Cisco SEG - Multiple large emails sent to external recipient

Back


Id	1399a9a5-6200-411e-8c34-ca5658754cf7
Rulename	Cisco SEG - Multiple large emails sent to external recipient
Description	Detects possible data exfiltration.
Severity	Medium
Tactics	Exfiltration
Techniques	T1030
Required data connectors	CefAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoSEG/Analytic Rules/CiscoSEGMultipleLargeEmails.yaml
Version	1.0.3
Arm template	1399a9a5-6200-411e-8c34-ca5658754cf7.json

KQL

let e_theshold = 3;
let s_threshold = 10000000;
CiscoSEGEvent
| where AdditionalFields[15]['ESAMsgSize'] > s_threshold
| where NetworkDirection =~ 'Outgoing'
| extend rec_domain = extract(@'@(.*)', 1, DstUserName)
| extend s_domain = extract(@'@(.*)', 1, SrcUserName)
| where s_domain != rec_domain
| summarize count() by SrcUserName
| where count_ >= e_theshold
| extend AccountCustomEntity = SrcUserName

YAML

description: |
    'Detects possible data exfiltration.'
kind: Scheduled
tactics:
- Exfiltration
requiredDataConnectors:
- connectorId: CefAma
  dataTypes:
  - CommonSecurityLog
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoSEG/Analytic Rules/CiscoSEGMultipleLargeEmails.yaml
severity: Medium
name: Cisco SEG - Multiple large emails sent to external recipient
triggerThreshold: 0
queryPeriod: 1h
query: |
  let e_theshold = 3;
  let s_threshold = 10000000;
  CiscoSEGEvent
  | where AdditionalFields[15]['ESAMsgSize'] > s_threshold
  | where NetworkDirection =~ 'Outgoing'
  | extend rec_domain = extract(@'@(.*)', 1, DstUserName)
  | extend s_domain = extract(@'@(.*)', 1, SrcUserName)
  | where s_domain != rec_domain
  | summarize count() by SrcUserName
  | where count_ >= e_theshold
  | extend AccountCustomEntity = SrcUserName  
relevantTechniques:
- T1030
id: 1399a9a5-6200-411e-8c34-ca5658754cf7
queryFrequency: 1h
status: Available
triggerOperator: gt
version: 1.0.3
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountCustomEntity
    identifier: Name

ARM