Detection rules › Kusto

Contrast ADR - Exploited Attack Event

This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.

Status: available
Severity: high
Time window: 5m
Source: github.com/Azure/Azure-Sentinel

'Detects successful exploitation of security vulnerabilities across all environments as identified by Contrast ADR. This rule captures confirmed exploited attacks that bypassed application security controls and require security team investigation.'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application
Execution	`T1059` Command and Scripting Interpreter
Stealth	`T1055` Process Injection
Lateral Movement	`T1210` Exploitation of Remote Services
Command & Control	`T1008` Fallback Channels

Rule body

id: ae4f67a6-0713-4a26-ae61-284e67b408c1
name: Contrast ADR - Exploited Attack Event
description: |
  'Detects successful exploitation of security vulnerabilities across all environments as identified by Contrast ADR. This rule captures confirmed exploited attacks that bypassed application security controls and require security team investigation.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: ContrastADRCCF
    dataTypes:
      - ContrastADRAttackEvents_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - Execution
  - DefenseEvasion
  - LateralMovement
  - CommandAndControl
relevantTechniques:
  - T1190
  - T1059
  - T1055
  - T1210
  - T1008
query: |
  ContrastADRAttackEvents_CL
  | where result =~ "exploited"
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: sourceIp
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: host_hostname
alertDetailsOverride:
  alertDisplayNameFormat: '{{result}} {{rule}} from {{sourceIp}} '
  alertDescriptionFormat: '{{result}}  on {{request_headers_referer}}  endpoint of {{application_name}} '
customDetails:
  AttackResult: result
  AttackRule: rule
  ApplicationName: application_name
  AttackedEndpoint: request_headers_referer
  Environment: environment
  TargetHost: host_hostname
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: PT1H
    matchingMethod: Selected
    groupByEntities:
      - IP
      - Host
eventGroupingSettings:
  aggregationKind: AlertPerResult
kind: Scheduled
version: 1.0.1

Stages and Predicates

Stage 1: `source`

ContrastADRAttackEvents_CL

Stage 2: `where`

| where result =~ "exploited"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`result`	eq	`exploited`	`field:"result" kind:eq value:"exploited"`