayNameFormat: 'GTI Zero-Day: {{CveId}}'
  alertDescriptionFormat: 'CVE: {{CveId}} | Risk: {{RiskRating}} | State: {{ExploitationState}}'
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/Vulnerabilities/GTI_ZeroDayVulnerability.yaml
queryFrequency: 10m
requiredDataConnectors:
- dataTypes:
  - GTI_Vulnerabilities_CL
  connectorId: GTIVulnerabilitiesConnector
version: 1.0.0
tactics:
- InitialAccess
- Execution
- PrivilegeEscalation
- Impact
query: |
  GTIVulnerabilities
  | where tolower(tostring(Tags)) has_any ("zero-day", "0day", "0-day", "zero_day", "zero Day")
  | extend Cvssv3Score = coalesce(Cvssv3xBaseScore, Cvssv3xTranslatedBaseScore)
  | extend
      Vendor       = tostring(Cpes[0].start_cpe.vendor),
      Product      = tostring(Cpes[0].start_cpe.product),
      CpeVersion   = tostring(Cpes[0].start_cpe.version),
      VendorFixUrl = coalesce(tostring(VendorFixReferences[0].url), tostring(VendorFixReferences[0]))
  | mv-apply _c = Cpes on (
      where isnotnull(_c.start_cpe)
      | summarize AffectedVendors  = make_set(tostring(_c.start_cpe.vendor)),
                  AffectedProducts = make_set(tostring(_c.start_cpe.product))
    )
  | project
      TimeGenerated,
      CveId,
      VulnName,
      RiskRating,
      Priority,
      ExploitationState,
      ExploitationConsequence,
      ExploitReleaseDate,
      Cvssv3Score,
      Cvssv4xScore,
      EpssScore,
      EpssPercentile,
      Cvssv4xThreatExploitMaturity,
      RecentActivityRelativeChange,
      Vendor,
      Product,
      CpeVersion,
      AffectedVendors,
      AffectedProducts,
      Description,
      VendorFixUrl,
      VendorFixReferences,
      Tags,
      Type
name: GTI - Zero-Day Vulnerability Detected
severity: High
entityMappings:
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: VendorFixUrl
customDetails:
  EpssPercentile: EpssPercentile
  AffectedVendor: Vendor
  CveId: CveId
  Cvssv3Score: Cvssv3Score
  ActivityChange: RecentActivityRelativeChange
  ExploitMaturity: Cvssv4xThreatExploitMaturity
  Priority: Priority
  EpssScore: EpssScore
  RiskRating: RiskRating
  Cvssv4Score: Cvssv4xScore
  ExploitState: ExploitationState
  AffectedProduct: Product
description: |
  Detects vulnerabilities ingested from Google Threat Intelligence that are tagged as Zero Day,
  indicating a vulnerability being exploited before a patch is publicly available. Fires when a
  matching record is found via the GTIVulnerabilities parser, warranting immediate analyst response.
kind: Scheduled

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/ebd03de8-0cee-4923-b510-45337e0aed84')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/ebd03de8-0cee-4923-b510-45337e0aed84')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "CVE: {{CveId}} | Risk: {{RiskRating}} | State: {{ExploitationState}}",
          "alertDisplayNameFormat": "GTI Zero-Day: {{CveId}}"
        },
        "alertRuleTemplateName": "ebd03de8-0cee-4923-b510-45337e0aed84",
        "customDetails": {
          "ActivityChange": "RecentActivityRelativeChange",
          "AffectedProduct": "Product",
          "AffectedVendor": "Vendor",
          "CveId": "CveId",
          "Cvssv3Score": "Cvssv3Score",
          "Cvssv4Score": "Cvssv4xScore",
          "EpssPercentile": "EpssPercentile",
          "EpssScore": "EpssScore",
          "ExploitMaturity": "Cvssv4xThreatExploitMaturity",
          "ExploitState": "ExploitationState",
          "Priority": "Priority",
          "RiskRating": "RiskRating"
        },
        "description": "Detects vulnerabilities ingested from Google Threat Intelligence that are tagged as Zero Day,\nindicating a vulnerability being exploited before a patch is publicly available. Fires when a\nmatching record is found via the GTIVulnerabilities parser, warranting immediate analyst response.\n",
        "displayName": "GTI - Zero-Day Vulnerability Detected",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "VendorFixUrl",
                "identifier": "Url"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByCustomDetails": [
              "CveId"
            ],
            "lookbackDuration": "P1D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/Vulnerabilities/GTI_ZeroDayVulnerability.yaml",
        "query": "GTIVulnerabilities\n| where tolower(tostring(Tags)) has_any (\"zero-day\", \"0day\", \"0-day\", \"zero_day\", \"zero Day\")\n| extend Cvssv3Score = coalesce(Cvssv3xBaseScore, Cvssv3xTranslatedBaseScore)\n| extend\n    Vendor       = tostring(Cpes[0].start_cpe.vendor),\n    Product      = tostring(Cpes[0].start_cpe.product),\n    CpeVersion   = tostring(Cpes[0].start_cpe.version),\n    VendorFixUrl = coalesce(tostring(VendorFixReferences[0].url), tostring(VendorFixReferences[0]))\n| mv-apply _c = Cpes on (\n    where isnotnull(_c.start_cpe)\n    | summarize AffectedVendors  = make_set(tostring(_c.start_cpe.vendor)),\n                AffectedProducts = make_set(tostring(_c.start_cpe.product))\n  )\n| project\n    TimeGenerated,\n    CveId,\n    VulnName,\n    RiskRating,\n    Priority,\n    ExploitationState,\n    ExploitationConsequence,\n    ExploitReleaseDate,\n    Cvssv3Score,\n    Cvssv4xScore,\n    EpssScore,\n    EpssPercentile,\n    Cvssv4xThreatExploitMaturity,\n    RecentActivityRelativeChange,\n    Vendor,\n    Product,\n    CpeVersion,\n    AffectedVendors,\n    AffectedProducts,\n    Description,\n    VendorFixUrl,\n    VendorFixReferences,\n    Tags,\n    Type\n",
        "queryFrequency": "PT10M",
        "queryPeriod": "PT10M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Execution",
          "Impact",
          "InitialAccess",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1068",
          "T1190",
          "T1203",
          "T1486"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}