RecordedFuture Threat Hunting Url All Actors

Back


Id	3f6f0d1a-f2f9-4e01-881a-c55a4a71905b
Rulename	RecordedFuture Threat Hunting Url All Actors
Description	Recorded Future Threat Hunting Url correlation for all actors.
Severity	Medium
Tactics	Persistence PrivilegeEscalation DefenseEvasion
Techniques	T1098 T1078
Required data connectors	ThreatIntelligenceUploadIndicatorsAPI
Kind	Scheduled
Query frequency	15m
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Recorded Future/Analytic Rules/ThreatHunting/RecordedFutureThreatHuntingUrlAllActors.yaml
Version	1.1.0
Arm template	3f6f0d1a-f2f9-4e01-881a-c55a4a71905b.json

KQL

let ioc_lookBack = 1d;
// The source table (_Im_WebSession) is a ASIM parser table, but can be replaced by any infrastructure table containing Url data.
// The following workbook: Recorded Future - Url Correlation will help researching available data and selecting tables and columns
_Im_WebSession
| where isnotempty(Url)
| extend lowerUrl=tolower(Url)
| join kind=inner (
ThreatIntelIndicators
// Only look for IOCs
| where ObservableKey == 'url:value'
| where isnotempty(ObservableValue)
// Only look at Recorded Future Threat Hunt Indicators.
| where Data.description startswith "Recorded Future - Threat Hunt"
// Only work with the latest indicators
| where TimeGenerated >= ago(ioc_lookBack)
| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
| where IsActive == true and ValidUntil > now()
| extend lowerUrl=tolower(ObservableValue)
) on lowerUrl
// select column from the source table to match with Recorded Future ThreatIntelIndicators $left.Url
| mv-expand RecordedFuturePortalLink=parse_json(tostring(parse_json(Tags)))['recordedfutureportallink']
| project Url=ObservableValue, Description=Data.description, Type, TimeGenerated, RecordedFuturePortalLink

YAML

incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    matchingMethod: AllEntities
    reopenClosedIncident: false
    enabled: true
    lookbackDuration: 1h
kind: Scheduled
customDetails:
  ActorInformation: RecordedFuturePortalLink
name: RecordedFuture Threat Hunting Url All Actors
queryFrequency: 15m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Recorded Future/Analytic Rules/ThreatHunting/RecordedFutureThreatHuntingUrlAllActors.yaml
severity: Medium
id: 3f6f0d1a-f2f9-4e01-881a-c55a4a71905b
entityMappings:
- entityType: URL
  fieldMappings:
  - columnName: Url
    identifier: Url
tactics:
- Persistence
- PrivilegeEscalation
- DefenseEvasion
queryPeriod: 1d
version: 1.1.0
requiredDataConnectors:
- connectorId: ThreatIntelligenceUploadIndicatorsAPI
  dataTypes:
  - ThreatIntelIndicators
triggerThreshold: 0
triggerOperator: gt
alertDetailsOverride:
  alertDynamicProperties:
  - alertProperty: AlertLink
    value: RecordedFuturePortalLink
  alertDisplayNameFormat: '{{Description}}'
  alertDescriptionFormat: '*{{Description}}**\n\nCorrelation found on {{Url}} from the {{Type}} table.\n'
query: |
  let ioc_lookBack = 1d;
  // The source table (_Im_WebSession) is a ASIM parser table, but can be replaced by any infrastructure table containing Url data.
  // The following workbook: Recorded Future - Url Correlation will help researching available data and selecting tables and columns
  _Im_WebSession
  | where isnotempty(Url)
  | extend lowerUrl=tolower(Url)
  | join kind=inner (
  ThreatIntelIndicators
  // Only look for IOCs
  | where ObservableKey == 'url:value'
  | where isnotempty(ObservableValue)
  // Only look at Recorded Future Threat Hunt Indicators.
  | where Data.description startswith "Recorded Future - Threat Hunt"
  // Only work with the latest indicators
  | where TimeGenerated >= ago(ioc_lookBack)
  | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
  | where IsActive == true and ValidUntil > now()
  | extend lowerUrl=tolower(ObservableValue)
  ) on lowerUrl
  // select column from the source table to match with Recorded Future ThreatIntelIndicators $left.Url
  | mv-expand RecordedFuturePortalLink=parse_json(tostring(parse_json(Tags)))['recordedfutureportallink']
  | project Url=ObservableValue, Description=Data.description, Type, TimeGenerated, RecordedFuturePortalLink  
relevantTechniques:
- T1098
- T1078
description: |
    'Recorded Future Threat Hunting Url correlation for all actors.'

ARM