GTI - Critical CVSS Score Vulnerability Detected

Status: available
Severity: high
Time window: 10m
Source: github.com/Azure/Azure-Sentinel

Detects vulnerabilities ingested from Google Threat Intelligence with a CVSS v3 base score at or above the critical threshold (9.0). Uses explicit Cvssv3xBaseScore and Cvssv3xTranslatedBaseScore fields from the GTIVulnerabilities parser. Fires when a matching record is found, indicating a critically rated vulnerability that warrants immediate analyst review.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application
Execution	`T1203` Exploitation for Client Execution
Privilege Escalation	`T1068` Exploitation for Privilege Escalation

Rule body

id: 3794141b-9bd3-41ae-8303-79f97692998b
name: GTI - Critical CVSS Score Vulnerability Detected
description: |
  Detects vulnerabilities ingested from Google Threat Intelligence with a CVSS v3 base score at or
  above the critical threshold (9.0). Uses explicit Cvssv3xBaseScore and Cvssv3xTranslatedBaseScore
  fields from the GTIVulnerabilities parser. Fires when a matching record is found, indicating a
  critically rated vulnerability that warrants immediate analyst review.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: GTIVulnerabilitiesConnector
    dataTypes:
      - GTI_Vulnerabilities_CL
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - Execution
  - PrivilegeEscalation
  - Impact
relevantTechniques:
  - T1190
  - T1068
  - T1203
query: |
  GTIVulnerabilities
  | extend Cvssv3Score = coalesce(Cvssv3xBaseScore, Cvssv3xTranslatedBaseScore)
  | where isnotempty(Cvssv3Score) and Cvssv3Score >= 9.0
  | extend
      Vendor       = tostring(Cpes[0].start_cpe.vendor),
      Product      = tostring(Cpes[0].start_cpe.product),
      CpeVersion   = tostring(Cpes[0].start_cpe.version),
      VendorFixUrl = coalesce(tostring(VendorFixReferences[0].url), tostring(VendorFixReferences[0]))
  | mv-apply _c = Cpes on (
      where isnotnull(_c.start_cpe)
      | summarize AffectedVendors  = make_set(tostring(_c.start_cpe.vendor)),
                  AffectedProducts = make_set(tostring(_c.start_cpe.product))
    )
  | project
      TimeGenerated,
      CveId,
      VulnName,
      Cvssv3Score,
      Cvssv4xScore,
      EpssScore,
      EpssPercentile,
      RiskRating,
      Priority,
      ExploitationState,
      ExploitationConsequence,
      Cvssv4xThreatExploitMaturity,
      Vendor,
      Product,
      CpeVersion,
      AffectedVendors,
      AffectedProducts,
      Description,
      VendorFixUrl,
      VendorFixReferences,
      Tags,
      Type
alertDetailsOverride:
  alertDisplayNameFormat: 'GTI Critical CVSS: {{CveId}} (Score: {{Cvssv3Score}})'
  alertDescriptionFormat: 'CVE: {{CveId}} | CVSS v3: {{Cvssv3Score}} | Risk: {{RiskRating}}'
entityMappings:
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: VendorFixUrl
customDetails:
  CveId: CveId
  Cvssv3Score: Cvssv3Score
  Cvssv4Score: Cvssv4xScore
  EpssScore: EpssScore
  EpssPercentile: EpssPercentile
  RiskRating: RiskRating
  Priority: Priority
  ExploitState: ExploitationState
  ExploitMaturity: Cvssv4xThreatExploitMaturity
  AffectedVendor: Vendor
  AffectedProduct: Product
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: P1D
    matchingMethod: Selected
    groupByCustomDetails:
      - CveId
eventGroupingSettings:
  aggregationKind: AlertPerResult
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

GTIVulnerabilities

Stage 2: `extend`

| extend Cvssv3Score = coalesce(Cvssv3xBaseScore, Cvssv3xTranslatedBaseScore)

Stage 3: `where`

| where isnotempty(Cvssv3Score) and Cvssv3Score >= 9.0

Stage 4: `extend`

| extend
    Vendor       = tostring(Cpes[0].start_cpe.vendor),
    Product      = tostring(Cpes[0].start_cpe.product),
    CpeVersion   = tostring(Cpes[0].start_cpe.version),
    VendorFixUrl = coalesce(tostring(VendorFixReferences[0].url), tostring(VendorFixReferences[0]))

Stage 5: `kusto:mv-apply`

| mv-apply _c = Cpes on (
    where isnotnull(_c.start_cpe)
    | summarize AffectedVendors  = make_set(tostring(_c.start_cpe.vendor)),
                AffectedProducts = make_set(tostring(_c.start_cpe.product))
  )

Stage 6: `project`

| project
    TimeGenerated,
    CveId,
    VulnName,
    Cvssv3Score,
    Cvssv4xScore,
    EpssScore,
    EpssPercentile,
    RiskRating,
    Priority,
    ExploitationState,
    ExploitationConsequence,
    Cvssv4xThreatExploitMaturity,
    Vendor,
    Product,
    CpeVersion,
    AffectedVendors,
    AffectedProducts,
    Description,
    VendorFixUrl,
    VendorFixReferences,
    Tags,
    Type

Stage 7: `summarize` aggregation inside the `mv-apply` branch

summarize

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Cvssv3Score`	ge	`9.0`	`field:"Cvssv3Score" kind:ge value:"9.0"`
`Cvssv3Score`	is_not_null	(no value, null check)	`field:"Cvssv3Score" kind:is_not_null`
`start_cpe`	is_not_null	(no value, null check)	`field:"start_cpe" kind:is_not_null`

GTI - Critical CVSS Score Vulnerability Detected

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: extend

Stage 3: where

Stage 4: extend

Stage 5: kusto:mv-apply

Stage 6: project

Stage 7: summarize aggregation inside the mv-apply branch