AIShield - Image classification AI Model extraction high suspicious vulnerability detection

Status: available
Severity: high
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

'This alert creates an incident when Image classification AI Model extraction high suspicious, high severity vulnerability detected from the AIShield.'

Rule body

id: b4cc5396-2a34-45f5-a726-860e476edf15
name: AIShield - Image classification AI Model extraction high suspicious vulnerability detection
description: |
  'This alert creates an incident when Image classification AI Model extraction high suspicious, high severity vulnerability detected from the AIShield.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: BoschAIShield
    dataTypes:
      - AIShield
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics: []
relevantTechniques: []
query: |
  AIShield
  | where Message has 'Image Classification AI Model Extraction Attack Identified'
  | where Severity =~ 'High'
  | where SuspiciousLevel =~ 'high suspicious attack'
  | extend NTDomain = tostring(split(Computer, '\\')[0]), HostName = tostring(split(Computer, '.')[0])
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: HostName
      - identifier: NTDomain
        columnName: NTDomain
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceName
eventGroupingSettings:
  aggregationKind: SingleAlert
alertDetailsOverride:
  alertDisplayNameFormat: AIShield - Image Classification AI Model extraction high suspicious vulnerability detected.
  alertDescriptionFormat: |
    This query detects Image Classification AI Model extraction high suspicious, high severity alert from AIShield generated at {{TimeGenerated}}.\n\nPlease check the source for more information and investigate further.
  alertTacticsColumnName: null
  alertSeverityColumnName: Severity
version: 1.0.4
kind: Scheduled

Stages and Predicates

Stage 1: `source`

AIShield

Stage 2: `where`

| where Message has 'Image Classification AI Model Extraction Attack Identified'

Stage 3: `where`

| where Severity =~ 'High'

Stage 4: `where`

| where SuspiciousLevel =~ 'high suspicious attack'

Stage 5: `extend`

| extend NTDomain = tostring(split(Computer, '\\')[0]), HostName = tostring(split(Computer, '.')[0])

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Message`	match	`Image Classification AI Model Extraction Attack Identified` transforms: `term`	`field:"Message" kind:match value:"Image Classification AI Model Extraction Attack Identified"`
`Severity`	eq	`High`	`field:"Severity" kind:eq value:"High"`
`SuspiciousLevel`	eq	`high suspicious attack`	`field:"SuspiciousLevel" kind:eq value:"high suspicious attack"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`HostName`	`extend`
`NTDomain`	`extend`

AIShield - Image classification AI Model extraction high suspicious vulnerability detection

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where