TI map Email entity to Cloud App Events

Back


Id	0385e99c-ae45-45f4-aecf-00104485cd6b
Rulename	TI map Email entity to Cloud App Events
Description	Identifies compromises and attacks and detect malicious activities in one’s email entity from TI
Severity	Medium
Tactics	InitialAccess
Techniques	T1566
Required data connectors	MicrosoftDefenderThreatIntelligence MicrosoftThreatProtection
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Threat Intelligence (NEW)/Analytic Rules/EmailEntity_CloudAppEvents_Updated.yaml
Version	1.0.7
Arm template	0385e99c-ae45-45f4-aecf-00104485cd6b.json

KQL

let dt_lookBack = 1h;
let ioc_lookBack = 14d;
let emailregex = @'^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+$';
ThreatIntelIndicators
  | where TimeGenerated >= ago(ioc_lookBack)
  | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id, ObservableValue
  | where IsActive and (ValidUntil > now() or isempty(ValidUntil))
//extract key part of kv pair
  | extend IndicatorType = replace(@"\[|\]|\""", "", tostring(split(ObservableKey, ":", 0)))
  | where IndicatorType == "email-addr"
  | extend EmailSenderAddress = ObservableValue
  | extend EmailSourceDomain = substring(EmailSenderAddress, indexof(EmailSenderAddress, "@") + 1, strlen(EmailSenderAddress) - indexof(EmailSenderAddress, "@") - 1)
  | project-reorder *, EmailSenderAddress, EmailSourceDomain, Type
  | extend IndicatorId = tostring(split(Id, "--")[2])
  | join kind=innerunique (CloudAppEvents
| extend User_Id = tostring(RawEventData.UserId)
| where isnotempty(User_Id)
| where TimeGenerated >= ago(dt_lookBack) and isnotempty(Application)
| extend CloudAppEvents_TimeGenerated = TimeGenerated 
| where User_Id matches regex emailregex) on $left.EmailSenderAddress == $right.User_Id
| where CloudAppEvents_TimeGenerated < ValidUntil
| summarize CloudAppEvents_TimeGenerated = argmax(CloudAppEvents_TimeGenerated, *) by IndicatorId, User_Id
| extend Name = tostring(split(User_Id, '@', 0)[0]), UPNSuffix = tostring(split(User_Id, '@', 1)[0])
| extend timestamp = CloudAppEvents_TimeGenerated

YAML

query: |
  let dt_lookBack = 1h;
  let ioc_lookBack = 14d;
  let emailregex = @'^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+$';
  ThreatIntelIndicators
    | where TimeGenerated >= ago(ioc_lookBack)
    | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id, ObservableValue
    | where IsActive and (ValidUntil > now() or isempty(ValidUntil))
  //extract key part of kv pair
    | extend IndicatorType = replace(@"\[|\]|\""", "", tostring(split(ObservableKey, ":", 0)))
    | where IndicatorType == "email-addr"
    | extend EmailSenderAddress = ObservableValue
    | extend EmailSourceDomain = substring(EmailSenderAddress, indexof(EmailSenderAddress, "@") + 1, strlen(EmailSenderAddress) - indexof(EmailSenderAddress, "@") - 1)
    | project-reorder *, EmailSenderAddress, EmailSourceDomain, Type
    | extend IndicatorId = tostring(split(Id, "--")[2])
    | join kind=innerunique (CloudAppEvents
  | extend User_Id = tostring(RawEventData.UserId)
  | where isnotempty(User_Id)
  | where TimeGenerated >= ago(dt_lookBack) and isnotempty(Application)
  | extend CloudAppEvents_TimeGenerated = TimeGenerated 
  | where User_Id matches regex emailregex) on $left.EmailSenderAddress == $right.User_Id
  | where CloudAppEvents_TimeGenerated < ValidUntil
  | summarize CloudAppEvents_TimeGenerated = argmax(CloudAppEvents_TimeGenerated, *) by IndicatorId, User_Id
  | extend Name = tostring(split(User_Id, '@', 0)[0]), UPNSuffix = tostring(split(User_Id, '@', 1)[0])
  | extend timestamp = CloudAppEvents_TimeGenerated  
entityMappings:
- fieldMappings:
  - identifier: DisplayName
    columnName: Name
  - identifier: FullName
    columnName: User_Id
  - identifier: UPNSuffix
    columnName: UPNSuffix
  entityType: Account
triggerOperator: gt
description: |
    'Identifies compromises and attacks and detect malicious activities in one's email entity from TI'
tactics:
- InitialAccess
severity: Medium
queryFrequency: 1h
kind: Scheduled
name: TI map Email entity to Cloud App Events
triggerThreshold: 0
id: 0385e99c-ae45-45f4-aecf-00104485cd6b
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
- connectorId: MicrosoftDefenderThreatIntelligence
  dataTypes:
  - ThreatIntelIndicators
relevantTechniques:
- T1566
version: 1.0.7
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Threat Intelligence (NEW)/Analytic Rules/EmailEntity_CloudAppEvents_Updated.yaml
queryPeriod: 14d

ARM