schema and naming updates
This commit is contained in:
Родитель
2f571bab92
Коммит
6f5b8b28a5
|
@ -1,7 +1,8 @@
|
|||
id: d804b39c-03a4-417c-a949-bdbf21fa3305
|
||||
name: Exchange Server Vulnerabilities March 2021 IoCs
|
||||
name: Exchange Server Vulnerabilities Disclosed March 2021 IoC Match
|
||||
description: |
|
||||
'This detection look for IoCs shared by Microsoft relating to attacks exploiting the Exchange Server vulnerabilities disclosed in March 2021. It looks for SHA256 file hashes, IP addresses and file paths in a number of data sources. This query can also be customized with additional data sources that may include these elements.'
|
||||
'This detection look for IoCs shared by Microsoft relating to attacks exploiting the Exchange Server vulnerabilities disclosed in March 2021. It looks for SHA256 file hashes, IP addresses and file paths in a number of data sources. This query can also be customized with additional data sources that may include these elements.
|
||||
Ref: https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server/'
|
||||
severity: Medium
|
||||
requiredDataConnectors:
|
||||
- connectorId: AzureMonitor(IIS)
|
||||
|
@ -43,8 +44,8 @@ tactics:
|
|||
relevantTechniques:
|
||||
- T1190
|
||||
query: |
|
||||
let iocs = externaldata(FirstSeen:string,IoC:string,Type:string,TLP:string,Release:string)
|
||||
[@"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilities-March2021.json"] with (format="json");
|
||||
let iocs = externaldata(DateAdded:string,FirstSeen:string,IoC:string,Type:string,TLP:string,Release:string)
|
||||
[@"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilities-March2021.jsonl"] with (format="json");
|
||||
let file_paths = (iocs | where Type =~ "FilePath");
|
||||
let sha256s = (iocs | where Type =~ "SHA256");
|
||||
let ips = (iocs | where Type =~ "IP");
|
||||
|
|
Загрузка…
Ссылка в новой задаче