IoTExploitationAttempts.yaml

id: 3d853a88-92d2-4aec-a680-2bf7bb560c56
name: Cynerio - Exploitation Attempt of IoT device
description:  Exploitation Attempt of IoT device - Attack detection
severity: High
requiredDataConnectors:
  - connectorId: CynerioSecurityEvents
    dataTypes:
      - CynerioEvent_CL
queryFrequency: 5h
queryPeriod: 5h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - LateralMovement
relevantTechniques:
  - T0866
query: |
  CynerioEvent_CL
  | where TimeGenerated > ago(24h)
  | where module_s == 'IDS'
  | where title_s == 'Exploitation Attempt'
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: asset_ip_s
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: dst_ip_s
eventGroupingSettings:
  aggregationKind: SingleAlert
customDetails: 
  ExploitDescription: details_s
version: 1.0.0
kind: Scheduled