Sunturai
Back to results
HighMicrosoft Sentinel analytics

GTI - Actively Exploited Vulnerability Detected

Detects vulnerabilities ingested from Google Threat Intelligence where the exploitation state is Confirmed or Wide, indicating the vulnerability is being actively exploited in the wild. Fires when such a record is…

Description

Detects vulnerabilities ingested from Google Threat Intelligence where the exploitation state is Confirmed or Wide, indicating the vulnerability is being actively exploited in the wild. Fires when such a record is ingested via the GTIVulnerabilities parser, prompting analyst triage and remediation.

Detection logic

Detection requirements

Platform
ContainersESXiIaaSLinuxmacOSNetwork DevicesWindows

The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.

Log source product
gtivulnerabilitiesconnector
Log source service
gti_vulnerabilities_cl

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice