detection.wiki

Detection rules › Kusto

Cyble Vision Alerts Compromised Files

This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.

Status
available
Severity
low
Time window
30m
Source
github.com/Azure/Azure-Sentinel

'Detects compromised files containing credential or logon data (stealer logs) related to monitored entities. Uses Alerts_compromised_files parser to expose file paths, log objects, and extracted email identifiers.'

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1552 Unsecured Credentials
ExfiltrationT1041 Exfiltration Over C2 Channel

Rule body kusto

id: 0f6a8287-09ee-4f82-b8c3-e35c4ac6212e
name: Cyble Vision Alerts Compromised Files
description: |
  'Detects compromised files containing credential or logon data (stealer logs) related to monitored entities. Uses Alerts_compromised_files parser to expose file paths, log objects, and extracted email identifiers.'
severity: Low
status: Available
requiredDataConnectors:
- connectorId: CybleVisionAlerts
  dataTypes:
  - CybleVisionAlerts_CL
enabled: true
queryfrequency: 30m
queryPeriod: 30m
triggerOperator: GreaterThan
triggerThreshold: 0
eventGroupingSettings:
  aggregationKind: AlertPerResult
tactics:
- CredentialAccess
- Exfiltration
relevantTechniques:
- T1552
- T1041
query: |
  Alerts_compromised_files  
  | where Service == "compromised_files" 
  | extend MappedSeverity = Severity
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
alertDetailsOverride:
  alertDisplayNameFormat: Compromised Credentials File {{CF_Filename}}
  alertDescriptionFormat: |
    A compromised file containing potential credential or logon data was discovered. Relative path {{CF_RelativePath}}. Log object path {{CF_LogObjPath}}. Primary email (if found) {{CF_PrimaryEmail}}.
customDetails:
  MappedSeverity: Severity
  Status: Status
  AlertID: AlertID
  Service: Service
  CF_Filename: CF_Filename
  CF_FileObjPath: CF_FileObjPath
  CF_LogObjPath: CF_LogObjPath
  CF_PrimaryEmail: CF_PrimaryEmail
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: CF_PrimaryEmail
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: source

Alerts_compromised_files

Stage 2: where

| where Service == "compromised_files"

Stage 3: extend

| extend MappedSeverity = Severity

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Serviceeq
  • compromised_files transforms: cased

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
MappedSeverityextend