Acronis - Multiple Endpoints Accessing Malicious URLs | Microsoft Sentinel Analytic Rules

Back


Id	1385f0ce-69d9-4abf-8039-52080c8c7017
Rulename	Acronis - Multiple Endpoints Accessing Malicious URLs
Description	Multiple endpoints accessing malicious URLs could indicate an ongoing phishing attack, with several employees interacting with those URLs.
Severity	Medium
Tactics	Execution
Techniques	T1204.001
Kind	Scheduled
Query frequency	1h
Query period	1d
Trigger threshold	2
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Acronis%20Cyber%20Protect%20Cloud/Analytic%20Rules/AcronisMultipleEndpointsAccessingMaliciousURLs.yaml
Version	1.0.0
Arm template	1385f0ce-69d9-4abf-8039-52080c8c7017.json

KQL

CommonSecurityLog
| where DeviceVendor == "Acronis"
| where DeviceEventClassID == "MaliciousUrlDetected"
| summarize MaliciousUrlDetected = count() by DeviceName

YAML

incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: P1D
    reopenClosedIncident: true
    matchingMethod: AnyAlert
    enabled: true
  createIncident: true
name: Acronis - Multiple Endpoints Accessing Malicious URLs
triggerOperator: gt
query: |
  CommonSecurityLog
  | where DeviceVendor == "Acronis"
  | where DeviceEventClassID == "MaliciousUrlDetected"
  | summarize MaliciousUrlDetected = count() by DeviceName
queryFrequency: 1h
description: Multiple endpoints accessing malicious URLs could indicate an ongoing phishing attack, with several employees interacting with those URLs.
id: 1385f0ce-69d9-4abf-8039-52080c8c7017
triggerThreshold: 2
queryPeriod: 1d
version: 1.0.0
kind: Scheduled
customDetails:
  DeviceName: DeviceName
relevantTechniques:
- T1204.001
eventGroupingSettings:
  aggregationKind: SingleAlert
severity: Medium
requiredDataConnectors: []
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Acronis%20Cyber%20Protect%20Cloud/Analytic%20Rules/AcronisMultipleEndpointsAccessingMaliciousURLs.yaml
tactics:
- Execution
entityMappings:
- fieldMappings:
  - identifier: HostName
    columnName: DeviceName
  entityType: Host

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/1385f0ce-69d9-4abf-8039-52080c8c7017')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/1385f0ce-69d9-4abf-8039-52080c8c7017')]",
      "properties": {
        "alertRuleTemplateName": "1385f0ce-69d9-4abf-8039-52080c8c7017",
        "customDetails": {
          "DeviceName": "DeviceName"
        },
        "description": "Multiple endpoints accessing malicious URLs could indicate an ongoing phishing attack, with several employees interacting with those URLs.",
        "displayName": "Acronis - Multiple Endpoints Accessing Malicious URLs",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "DeviceName",
                "identifier": "HostName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "lookbackDuration": "P1D",
            "matchingMethod": "AnyAlert",
            "reopenClosedIncident": true
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Acronis%20Cyber%20Protect%20Cloud/Analytic%20Rules/AcronisMultipleEndpointsAccessingMaliciousURLs.yaml",
        "query": "CommonSecurityLog\n| where DeviceVendor == \"Acronis\"\n| where DeviceEventClassID == \"MaliciousUrlDetected\"\n| summarize MaliciousUrlDetected = count() by DeviceName\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P1D",
        "severity": "Medium",
        "subTechniques": [
          "T1204.001"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Execution"
        ],
        "techniques": [
          "T1204"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 2
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}