40 строки
1.3 KiB
YAML
40 строки
1.3 KiB
YAML
id: 9649e203-3cb7-47ff-89a9-42f2a5eefe31
|
|
name: Alsid Active Directory attacks pathways
|
|
description: |
|
|
'Searches for triggered Indicators of Exposures related to Active Directory attacks pathways'
|
|
severity: Low
|
|
requiredDataConnectors:
|
|
- connectorId: AlsidForAD
|
|
dataTypes:
|
|
- AlsidForADLog_CL
|
|
queryFrequency: 2h
|
|
queryPeriod: 2h
|
|
triggerOperator: gt
|
|
triggerThreshold: 0
|
|
status: Available
|
|
tactics:
|
|
- CredentialAccess
|
|
relevantTechniques:
|
|
- T1110
|
|
query: |
|
|
let SeverityTable=datatable(Severity:string,Level:int) [
|
|
"low", 1,
|
|
"medium", 2,
|
|
"high", 3,
|
|
"critical", 4
|
|
];
|
|
let codeNameList = datatable(Codename:string)["C-PRIV-ACCOUNTS-SPN", "C-SDPROP-CONSISTENCY", "C-DANG-PRIMGROUPID", "C-GPO-HARDENING", "C-DC-ACCESS-CONSISTENCY", "C-DANGEROUS-TRUST-RELATIONSHIP", "C-UNCONST-DELEG", "C-ABNORMAL-ENTRIES-IN-SCHEMA"];
|
|
afad_parser
|
|
| where MessageType == 0 and Codename in~ (codeNameList)
|
|
| lookup kind=leftouter SeverityTable on Severity
|
|
| order by Level
|
|
| extend HostName = tostring(split(Host, '.', 0)[0]), DnsDomain = tostring(strcat_array(array_slice(split(Host, '.'), 1, -1), '.'))
|
|
entityMappings:
|
|
- entityType: Host
|
|
fieldMappings:
|
|
- identifier: HostName
|
|
columnName: HostName
|
|
- identifier: DnsDomain
|
|
columnName: DnsDomain
|
|
version: 1.0.1
|
|
kind: Scheduled |