33 строки
960 B
YAML
Executable File
33 строки
960 B
YAML
Executable File
id: 75491db8-eaf7-40bb-a46a-279872cc82f5
|
|
name: Google DNS - Malicous Python packages
|
|
description: |
|
|
'Detects requests to resources with malicious Python packages.'
|
|
severity: High
|
|
requiredDataConnectors:
|
|
- connectorId: GCPDNSDataConnector
|
|
dataTypes:
|
|
- GCPCloudDNS
|
|
queryFrequency: 15m
|
|
queryPeriod: 15m
|
|
triggerOperator: gt
|
|
triggerThreshold: 0
|
|
tactics:
|
|
- InitialAccess
|
|
relevantTechniques:
|
|
- T1195
|
|
query: |
|
|
GCPCloudDNS
|
|
| where Query has_any ('psec.forward.io.global.prod.fastly.net', 'b0a0374cd1cb4305002e.d.requestbin.net', 'tornadodomain.000webhostapp.com', 'yxznlysc47wvrb9r9z211e1jbah15q')
|
|
| extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr
|
|
entityMappings:
|
|
- entityType: DNS
|
|
fieldMappings:
|
|
- identifier: DomainName
|
|
columnName: DNSCustomEntity
|
|
- entityType: IP
|
|
fieldMappings:
|
|
- identifier: Address
|
|
columnName: IPCustomEntity
|
|
version: 1.0.0
|
|
kind: Scheduled
|