detection.wiki

Detection rules › Kusto

Cynerio - Suspicious Connection to External Address

Severity
high
Time window
5h
Source
github.com/Azure/Azure-Sentinel

Suspicious Connection to External Address

MITRE ATT&CK coverage

TacticTechniques
Initial Access
Lateral Movement

Rule body

id: c0756978-baa6-4239-9174-bac1b1ca1a6a
name: Cynerio - Suspicious Connection to External Address
description: Suspicious Connection to External Address
severity: High
requiredDataConnectors:
  - connectorId: CynerioSecurityEvents
    dataTypes:
      - CynerioEvent_CL
queryFrequency: 5h
queryPeriod: 5h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - LateralMovement
relevantTechniques:
  - T0866
query: |
  CynerioEvent_CL
  | where TimeGenerated > ago(24h)
  | where module_s == 'IDS'
  | where title_s == 'Suspicious Connection'
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: asset_ip_s
eventGroupingSettings:
  aggregationKind: SingleAlert
customDetails: 
  Hostname: host_s
  DstIP: dst_ip_s
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: source

CynerioEvent_CL

Stage 2: where

| where TimeGenerated > ago(24h)

Stage 3: where

| where module_s == 'IDS'

Stage 4: where

| where title_s == 'Suspicious Connection'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
module_seq
  • IDS
field:"module_s" kind:eq value:"IDS"
title_seq
  • Suspicious Connection
field:"title_s" kind:eq value:"Suspicious Connection"