Europium - Hash and IP IOCs - September 2022

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

Identifies a match across various data feeds for hashes and IP IOC related to Europium Reference: https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government

Attribute	Value
Type	Analytic Rule
Solution	Standalone Content
ID	9d8b5a18-b7db-4c23-84a6-95febaf7e1e4
Severity	High
Kind	Scheduled
Tactics	CommandAndControl, CredentialAccess
Techniques	T1071, T1003
Required Connectors	DNS, AzureMonitor(VMInsights), F5, CiscoASA, PaloAltoNetworks, Fortinet, CheckPoint, CEF, MicrosoftThreatProtection, Office365, AzureFirewall, WindowsFirewall
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
CommonSecurityLog	✓	✓	✓
DeviceFileEvents	✓	✗	✓
DeviceImageLoadEvents	✓	✗	✓
DeviceNetworkEvents	✓	✗	✓
DnsEvents	✓	✗	✓
Event	✓	✓	✗
OfficeActivity	✓	✗	✓
VMConnection	✗	✗	✗
WindowsFirewall	✓	✗	✓

Associated Connectors

The following connectors provide data for this content item:

Connector	Solution
CefAma	Common Event Format
DNS	Windows Server DNS
VirtualMetricDirectorProxy	VirtualMetric DataStream
VirtualMetricMSSentinelConnector	VirtualMetric DataStream
VirtualMetricMSSentinelDataLakeConnector	VirtualMetric DataStream
WindowsFirewall	Windows Firewall

Solutions: Common Event Format, VirtualMetric DataStream, Windows Firewall, Windows Server DNS

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Analytic Rules