Web shell command alert enrichment

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

Extracts MDATP Alerts that indicate a command was executed by a web shell. Uses time window based querying to idneitfy the potential web shell location on the server, then enriches with Attacker IP and User Agent

Attribute	Value
Type	Hunting Query
Solution	Standalone Content
ID	d2e6f31b-add1-4f44-b54d-1975a5605c1d
Tactics	PrivilegeEscalation, Persistence
Required Connectors	MicrosoftDefenderAdvancedThreatProtection, AzureMonitor(IIS)
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
SecurityAlert	✓	✗	?
W3CIISLog	✓	✗	?

Associated Connectors

The following connectors provide data for this content item:

Connector	Solution
AzureActiveDirectoryIdentityProtection	Microsoft Entra ID Protection
AzureAdvancedThreatProtection	Microsoft Defender for Identity
AzureSecurityCenter	Microsoft Defender for Cloud
ESI-Opt5ExchangeIISLogs	Microsoft Exchange Security - Exchange On-Premises
IoT	IoTOTThreatMonitoringwithDefenderforIoT
MicrosoftCloudAppSecurity	Microsoft Defender for Cloud Apps
MicrosoftDefenderAdvancedThreatProtection	MicrosoftDefenderForEndpoint
MicrosoftDefenderForCloudTenantBased	Microsoft Defender for Cloud
OfficeATP	Microsoft Defender for Office 365
OfficeIRM	MicrosoftPurviewInsiderRiskManagement

Solutions: IoTOTThreatMonitoringwithDefenderforIoT, Microsoft Defender for Cloud, Microsoft Defender for Cloud Apps, Microsoft Defender for Identity, Microsoft Defender for Office 365, Microsoft Entra ID Protection, Microsoft Exchange Security - Exchange On-Premises, MicrosoftDefenderForEndpoint, MicrosoftPurviewInsiderRiskManagement

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Hunting Queries