CYFIRMA - High severity File Hash Indicators with Block Action and Malware

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

This KQL query retrieves file hash indicators (MD5, SHA1, SHA256) from the CyfirmaIndicators_CL table within the last 5 minutes. It filters records with a confidence score of 80 or higher, containing file hash patterns, a recommended action of 'Block', and roles marked as 'Malware'. Extracted hashes and key threat intelligence details are projected for Blocking and investigation.

Attribute	Value
Type	Analytic Rule
Solution	Cyfirma Cyber Intelligence
ID	`990fc0dc-e7a5-4f6d-bc24-8569652cd773`
Severity	High
Kind	Scheduled
Tactics	InitialAccess, Execution, Persistence, PrivilegeEscalation, DefenseEvasion, CredentialAccess, Discovery, LateralMovement, Collection, Impact
Techniques	T1566, T1203, T1059, T1204, T1547, T1053, T1055, T1027, T1562, T1036, T1003, T1555, T1082, T1057, T1021, T1113, T1486, T1566.001, T1059.001, T1059.003, T1547.001, T1053.005, T1562.001, T1003.001, T1555.003, T1021.002
Required Connectors	CyfirmaCyberIntelligenceDC
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
`CyfirmaIndicators_CL`	?	✓	?

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Analytic Rules · Back to Cyfirma Cyber Intelligence