Radiflow - Exploit Detected

Status: available
Severity: high
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

'Generates an incident when the use of an exploit is detected by Radiflow's iSID.'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T0819` Exploit Public-Facing Application `T0866` Exploitation of Remote Services
Privilege Escalation	`T0890` Exploitation for Privilege Escalation
Lateral Movement	`T0866` Exploitation of Remote Services

Rule body

id: 6c028ebd-03ca-41cb-bce7-5727ddb43731
name: Radiflow - Exploit Detected
description: |
  'Generates an incident when the use of an exploit is detected by Radiflow's iSID.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: RadiflowIsid
    dataTypes:
      - RadiflowEvent
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
- PrivilegeEscalation
- LateralMovement
relevantTechniques:
- T0819
- T0866
- T0890
query: |
  RadiflowEvent
  | where DeviceProduct =~ 'iSID'
  | where
      (
          EventClassID in (34, 53, 67, 68, 69, 70, 71, 179)
          or EventMessage has 'Exploit'
      )
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1h
    matchingMethod: AllEntities
    groupByEntities: []
    groupByAlertDetails: []
    groupByCustomDetails: []
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: 'Exploit Detected: {{EventMessage}}'
  alertDescriptionFormat: "A possible exploit attempt has been detected. Check the details of this incident for further information.\n\nMessage: {{EventMessage}}\nSource device: {{SourceIP}} \nDestination device (if any): {{DestinationIP}} "
  alertSeverityColumnName: EventSeverity
  alertDynamicProperties: []
suppressionEnabled: false
suppressionDuration: 5h
customDetails:
  SourceMAC: SourceMACAddress
  SourceType: SourceType
  SourceVendor: SourceVendor
  SourceVLAN: SourceVLAN
  DestinationMAC: DestinationMACAddress
  DestinationType: DestinationType
  DestinationVendor: DestinationVendor
  Port: Port
  Protocol: Protocol
  SourceHostName: SourceHostName
  SourceIP: SourceIP
  DestinationHostName: DestinationHostName
  DestinationIP: DestinationIP
entityMappings:
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: SourceHostName
  - identifier: NetBiosName
    columnName: SourceHostName
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: DestinationHostName
  - identifier: NetBiosName
    columnName: DestinationHostName
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SourceIP
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: DestinationIP
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

RadiflowEvent

Stage 2: `where`

| where DeviceProduct =~ 'iSID'

Stage 3: `where`

| where
    (
        EventClassID in (34, 53, 67, 68, 69, 70, 71, 179)
        or EventMessage has 'Exploit'
    )

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`DeviceProduct`	eq	`iSID`	`field:"DeviceProduct" kind:eq value:"iSID"`
`EventClassID`	in	`179` `34` `53` `67` `68` `69` `70` `71`	`field:"EventClassID" kind:in`
`EventMessage`	match	`Exploit` transforms: `term`	`field:"EventMessage" kind:match value:"Exploit"`

Radiflow - Exploit Detected

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Indicators

Stage 1: `source`

Stage 2: `where`

Stage 3: `where`