This commit is contained in:
Pete Bryan 2021-03-07 17:16:27 -08:00
Родитель 2f571bab92
Коммит 6f5b8b28a5
2 изменённых файлов: 5 добавлений и 4 удалений

Просмотреть файл

@ -1,7 +1,8 @@
id: d804b39c-03a4-417c-a949-bdbf21fa3305
name: Exchange Server Vulnerabilities March 2021 IoCs
name: Exchange Server Vulnerabilities Disclosed March 2021 IoC Match
description: |
'This detection look for IoCs shared by Microsoft relating to attacks exploiting the Exchange Server vulnerabilities disclosed in March 2021. It looks for SHA256 file hashes, IP addresses and file paths in a number of data sources. This query can also be customized with additional data sources that may include these elements.'
'This detection look for IoCs shared by Microsoft relating to attacks exploiting the Exchange Server vulnerabilities disclosed in March 2021. It looks for SHA256 file hashes, IP addresses and file paths in a number of data sources. This query can also be customized with additional data sources that may include these elements.
Ref: https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server/'
severity: Medium
requiredDataConnectors:
- connectorId: AzureMonitor(IIS)
@ -43,8 +44,8 @@ tactics:
relevantTechniques:
- T1190
query: |
let iocs = externaldata(FirstSeen:string,IoC:string,Type:string,TLP:string,Release:string)
[@"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilities-March2021.json"] with (format="json");
let iocs = externaldata(DateAdded:string,FirstSeen:string,IoC:string,Type:string,TLP:string,Release:string)
[@"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilities-March2021.jsonl"] with (format="json");
let file_paths = (iocs | where Type =~ "FilePath");
let sha256s = (iocs | where Type =~ "SHA256");
let ips = (iocs | where Type =~ "IP");