Detection rules › Kusto

Contrast ADR - Exploited Attack in Production

This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.

Status: available
Severity: high
Time window: 5m
Source: github.com/Azure/Azure-Sentinel

'Detects successful exploitation of security vulnerabilities in production environments as identified by Contrast ADR. This rule triggers on confirmed exploited attacks in production systems, requiring immediate incident response and remediation.'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application
Execution	`T1059` Command and Scripting Interpreter
Stealth	`T1055` Process Injection
Lateral Movement	`T1210` Exploitation of Remote Services
Command & Control	`T1008` Fallback Channels

Rule body

id: 31417149-f3a2-4db4-9e5f-85e0a464f6a1
name: Contrast ADR - Exploited Attack in Production
description: |
  'Detects successful exploitation of security vulnerabilities in production environments as identified by Contrast ADR. This rule triggers on confirmed exploited attacks in production systems, requiring immediate incident response and remediation.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: ContrastADRCCF
    dataTypes:
      - ContrastADRAttackEvents_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - Execution
  - DefenseEvasion
  - LateralMovement
  - CommandAndControl
relevantTechniques:
  - T1190
  - T1059
  - T1055
  - T1210
  - T1008
query: |
  ContrastADRAttackEvents_CL
  | where result =~ "exploited" and environment =~ "production"
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: sourceIp
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: host_hostname
alertDetailsOverride:
  alertDisplayNameFormat: '{{result}} {{rule}} from {{sourceIp}} in Production'
  alertDescriptionFormat: '{{result}}  on {{request_headers_referer}}  endpoint of {{application_name}} '
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: PT30M
    matchingMethod: Selected
    groupByEntities:
      - IP
      - Host
eventGroupingSettings:
  aggregationKind: AlertPerResult
kind: Scheduled
version: 1.0.1

Stages and Predicates

Stage 1: `source`

ContrastADRAttackEvents_CL

Stage 2: `where`

| where result =~ "exploited" and environment =~ "production"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`environment`	eq	`production`	`field:"environment" kind:eq value:"production"`
`result`	eq	`exploited`	`field:"result" kind:eq value:"exploited"`