↳ GitHub sourceAnalytics ruleMedium

Firmware Updates (Microsoft Defender for IoT)

Description

'This alert leverages Defender for IoT to detect unauthorized firmware updates that may indicate malicious activity on the network such as a cyber threat that attempts to manipulate PLC firmware to compromise PLC function.'

Rule type: Scheduled
Version: 1.0.3
Declared status: Available
Query frequency: 1h
Query period: 1h
Trigger: gt 0

Declared MITRE coverage

Persistence T0857

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

IoT

Data types

SecurityAlert (ASC for IoT)

KQL query

Original query, unchanged.

SecurityAlert
| where ProviderName == "IoTSecurity"
| where AlertName has_any ("Beckhoff Software Changed", "Firmware Version Changed", "Firmware Change", "Firmware Changed", "Firmware Update")
| extend ExtendedProperties = parse_json(ExtendedProperties)
| where tostring(ExtendedProperties.isNew) == "True"
| extend DeviceId = tostring(ExtendedProperties.DeviceId), 
         SourceDeviceAddress = tostring(ExtendedProperties.SourceDeviceAddress), 
         DestDeviceAddress = tostring(ExtendedProperties.DestinationDeviceAddress), 
         RemediationSteps = tostring(parse_json(RemediationSteps)[0]), 
         Protocol = tostring(ExtendedProperties.Protocol), 
         AlertManagementUri = tostring(ExtendedProperties.AlertManagementUri)
| project
  TimeGenerated,
  DeviceId,
  ProductName,
  ProductComponentName,
  AlertSeverity,
  AlertName,
  Description,
  Protocol,
  SourceDeviceAddress,
  DestDeviceAddress,
  RemediationSteps,
  Tactics,
  Entities,
  VendorOriginalId,
  AlertLink,
  AlertManagementUri,
  Techniques

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/IoTOTThreatMonitoringwithDefenderforIoT/Analytic Rules/IoTFirmwareUpdates.yaml ↗
Commit: 9800e51 ↗
Source identifier: 7cad4b66-5e83-4756-8de4-f21315ab1e77

Additional source files 2

Solutions/IoTOTThreatMonitoringwithDefenderforIoT/Analytic Rules/IoTFirmwareUpdates.yamlsource ↗Solutions/IoTOTThreatMonitoringwithDefenderforIoT/Data/Solution_IoTOTThreatMonitoringwithDefenderforIoT.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.