detection.wiki

Detection rules › Kusto

Contrast ADR - Exploited Attack Event

This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.

Status
available
Severity
high
Time window
5m
Source
github.com/Azure/Azure-Sentinel

'Detects successful exploitation of security vulnerabilities across all environments as identified by Contrast ADR. This rule captures confirmed exploited attacks that bypassed application security controls and require security team investigation.'

MITRE ATT&CK coverage

TacticTechniques
Initial AccessT1190 Exploit Public-Facing Application
ExecutionT1059 Command and Scripting Interpreter
StealthT1055 Process Injection
Lateral MovementT1210 Exploitation of Remote Services
Command & ControlT1008 Fallback Channels

Rule body kusto

id: ae4f67a6-0713-4a26-ae61-284e67b408c1
name: Contrast ADR - Exploited Attack Event
description: |
  'Detects successful exploitation of security vulnerabilities across all environments as identified by Contrast ADR. This rule captures confirmed exploited attacks that bypassed application security controls and require security team investigation.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: ContrastADRCCF
    dataTypes:
      - ContrastADRAttackEvents_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - Execution
  - DefenseEvasion
  - LateralMovement
  - CommandAndControl
relevantTechniques:
  - T1190
  - T1059
  - T1055
  - T1210
  - T1008
query: |
  ContrastADRAttackEvents_CL
  | where result =~ "exploited"
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: sourceIp
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: host_hostname
alertDetailsOverride:
  alertDisplayNameFormat: '{{result}} {{rule}} from {{sourceIp}} '
  alertDescriptionFormat: '{{result}}  on {{request_headers_referer}}  endpoint of {{application_name}} '
customDetails:
  AttackResult: result
  AttackRule: rule
  ApplicationName: application_name
  AttackedEndpoint: request_headers_referer
  Environment: environment
  TargetHost: host_hostname
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: PT1H
    matchingMethod: Selected
    groupByEntities:
      - IP
      - Host
eventGroupingSettings:
  aggregationKind: AlertPerResult
kind: Scheduled
version: 1.0.1

Stages and Predicates

Stage 1: source

ContrastADRAttackEvents_CL

Stage 2: where

| where result =~ "exploited"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
resulteq
  • exploited