detection.wiki

Detection rules › Kusto

ARGOS Cloud Security - Exploitable Cloud Resources

This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.

Status
available
Severity
high
Time window
1h
Source
github.com/Azure/Azure-Sentinel

Exploitable Cloud Security Issues are ones that expose cloud resources to the internet and allow initial access to your environment.

MITRE ATT&CK coverage

TacticTechniques
Initial AccessT1190 Exploit Public-Facing Application

Rule body kusto

id: a9bf1b8c-c761-4840-b9a8-7535ca68ca28
name: ARGOS Cloud Security - Exploitable Cloud Resources
description: Exploitable Cloud Security Issues are ones that expose cloud resources to the internet and allow initial access to your environment.
requiredDataConnectors:
  - connectorId: ARGOSCloudSecurity
    dataTypes:
      - ARGOS_CL
kind: Scheduled
severity: High
status: Available
query: |
  ARGOS_CL | where exploitable_b
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
suppressionDuration: PT5H
suppressionEnabled: false
tactics:
  - InitialAccess
relevantTechniques:
  - T1190
alertRuleTemplateName:
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: New exploitable cloud resource - {{name_s}} - {{ruleId_s}}
customDetails:
entityMappings:
- entityType: AzureResource
  fieldMappings:
  - identifier: ResourceId
    columnName: ResourceId
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: url_s
version: 1.0.3

Stages and Predicates

Stage 1: source

ARGOS_CL

Stage 2: where

| where exploitable_b