Kusto rules: 08

id: d5e012c2-29ba-4a02-a813-37b928aafe2d
name: Awake Security - High Severity Matches By Device
description: This query searches for devices with high severity event(s).
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: CefAma
    dataTypes:
      - CommonSecurityLog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics: []
relevantTechniques: []
query: |
  CommonSecurityLog
  | where DeviceVendor == "Arista Networks" and DeviceProduct == "Awake Security" and toint(LogSeverity) > 6
  | summarize StartTime=min(TimeGenerated), EndTime=max(TimeGenerated), Models=make_set(Activity), ASPMatchURLs=make_set(DeviceCustomString2), SourceIPs=make_set(SourceIP),
    DestinationIPs=make_set(DestinationIP), ModelMatchCount=sum(EventCount), MaxSeverity=max(todecimal  (LogSeverity)) by SourceHostName
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: Awake Security - High Severity Matches On Device {{SourceHostName}}
  alertDescriptionFormat: |
    Device {{SourceHostName}} matched the following high-severity Awake model(s):

    {{Models}}

    The destination IPs associated with these matches were:

    {{DestinationIPs}}
  alertTacticsColumnName: null
  alertSeverityColumnName: MaxSeverity
customDetails:
  Matched_Models: Models
  Matches_ASP_URLs: ASPMatchURLs
  Device: SourceHostName
  Matches_Count: ModelMatchCount
  Matches_Max_Severity: MaxSeverity
  Matches_Dest_IPs: DestinationIPs
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: SourceHostName
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIPs
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: true
    lookbackDuration: 3d
    matchingMethod: Selected
    groupByEntities:
      - Host
    groupByAlertDetails: []
    groupByCustomDetails:
      - Device
version: 1.0.2
kind: Scheduled

id: 09f2a28b-3286-4268-9e2f-33805f104e5d
name: AWSCloudTrail - S3 object publicly exposed
description: |
  Detects S3 object ACL changes that expose objects to public or broadly authenticated users.
  This can result in unintended data disclosure from object-level permissions.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: AWS
    dataTypes:
      - AWSCloudTrail
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Exfiltration
relevantTechniques:
  - T1537
query: |
    AWSCloudTrail
      | where EventName == "PutObjectAcl" and isempty(ErrorCode) and isempty(ErrorMessage)
      | extend Grant = parse_json(tostring((parse_json(RequestParameters).AccessControlPolicy))).AccessControlList.Grant
      | mvexpand Grant
      | extend cannedacl = parse_json(tostring((parse_json(RequestParameters))))
      | extend URI = parse_json(Grant).Grantee.URI, type = parse_json(Grant).Grantee.["xsi:type"], xamzacl = parse_json(cannedacl).["x-amz-acl"]
      | where (type == "Group" and (URI endswith "AllUsers" or URI endswith "AuthenticatedUsers"))
        or xamzacl in ("authenticated-read","public-read","public-read-write")
      | extend UserIdentityArn = iif(isempty(UserIdentityArn), tostring(parse_json(Resources)[0].ARN), UserIdentityArn)
      | extend UserName = tostring(split(UserIdentityArn, '/')[-1])
      | extend AccountName = case( UserIdentityPrincipalid == "Anonymous", "Anonymous", isempty(UserIdentityUserName), UserName, UserIdentityUserName)
      | extend AccountName = iif(AccountName contains "@", tostring(split(AccountName, '@', 0)[0]), AccountName),
        AccountUPNSuffix = iif(AccountName contains "@", tostring(split(AccountName, '@', 1)[0]), "")
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountUPNSuffix
      - identifier: CloudAppAccountId
        columnName: RecipientAccountId
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIpAddress
customDetails:
  EventName: EventName
  URI: URI
  xamzacl: xamzacl
  RecipientAccountId: RecipientAccountId
alertDetailsOverride:
  alertDisplayNameFormat: 'AWS S3 object public ACL exposure by {{AccountName}}'
  alertDescriptionFormat: 'Detected {{EventName}} event from {{SourceIpAddress}} applying public object ACL settings in account {{RecipientAccountId}}.'
version: 1.0.2
kind: Scheduled

id: f7210a45-12a4-4d02-b59e-f23476827a4b
name: AWSCloudTrail - Unauthorized EC2 Instance Setup Attempt
description: |
  Detects an unauthorized attempt to launch an EC2 instance by a user without the necessary permissions. This may indicate an attempt to provision malicious infrastructure within the AWS subscription. Reference: https://stratus-red-team.cloud/attack-techniques/AWS/aws.execution.ec2-launch-unusual-instances/
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: AWS
    dataTypes:
      - AWSCloudTrail
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - ResourceDevelopment
relevantTechniques:
  - T1583
query: |
 AWSCloudTrail
 | where EventName == "RunInstances"
 | where ErrorCode == "Client.UnauthorizedOperation"
 | project TimeGenerated, AwsEventId, EventTypeName, UserIdentityPrincipalid, UserIdentityType,  UserIdentityAccountId, SessionMfaAuthenticated, SessionCreationDate, SessionIssuerUserName, SourceIpAddress, AWSRegion, UserAgent, RequestParameters, ErrorMessage
 | extend UserName = substring(UserIdentityPrincipalid, indexof_regex(UserIdentityPrincipalid, ":") + 1)
 | extend Name = split(UserName,'@')[0],UpnSuffix = split(UserName,'@')[1]
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: Name
      - identifier: UPNSuffix
        columnName: UpnSuffix
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIpAddress
customDetails:
  AWSRegion: AWSRegion
  UserAgent: UserAgent
  ErrorMessage: ErrorMessage
  UserIdentityType: UserIdentityType
alertDetailsOverride:
  alertDisplayNameFormat: Unauthorized EC2 instance launch attempt by {{UserIdentityPrincipalid}} in {{AWSRegion}}
  alertDescriptionFormat: User {{UserIdentityPrincipalid}} (type {{UserIdentityType}}) attempted an unauthorized EC2 instance launch in region {{AWSRegion}}.
version: 1.0.1
kind: Scheduled

id: bc26d218-89a4-40ba-88b6-76e5141b5731
name: BloodHound Attack Path Finding - Non-Tier Zero Principal Trusted for Unconstrained
  Delegation
description: BloodHound Attack Path Finding - Non-Tier Zero Principal Trusted for
  Unconstrained Delegation
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: BloodHoundEnterprise
    dataTypes:
      - BHEAttackPathsData_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics: []
relevantTechniques: []
query: BHEAttackPathsData_CL | where Finding == "T0CoerceToTGT"
entityMappings:
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: domain_name
customDetails:
  Description: ShortDescription
  Remediation: ShortRemediation
version: 1.0.0
kind: Scheduled

id: e71890a2-5f61-4790-b1ed-cf1d92d3e398
name: CiscoISE - Command executed with the highest privileges by new user
description: |
  'Detects command execution with PrivilegeLevel - 15 by user for wich there was no such activity detected earlier.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: SyslogAma
    datatypes:
      - Syslog
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - Persistence
  - PrivilegeEscalation
  - DefenseEvasion
  - Execution
relevantTechniques:
  - T1133
  - T1548
  - T1059
query: |
  let lbperiod = 14d;
  let lbtime = 15m;
  let knownPrivUsers =
  CiscoISEEvent
  | where TimeGenerated between (ago(lbperiod) .. ago(lbtime))
  | where PrivilegeLevel == '15'
  | summarize makelist(DstUserName)
  ;
  CiscoISEEvent
  | where TimeGenerated > ago(lbtime)
  | where PrivilegeLevel == '15'
  | where DstUserName !in (knownPrivUsers)
  | project TimeGenerated, SrcIpAddr, DstIpAddr, DstUserName, CmdSet
  | extend AccountCustomEntity = DstUserName
  | extend IPCustomEntity = SrcIpAddr
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity
version: 1.0.4
kind: Scheduled

id: 73e1d89b-79a6-4ab0-b3bb-5e564fcf10f1
name: Cloud Gateway Pool Deleted
description: Detects when a cloud gateway pool is deleted from Veeam Backup & Replication.
  This might indicate unauthorized removal of critical components.
severity: Informational
status: Available
requiredDataConnectors:
- connectorId: Syslog
  dataTypes:
  - Syslog
- connectorId: SyslogAma
  dataTypes:
  - Syslog
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
eventGroupingSettings:
  aggregationKind: AlertPerResult
tactics: []
relevantTechniques: []
query: "Veeam_GetSecurityEvents\n| where instanceId == 24143\n| project\n    Date\
  \ = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n    DataSource = original_host,\n\
  \    EventId = instanceId,\n    [\"User Name\"] = user,\n  MessageDetails = Description,\n\
  \   Severity = SeverityDescription"
version: 1.0.1
kind: Scheduled
customDetails:
  Date: Date
  VbrHostName: DataSource
  EventId: EventId
  MessageDetails: MessageDetails
  Severity: Severity

id: f3c25011-4509-41c8-be27-35d891531c39
name: Cyble Vision Alerts Bitbucket
description: |
  'Detects exposed secrets in Bitbucket repositories using the Alerts_bit_bucket parser. Creates one incident per matched secret. Includes decoder, detector, commit, file, and repository context for SOC triage.'
severity: Low
status: Available
requiredDataConnectors:
- connectorId: CybleVisionAlerts
  dataTypes:
  - CybleVisionAlerts_CL
enabled: true
queryFrequency: 30m
queryPeriod: 30m
triggerOperator: GreaterThan
triggerThreshold: 0
eventGroupingSettings:
  aggregationKind: AlertPerResult
tactics:
- CredentialAccess
- Exfiltration
- Discovery
relevantTechniques:
- T1552
- T1537
- T1083
query: |
  Alerts_bit_bucket 
  | where Service == "bit_bucket" 
  | extend MappedSeverity = Severity
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
alertDetailsOverride:
  alertDisplayNameFormat: Secret Exposure in Bitbucket {{BB_File}} ({{BB_DetectorName}})
  alertDescriptionFormat: |
    A sensitive secret was detected in Bitbucket repository {{BB_Repository}}. File {{BB_File}}:{{BB_Line}}. Investigator should verify exposure, rotate credentials and remediate impacted systems.
customDetails:
  MappedSeverity: Severity
  Status: Status
  AlertID: AlertID
  Service: Service
  BB_DetectorName: BB_DetectorName
  BB_Raw: BB_Raw
  BB_File: BB_File
  BB_Line: BB_Line
  BB_Commit: BB_Commit
  BB_Email: BB_Email
  BB_Repository: BB_Repository
  BB_Link: BB_Link
  BB_Verified: BB_Verified
  BB_RotationGuide: BB_RotationGuide
entityMappings:
- entityType: Url
  fieldMappings:
  - identifier: Url
    columnName: BB_Repository
- entityType: Url
  fieldMappings:
  - identifier: Url
    columnName: BB_Link
- entityType: File
  fieldMappings:
  - identifier: Name
    columnName: BB_File
  - identifier: Directory
    columnName: KeywordName
version: 1.0.0
kind: Scheduled

id: 3367fd5e-44b3-4746-a9a5-dc15c8202490
name: Execution attempts stateful anomaly on database
description: |
  'This query detects batches of distinct SQL queries that execute (or attempt to) commands that could indicate potential security issues - such as attempts to execute shell commands (e.g. for running illegitimate code).'
severity: Medium
requiredDataConnectors:
  - connectorId: AzureSql
    dataTypes:
      - AzureDiagnostics
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
status: Available
tactics:
  - Execution
relevantTechniques:
  - T1059
  - T1059.001
  - T1059.003
tags:
  - SQL
query: |
    let monitoredStatementsThreshold = 1;           // Minimal number of monitored statements in the slice to trigger an anomaly.
    let trainingSlicesThreshold = 5;                // The maximal amount of slices with monitored statements in the training window before anomaly detection is throttled.
    let timeSliceSize = 1h;                         // The size of the single timeSlice for individual aggregation.
    let detectionWindow = 1h;                       // The size of the recent detection window for detecting anomalies.  
    let trainingWindow = detectionWindow + 14d;     // The size of the training window before the detection window for learning the normal state.
    let hotwords = pack_array('xp_cmdshell', 'ps.exe', 'powershell', 'cmd.exe', 'msiexec', '<script>'); // List of monitored hot words.
    let processedData = materialize (
        AzureDiagnostics
        | where TimeGenerated >= ago(trainingWindow)
        | where Category == 'SQLSecurityAuditEvents' and action_id_s has_any ("RCM", "BCM") // Keep only SQL affected rows
        | project TimeGenerated, PrincipalName = server_principal_name_s, ClientIp = client_ip_s, HostName = host_name_s, ResourceId,
                  ApplicationName = application_name_s, ActionName = action_name_s, Database = strcat(LogicalServerName_s, '/', database_name_s),
                  IsSuccess = succeeded_s, AffectedRows = affected_rows_d,
                  ResponseRows = response_rows_d, Statement = statement_s,
                  Error = case( additional_information_s has 'error_code', toint(extract("<error_code>([0-9.]+)", 1, additional_information_s))
                        , additional_information_s has 'failure_reason', toint(extract("<failure_reason>Err ([0-9.]+)", 1, additional_information_s))
                        , 0),
                  State = case( additional_information_s has 'error_state', toint(extract("<error_state>([0-9.]+)", 1, additional_information_s))
                        , additional_information_s has 'failure_reason', toint(extract("<failure_reason>Err ([0-9.]+), Level ([0-9.]+)", 2, additional_information_s))
                        , 0),
                  AdditionalInfo = additional_information_s, timeSlice = floor(TimeGenerated, timeSliceSize)
        | extend hasHotword = iff(Statement has_any (hotwords), 1, 0)
        | summarize countEvents = count(), countStatements = dcount(Statement)
            , countStatementsWithHotwords = dcountif(Statement, hasHotword == 1)
            , countFailedStatementsWithHotwords = dcountif(Statement, (hasHotword == 1) and (Error > 0))
            , countSuccessfulStatementsWithHotwords = dcountif(Statement, ((hasHotword == 1)) and (Error == 0))
            , anyMonitoredStatement = anyif(Statement, (hasHotword == 1))
            , anySuccessfulMonitoredStatement = anyif(Statement, (hasHotword == 1) and (Error == 0))
            , anyInfo = anyif(AdditionalInfo, hasHotword == 1)
            , hotWord = anyif(extract(strcat_array(hotwords, '|'), 0, tolower(Statement)), hasHotword == 1)
            by Database, ClientIp, ApplicationName, PrincipalName, timeSlice,HostName,ResourceId    
        | extend WindowType = case( timeSlice >= ago(detectionWindow), 'detection',
                                               (ago(trainingWindow) <= timeSlice and timeSlice < ago(detectionWindow)), 'training', 'other')
        | where WindowType in ('detection', 'training'));
    let trainingSet =
        processedData
        | where WindowType == 'training'
        | summarize countSlicesWithHotwords = dcountif(timeSlice, countStatementsWithHotwords >= monitoredStatementsThreshold)
            by Database;
    processedData
    | where WindowType == 'detection' 
    | join kind = inner (trainingSet) on Database
    | extend IsHotwordAnomalyOnStatement = iff(((countStatementsWithHotwords >= monitoredStatementsThreshold) and (countSlicesWithHotwords <= trainingSlicesThreshold)), true, false)
        , anomalyScore = round(countStatementsWithHotwords/monitoredStatementsThreshold, 0)
    | where IsHotwordAnomalyOnStatement == 'true'
    | project TimeGenerated = timeSlice, Database, ClientIp, ApplicationName, PrincipalName, HostName, ResourceId, countEvents, countStatements, countStatementsWithHotwords, anyMonitoredStatement, anyInfo, anomalyScore, hotWord
    | extend Name = tostring(split(PrincipalName,'@',0)[0]), UPNSuffix = tostring(split(PrincipalName,'@',1)[0])
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: Name
      - identifier: UPNSuffix
        columnName: UPNSuffix
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: ClientIp
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: HostName
  - entityType: CloudApplication
    fieldMappings:
      - identifier: Name
        columnName: ApplicationName
  - entityType: AzureResource
    fieldMappings:
      - identifier: ResourceId
        columnName: ResourceId
customDetails:
  HotWords: hotWord
alertDetailsOverride:
  alertDisplayNameFormat: 'Execution attempts stateful anomaly on database {{Database}}'
  alertDescriptionFormat: 'An anomaly was detected on database {{Database}} with {{countStatementsWithHotwords}} statements with monitored hot words (xp_cmdshell, powershell, cmd.exe etc.) in the last hour. Investigate the database activity for potential malicious attempts to execute shell commands or run illegitimate code.'
version: 1.1.2
kind: Scheduled

id: 3a8d7f9e-4b2c-4e5d-8c6b-9f1a3d5e8c7b
name: GCP Audit Logs - Storage Bucket Made Public
description: |
  'Detects when a Google Cloud Storage bucket is made publicly accessible by granting permissions to allUsers or allAuthenticatedUsers.
  Making buckets public can expose sensitive data to unauthorized access and may indicate a misconfiguration or malicious activity.
  Adversaries may make buckets public to exfiltrate data or as part of a data exposure attack.
  This rule monitors setIamPermissions operations that add public access roles to storage buckets.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: GCPAuditLogsDefinition
    dataTypes:
      - GCPAuditLogs
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Collection
  - InitialAccess
  - Exfiltration
relevantTechniques:
  - T1530
  - T1078.004
  - T1567.002
tags:
  - GCP
  - Storage
  - Data Exposure
  - Cloud Security
query: |
  GCPAuditLogs
  | where ServiceName == "storage.googleapis.com"
  | where MethodName == "storage.setIamPermissions"
  | where GCPResourceType == "gcs_bucket"
  | extend 
      ServiceDataJson = parse_json(ServiceData),
      RequestMetadataJson = parse_json(RequestMetadata),
      AuthInfoJson = parse_json(AuthenticationInfo),
      AuthzInfoJson = parse_json(AuthorizationInfo)
  | extend PolicyDelta = ServiceDataJson.policyDelta.bindingDeltas
  | mv-expand PolicyDelta
  | extend 
      Action = tostring(PolicyDelta.action),
      Member = tostring(PolicyDelta.member),
      Role = tostring(PolicyDelta.role)
  | where Action == "ADD"
  | where Member in~ ("allUsers", "allAuthenticatedUsers")
  | extend 
      BucketName = extract(@"buckets/([^/]+)", 1, GCPResourceName),
      CallerIpAddress = tostring(RequestMetadataJson.callerIp),
      UserAgent = tostring(RequestMetadataJson.callerSuppliedUserAgent),
      AuthEmail = tostring(AuthInfoJson.principalEmail),
      Permission = tostring(AuthzInfoJson[0].permission),
      PermissionGranted = tostring(AuthzInfoJson[0].granted)
  | extend 
      PublicAccessType = case(
          Member =~ "allUsers", "Public to Everyone",
          Member =~ "allAuthenticatedUsers", "Public to All Authenticated Users",
          "Unknown"),
      AccountName = tostring(split(PrincipalEmail, "@")[0]), 
      AccountUPNSuffix = tostring(split(PrincipalEmail, "@")[1])
  | project TimeGenerated,
            PrincipalEmail,
            AuthEmail,
            ProjectId,
            BucketName,
            ResourceName = GCPResourceName,
            PublicAccessType,
            Member,
            Role,
            CallerIpAddress,
            UserAgent,
            MethodName,
            ServiceName,
            Severity,
            Permission,
            PermissionGranted,
            LogName,
            InsertId,
            AccountName,
            AccountUPNSuffix
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: PrincipalEmail
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountUPNSuffix
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: CallerIpAddress
  - entityType: CloudApplication
    fieldMappings:
      - identifier: Name
        columnName: ProjectId
      - identifier: InstanceName
        columnName: ResourceName
customDetails:
  ProjectId: ProjectId
  BucketName: BucketName
  ResourceName: ResourceName
  PublicAccessType: PublicAccessType
  RoleGranted: Role
  UserAgent: UserAgent
  Permission: Permission
alertDetailsOverride:
  alertDisplayNameFormat: "GCP Storage Bucket {{BucketName}} Made Public by {{PrincipalEmail}}"
  alertDescriptionFormat: |-
    User {{PrincipalEmail}} made storage bucket {{BucketName}} publicly accessible in project {{ProjectId}}.
    This may expose sensitive data to unauthorized access. Investigate immediately to determine if this action was authorized and assess potential data exposure.
    Review bucket contents and access logs for any unauthorized access attempts.
version: 1.0.0
kind: Scheduled

id: 141d7e3c-a72b-49f7-9e64-57f60c2fa927
name: Global VM Exclusions Deleted
description: Detects when a VM is removed from global exclusions in Veeam Backup &
  Replication. This might indicate unauthorized changes.
severity: Low
status: Available
requiredDataConnectors:
- connectorId: Syslog
  dataTypes:
  - Syslog
- connectorId: SyslogAma
  dataTypes:
  - Syslog
queryFrequency: 3h
queryPeriod: 3h
triggerOperator: gt
triggerThreshold: 0
eventGroupingSettings:
  aggregationKind: AlertPerResult
tactics: []
relevantTechniques: []
query: "Veeam_GetSecurityEvents\n| where instanceId == 40500\n| project\n    Date\
  \ = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n    DataSource = original_host,\n\
  \    EventId = instanceId,\n    UserName = user,\n  MessageDetails = Description,\n\
  \    Severity = SeverityDescription"
version: 1.0.1
kind: Scheduled
customDetails:
  Date: Date
  VbrHostName: DataSource
  EventId: EventId
  MessageDetails: MessageDetails
  Severity: Severity

id: 347c6cb3-33d2-4753-b7f6-eab946a8cd51
name: GSA - TI URL Entity
description: |
  This query identifies URL indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in GSA NetworkAccessTraffic.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: AzureActiveDirectory
    dataTypes:
      - NetworkAccessTrafficLogs
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CommandAndControl
relevantTechniques:
  - T1071
query: |
  let dt_lookBack = 1h;
  let ioc_lookBack = 14d;
  let GSANetworkAccessTraffic_ = NetworkAccessTraffic
  | where TimeGenerated >= ago(dt_lookBack)
  | where TrafficType  == "internet"
  | extend DestinationUrlToLower = tolower(DestinationUrl)
  | project-rename GSANetworkAccessTraffic_TimeGenerated = TimeGenerated;
  let GSANetworkAccessTrafficUrls =
      GSANetworkAccessTraffic_
      | where isnotempty(DestinationUrl)
      | extend Url = tolower(DestinationUrl)
      | distinct Url;
  ThreatIntelIndicators
    | extend IndicatorType = replace(@'[\[\]"]', "", tostring(split(ObservableKey, ":", 0)))
    | where IndicatorType == "url"
    | extend Url = ObservableValue
    | extend TrafficLightProtocolLevel = tostring(parse_json(AdditionalFields).TLPLevel)
    | where TimeGenerated >= ago(ioc_lookBack)
    | extend Url = tolower(Url)
    | where Url in (GSANetworkAccessTrafficUrls)
    | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id, ObservableValue
    | where IsActive and (ValidUntil > now() or isempty(ValidUntil))
    | extend Description = tostring(parse_json(Data).description)
    | where Description !contains_cs "State: inactive;" and Description !contains_cs "State: falsepos;"
    | project-reorder *, Tags, TrafficLightProtocolLevel, Url, Type
    | join kind=innerunique (GSANetworkAccessTraffic_) on $left.Url == $right.DestinationUrlToLower
    | where isempty(ValidUntil) or GSANetworkAccessTraffic_TimeGenerated < ValidUntil
    | extend GSAThreatType = ThreatType
  | summarize GSANetworkAccessTraffic_TimeGenerated = arg_max(GSANetworkAccessTraffic_TimeGenerated, *) by Id, DestinationUrl
  | project-reorder *,
      Tags,
      Confidence,
      TrafficLightProtocolLevel,
      Type,
      UserPrincipalName,
      UserId,
      DeviceId,
      InitiatingProcessName,
      GSAThreatType,
      DestinationIp,
      DestinationFqdn,
      DestinationUrl,
      DestinationPort,
      SourceIp,
      SourcePort,
      HttpUserAgent
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: UserPrincipalName
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIp
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: DestinationUrl
  - entityType: Process
    fieldMappings:
      - identifier: CommandLine
        columnName: InitiatingProcessName
version: 1.0.1
kind: Scheduled

id: d5065600-617b-4a16-b58a-4a46da9c1afd
name: Guardian- Privacy Protection PII Policy Violation Detection
description: |
  'This alert creates an incident when  Privacy Protection PII Policy Violation detected from the Guardian'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: BoschAIShield
    dataTypes:
      - Guardian
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics: []
relevantTechniques: []
query: |
  Guardian
  | where PolicyViolatedControlFeature =~ 'PII Detection'
  | where Severity =~ 'High'
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: HostName
      - identifier: NTDomain
        columnName: NTDomain
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIP
eventGroupingSettings:
  aggregationKind: SingleAlert
alertDetailsOverride:
  alertDisplayNameFormat: Guardian-  Privacy Protection PII Policy Violation detection
  alertDescriptionFormat: |
    This query detects Privacy Protection PII Policy Violation detected from the Guardian generated at {{TimeGenerated}}.\n\nPlease check the source for more information and investigate further
  alertTacticsColumnName: null
  alertSeverityColumnName: Severity
version: 1.0.0
kind: Scheduled

id: 3edb7215-250b-40c0-8b46-79093949242d
name: High Number of Urgent Vulnerabilities Detected
description: |
  'This Creates an incident when a host has a high number of Urgent, severity 5, vulnerabilities detected.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: QualysVMLogsCCPDefinition
    dataTypes:
      - QualysHostDetection
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1190
query: |
  let threshold = 10;
  QualysHostDetection
  | where Severity == "5"
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by NetBios, IPAddress
  | where count_ >= threshold
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: NetBios
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPAddress
version: 1.0.3
kind: Scheduled

let extensions = datatable (Id:string, VulnVersion:string) [
    "nnpnnpemnckcfdebeekibpiijlicmpom", "2.0.1",
    "kkodiihpgodmdankclfibbiphjkfdenh", "1.16.2",
    "oaikpkmjciadfpddlpjjdapglcihgdle", "1.0.12",
    "dpggmcodlahmljkhlmpgpdcffdaoccni", "1.1.1",
    "acmfnomgphggonodopogfbmkneepfgnh", "4.00",
    "mnhffkhmpnefgklngfmlndmkimimbphc", "4.40",
    "cedgndijpacnfbdggppddacngjfdkaca", "0.0.11",
    "bbdnohkpnbkdkmnkddobeafboooinpla", "1.0.1",
    "egmennebgadmncfjafcemlecimkepcle", "2.2.7",
    "bibjgkidgpfbblifamdlkdlhgihmfohh", "0.1.3",
    "befflofjcniongenjmbkgkoljhgliihe", "2.13.0",
    "pkgciiiancapdlpcbppfkmeaieppikkk", "1.3.7",
    "llimhhconnjiflfimocjggfjdlmlhblm", "1.5.7",
    "oeiomhmbaapihbilkfkhmlajkeegnjhe", "3.18.0",
    "pajkjnmeojmbapicmbpliphjmcekeaac", "24.10.4",
    "ndlbedplllcgconngcnfmkadhokfaaln", "2.22.6",
    "epdjhgbipjpbbhoccdeipghoihibnfja", "1.4",
    "cplhlgabfijoiabgkigdafklbhhdkahj", "1.0.161",
    "jiofmdifioeejeilfkpegipdjiopiekl", "1.1.61",
    "hihblcmlaaademjlakdpicchbjnnnkbo", "3.0.2",
    "llimhhconnjiflfimocjggfjdlmlhblm", "1.5.7",
    "ekpkdmohpdnebfedjjfklhpefgpgaaji", "1.3",
    "epikoohpebngmakjinphfiagogjcnddm", "2.7.3",
    "miglaibdlgminlepgeifekifakochlka", "1.4.5",
    "eanofdhdfbcalhflpbdipkjjkoimeeod", "1.4.9",
    "ogbhbgkiojdollpjbhbamafmedkeockb", "1.8.1",
    "bgejafhieobnfpjlpcjjggoboebonfcg", "1.1.1",
    "igbodamhgjohafcenbcljfegbipdfjpk", "2.3",
    "mbindhfolmpijhodmgkloeeppmkhpmhc", "1.44",
    "hodiladlefdpcbemnbbcpclbmknkiaem", "3.1.3",
    "lbneaaedflankmgmfbmaplggbmjjmbae", "1.3.8",
    "eaijffijbobmnonfhilihbejadplhddo", "2.4",
    "hmiaoahjllhfgebflooeeefeiafpkfde", "1.0.0"
];
DeviceTvmBrowserExtensions
// Find devices using vulnerable extensions
| join kind=inner extensions on $left.ExtensionId == $right.Id
| extend IntVersion = parse_version(ExtensionVersion), IntVulnVursion = parse_version(VulnVersion)
| where IntVersion <= IntVulnVursion and IsActivated == "true"
// Join for more device info
| join kind=inner (
    DeviceInfo 
    | where Timestamp > ago(7d)
) on DeviceId
| distinct DeviceName, DeviceId, BrowserName, ExtensionName, ExtensionDescription, ExtensionVersion, ExtensionRisk, VulnVersion