Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
Identifies a match across various data feeds for domains, hashes and IP IOC related to Mercury Reference: https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/
| Attribute | Value |
|---|---|
| Type | Analytic Rule |
| Solution | Standalone Content |
| ID | ae10c588-7ff7-486c-9920-ab8b0bdb6ede |
| Severity | High |
| Kind | Scheduled |
| Tactics | CommandAndControl |
| Techniques | T1071 |
| Required Connectors | DNS, AzureMonitor(VMInsights), F5, CiscoASA, PaloAltoNetworks, Fortinet, CheckPoint, CEF, MicrosoftThreatProtection, Office365, AzureFirewall, WindowsFirewall |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
AZFWApplicationRule |
✓ | ✗ | ✓ | |
AZFWDnsQuery |
✓ | ✗ | ✓ | |
AZFWNetworkRule |
✓ | ✗ | ✓ | |
AzureDiagnostics 🔶 |
✗ | ✗ | ✗ | |
CommonSecurityLog |
✓ | ✓ | ✓ | |
DeviceFileEvents |
✓ | ✗ | ✓ | |
DeviceImageLoadEvents |
✓ | ✗ | ✓ | |
DeviceNetworkEvents |
✓ | ✗ | ✓ | |
DnsEvents |
✓ | ✗ | ✓ | |
Event |
✓ | ✓ | ✗ | |
OfficeActivity |
✓ | ✗ | ✓ | |
VMConnection |
✗ | ✗ | ✗ | |
WindowsFirewall |
✓ | ✗ | ✓ |
The following connectors provide data for this content item:
Solutions: Common Event Format, VirtualMetric DataStream, Windows Firewall, Windows Server DNS
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊