sentinel-integration/Solutions/Flare/Analytic Rules/FlarePaste.yaml at c94d464f8c3401e1354ea36d9e39a65830cf4226 · Flared/sentinel-integration · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
id: 9cb7c337-f177-4af6-b0e8-b6b7552d762d
name: Flare Paste result
description: |
    'Result found on code Snippet (paste) sharing platform'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: Flare
    dataTypes:
      - Firework_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Reconnaissance
relevantTechniques:
  - T1593
query: |
  Firework_CL
  | extend source = column_ifexists("source_s", "")
  | extend risk_score = column_ifexists("risk_score_d", 0.0)
  | where source in ("gist_github", "Pastebin", "driller_stackexchange")
  | where risk_score >= 3
version: 1.0.2
kind: Scheduled