Detection rules › Kusto
Cynerio - Exploitation Attempt of IoT device
Exploitation Attempt of IoT device - Attack detection
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T0866 Exploitation of Remote Services |
| Lateral Movement | T0866 Exploitation of Remote Services |
Rule body kusto
id: 3d853a88-92d2-4aec-a680-2bf7bb560c56
name: Cynerio - Exploitation Attempt of IoT device
description: Exploitation Attempt of IoT device - Attack detection
severity: High
requiredDataConnectors:
- connectorId: CynerioSecurityEvents
dataTypes:
- CynerioEvent_CL
queryFrequency: 5h
queryPeriod: 5h
triggerOperator: gt
triggerThreshold: 0
tactics:
- LateralMovement
relevantTechniques:
- T0866
query: |
CynerioEvent_CL
| where TimeGenerated > ago(24h)
| where module_s == 'IDS'
| where title_s == 'Exploitation Attempt'
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: asset_ip_s
- entityType: IP
fieldMappings:
- identifier: Address
columnName: dst_ip_s
eventGroupingSettings:
aggregationKind: SingleAlert
customDetails:
ExploitDescription: details_s
version: 1.0.0
kind: Scheduled
Stages and Predicates
Stage 1: source
CynerioEvent_CL
Stage 2: where
| where TimeGenerated > ago(24h)
Stage 3: where
| where module_s == 'IDS'
Stage 4: where
| where title_s == 'Exploitation Attempt'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.