Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
Matches domain name IOCs related to Forest Blizzard group activity published July 2019 with CommonSecurityLog, DnsEvents and VMConnection dataTypes. References: https://blogs.microsoft.com/on-the-issues/2019/07/17/new-cyberthreats-require-new-ways-to-protect-democracy/.
| Attribute | Value |
|---|---|
| Type | Analytic Rule |
| Solution | Standalone Content |
| ID | 074ce265-f684-41cd-af07-613c5f3e6d0d |
| Severity | High |
| Kind | Scheduled |
| Tactics | CommandAndControl |
| Techniques | T1071 |
| Required Connectors | DNS, AzureMonitor(VMInsights), CiscoASA, PaloAltoNetworks, AzureFirewall, Zscaler, InfobloxNIOS, GCPDNSDataConnector, NXLogDnsLogs, CiscoUmbrellaDataConnector, Corelight |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
AZFWApplicationRule |
✓ | ✗ | ✓ |
AZFWDnsQuery |
✓ | ✗ | ✓ |
AzureDiagnostics 🔶 |
✗ | ✗ | ✗ |
CommonSecurityLog |
✓ | ✓ | ✓ |
VMConnection |
✗ | ✗ | ✗ |
The following connectors provide data for this content item:
Solutions: Common Event Format, VirtualMetric DataStream
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊