Acronis - Multiple Endpoints Accessing Malicious URLs

Back


Id	1385f0ce-69d9-4abf-8039-52080c8c7017
Rulename	Acronis - Multiple Endpoints Accessing Malicious URLs
Description	Multiple endpoints accessing malicious URLs could indicate an ongoing phishing attack, with several employees interacting with those URLs.
Severity	Medium
Tactics	Execution
Techniques	T1204.001
Kind	Scheduled
Query frequency	1h
Query period	1d
Trigger threshold	2
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Acronis Cyber Protect Cloud/Analytic Rules/AcronisMultipleEndpointsAccessingMaliciousURLs.yaml
Version	1.0.0
Arm template	1385f0ce-69d9-4abf-8039-52080c8c7017.json

KQL

CommonSecurityLog
| where DeviceVendor == "Acronis"
| where DeviceEventClassID == "MaliciousUrlDetected"
| summarize MaliciousUrlDetected = count() by DeviceName

YAML

name: Acronis - Multiple Endpoints Accessing Malicious URLs
incidentConfiguration:
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: true
    lookbackDuration: P1D
    matchingMethod: AnyAlert
  createIncident: true
query: |
  CommonSecurityLog
  | where DeviceVendor == "Acronis"
  | where DeviceEventClassID == "MaliciousUrlDetected"
  | summarize MaliciousUrlDetected = count() by DeviceName  
entityMappings:
- entityType: Host
  fieldMappings:
  - columnName: DeviceName
    identifier: HostName
queryPeriod: 1d
tactics:
- Execution
triggerOperator: gt
kind: Scheduled
triggerThreshold: 2
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Acronis Cyber Protect Cloud/Analytic Rules/AcronisMultipleEndpointsAccessingMaliciousURLs.yaml
eventGroupingSettings:
  aggregationKind: SingleAlert
relevantTechniques:
- T1204.001
id: 1385f0ce-69d9-4abf-8039-52080c8c7017
customDetails:
  DeviceName: DeviceName
severity: Medium
requiredDataConnectors: []
version: 1.0.0
description: Multiple endpoints accessing malicious URLs could indicate an ongoing phishing attack, with several employees interacting with those URLs.
queryFrequency: 1h

ARM