GTI - Zero-Day Vulnerability Detected

Status: available
Severity: high
Time window: 10m
Source: github.com/Azure/Azure-Sentinel

Detects vulnerabilities ingested from Google Threat Intelligence that are tagged as Zero Day, indicating a vulnerability being exploited before a patch is publicly available. Fires when a matching record is found via the GTIVulnerabilities parser, warranting immediate analyst response.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application
Execution	`T1203` Exploitation for Client Execution
Privilege Escalation	`T1068` Exploitation for Privilege Escalation
Impact	`T1486` Data Encrypted for Impact

Rule body

id: ebd03de8-0cee-4923-b510-45337e0aed84
name: GTI - Zero-Day Vulnerability Detected
description: |
  Detects vulnerabilities ingested from Google Threat Intelligence that are tagged as Zero Day,
  indicating a vulnerability being exploited before a patch is publicly available. Fires when a
  matching record is found via the GTIVulnerabilities parser, warranting immediate analyst response.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: GTIVulnerabilitiesConnector
    dataTypes:
      - GTI_Vulnerabilities_CL
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - Execution
  - PrivilegeEscalation
  - Impact
relevantTechniques:
  - T1190
  - T1068
  - T1203
  - T1486
query: |
  GTIVulnerabilities
  | where tolower(tostring(Tags)) has_any ("zero-day", "0day", "0-day", "zero_day", "zero Day")
  | extend Cvssv3Score = coalesce(Cvssv3xBaseScore, Cvssv3xTranslatedBaseScore)
  | extend
      Vendor       = tostring(Cpes[0].start_cpe.vendor),
      Product      = tostring(Cpes[0].start_cpe.product),
      CpeVersion   = tostring(Cpes[0].start_cpe.version),
      VendorFixUrl = coalesce(tostring(VendorFixReferences[0].url), tostring(VendorFixReferences[0]))
  | mv-apply _c = Cpes on (
      where isnotnull(_c.start_cpe)
      | summarize AffectedVendors  = make_set(tostring(_c.start_cpe.vendor)),
                  AffectedProducts = make_set(tostring(_c.start_cpe.product))
    )
  | project
      TimeGenerated,
      CveId,
      VulnName,
      RiskRating,
      Priority,
      ExploitationState,
      ExploitationConsequence,
      ExploitReleaseDate,
      Cvssv3Score,
      Cvssv4xScore,
      EpssScore,
      EpssPercentile,
      Cvssv4xThreatExploitMaturity,
      RecentActivityRelativeChange,
      Vendor,
      Product,
      CpeVersion,
      AffectedVendors,
      AffectedProducts,
      Description,
      VendorFixUrl,
      VendorFixReferences,
      Tags,
      Type
alertDetailsOverride:
  alertDisplayNameFormat: 'GTI Zero-Day: {{CveId}}'
  alertDescriptionFormat: 'CVE: {{CveId}} | Risk: {{RiskRating}} | State: {{ExploitationState}}'
entityMappings:
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: VendorFixUrl
customDetails:
  CveId: CveId
  RiskRating: RiskRating
  Priority: Priority
  ExploitState: ExploitationState
  Cvssv3Score: Cvssv3Score
  Cvssv4Score: Cvssv4xScore
  EpssScore: EpssScore
  EpssPercentile: EpssPercentile
  ExploitMaturity: Cvssv4xThreatExploitMaturity
  ActivityChange: RecentActivityRelativeChange
  AffectedVendor: Vendor
  AffectedProduct: Product
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: P1D
    matchingMethod: Selected
    groupByCustomDetails:
      - CveId
eventGroupingSettings:
  aggregationKind: AlertPerResult
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

GTIVulnerabilities

Stage 2: `where`

| where tolower(tostring(Tags)) has_any ("zero-day", "0day", "0-day", "zero_day", "zero Day")

Stage 3: `extend`

| extend Cvssv3Score = coalesce(Cvssv3xBaseScore, Cvssv3xTranslatedBaseScore)

Stage 4: `extend`

| extend
    Vendor       = tostring(Cpes[0].start_cpe.vendor),
    Product      = tostring(Cpes[0].start_cpe.product),
    CpeVersion   = tostring(Cpes[0].start_cpe.version),
    VendorFixUrl = coalesce(tostring(VendorFixReferences[0].url), tostring(VendorFixReferences[0]))

Stage 5: `kusto:mv-apply`

| mv-apply _c = Cpes on (
    where isnotnull(_c.start_cpe)
    | summarize AffectedVendors  = make_set(tostring(_c.start_cpe.vendor)),
                AffectedProducts = make_set(tostring(_c.start_cpe.product))
  )

Stage 6: `project`

| project
    TimeGenerated,
    CveId,
    VulnName,
    RiskRating,
    Priority,
    ExploitationState,
    ExploitationConsequence,
    ExploitReleaseDate,
    Cvssv3Score,
    Cvssv4xScore,
    EpssScore,
    EpssPercentile,
    Cvssv4xThreatExploitMaturity,
    RecentActivityRelativeChange,
    Vendor,
    Product,
    CpeVersion,
    AffectedVendors,
    AffectedProducts,
    Description,
    VendorFixUrl,
    VendorFixReferences,
    Tags,
    Type

Stage 7: `summarize` aggregation inside the `mv-apply` branch

summarize

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Tags`	match	`0-day` transforms: `tolower`, `tostring`, `term` `0day` transforms: `tolower`, `tostring`, `term` `zero Day` transforms: `tolower`, `tostring`, `term` `zero-day` transforms: `tolower`, `tostring`, `term` `zero_day` transforms: `tolower`, `tostring`, `term`	`field:"Tags" kind:match`
`start_cpe`	is_not_null	(no value, null check)	`field:"start_cpe" kind:is_not_null`

GTI - Zero-Day Vulnerability Detected

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: extend

Stage 4: extend

Stage 5: kusto:mv-apply

Stage 6: project

Stage 7: summarize aggregation inside the mv-apply branch