Detection rules › Kusto
Cynerio - Suspicious Connection to External Address
Suspicious Connection to External Address
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T0866 Exploitation of Remote Services |
| Lateral Movement | T0866 Exploitation of Remote Services |
Rule body kusto
id: c0756978-baa6-4239-9174-bac1b1ca1a6a
name: Cynerio - Suspicious Connection to External Address
description: Suspicious Connection to External Address
severity: High
requiredDataConnectors:
- connectorId: CynerioSecurityEvents
dataTypes:
- CynerioEvent_CL
queryFrequency: 5h
queryPeriod: 5h
triggerOperator: gt
triggerThreshold: 0
tactics:
- LateralMovement
relevantTechniques:
- T0866
query: |
CynerioEvent_CL
| where TimeGenerated > ago(24h)
| where module_s == 'IDS'
| where title_s == 'Suspicious Connection'
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: asset_ip_s
eventGroupingSettings:
aggregationKind: SingleAlert
customDetails:
Hostname: host_s
DstIP: dst_ip_s
version: 1.0.0
kind: Scheduled
Stages and Predicates
Stage 1: source
CynerioEvent_CL
Stage 2: where
| where TimeGenerated > ago(24h)
Stage 3: where
| where module_s == 'IDS'
Stage 4: where
| where title_s == 'Suspicious Connection'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.