Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
Identifies a match across various data feeds for hashes and IP IOC related to Europium Reference: https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government
| Attribute | Value |
|---|---|
| Type | Analytic Rule |
| Solution | Standalone Content |
| ID | 9d8b5a18-b7db-4c23-84a6-95febaf7e1e4 |
| Severity | High |
| Kind | Scheduled |
| Tactics | CommandAndControl, CredentialAccess |
| Techniques | T1071, T1003 |
| Required Connectors | DNS, AzureMonitor(VMInsights), F5, CiscoASA, PaloAltoNetworks, Fortinet, CheckPoint, CEF, MicrosoftThreatProtection, Office365, AzureFirewall, WindowsFirewall |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
CommonSecurityLog |
✓ | ✓ | ? |
DeviceFileEvents |
✓ | ✗ | ? |
DeviceImageLoadEvents |
✓ | ✗ | ? |
DeviceNetworkEvents |
✓ | ✗ | ? |
DnsEvents |
✓ | ✗ | ? |
Event |
✓ | ✓ | ? |
OfficeActivity |
✓ | ✗ | ? |
VMConnection |
? | ✗ | ? |
WindowsFirewall |
✓ | ✗ | ? |
The following connectors provide data for this content item:
Solutions: Common Event Format, VirtualMetric DataStream, Windows Firewall, Windows Server DNS, Zscaler Internet Access
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊