Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
Identifies a match across various data feeds for domains, hashes and IP IOC related to Mercury Reference: https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/
| Attribute | Value |
|---|---|
| Type | Analytic Rule |
| Solution | Standalone Content |
| ID | ae10c588-7ff7-486c-9920-ab8b0bdb6ede |
| Severity | High |
| Kind | Scheduled |
| Tactics | CommandAndControl |
| Techniques | T1071 |
| Required Connectors | DNS, AzureMonitor(VMInsights), F5, CiscoASA, PaloAltoNetworks, Fortinet, CheckPoint, CEF, MicrosoftThreatProtection, Office365, AzureFirewall, WindowsFirewall |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
AZFWApplicationRule |
✓ | ✗ | ? |
AZFWDnsQuery |
✓ | ✗ | ? |
AZFWNetworkRule |
✓ | ✗ | ? |
AzureDiagnostics 🔶 |
? | ✗ | ? |
CommonSecurityLog |
✓ | ✓ | ? |
DeviceFileEvents |
✓ | ✗ | ? |
DeviceImageLoadEvents |
✓ | ✗ | ? |
DeviceNetworkEvents |
✓ | ✗ | ? |
DnsEvents |
✓ | ✗ | ? |
Event |
✓ | ✓ | ? |
OfficeActivity |
✓ | ✗ | ? |
VMConnection |
? | ✗ | ? |
WindowsFirewall |
✓ | ✗ | ? |
The following connectors provide data for this content item:
Solutions: Common Event Format, VirtualMetric DataStream, Windows Firewall, Windows Server DNS, Zscaler Internet Access
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊