Cisco SEG - Multiple large emails sent to external recipient

Back


Id	1399a9a5-6200-411e-8c34-ca5658754cf7
Rulename	Cisco SEG - Multiple large emails sent to external recipient
Description	Detects possible data exfiltration.
Severity	Medium
Tactics	Exfiltration
Techniques	T1030
Required data connectors	CefAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoSEG/Analytic Rules/CiscoSEGMultipleLargeEmails.yaml
Version	1.0.3
Arm template	1399a9a5-6200-411e-8c34-ca5658754cf7.json

KQL

let e_theshold = 3;
let s_threshold = 10000000;
CiscoSEGEvent
| where AdditionalFields[15]['ESAMsgSize'] > s_threshold
| where NetworkDirection =~ 'Outgoing'
| extend rec_domain = extract(@'@(.*)', 1, DstUserName)
| extend s_domain = extract(@'@(.*)', 1, SrcUserName)
| where s_domain != rec_domain
| summarize count() by SrcUserName
| where count_ >= e_theshold
| extend AccountCustomEntity = SrcUserName

YAML

query: |
  let e_theshold = 3;
  let s_threshold = 10000000;
  CiscoSEGEvent
  | where AdditionalFields[15]['ESAMsgSize'] > s_threshold
  | where NetworkDirection =~ 'Outgoing'
  | extend rec_domain = extract(@'@(.*)', 1, DstUserName)
  | extend s_domain = extract(@'@(.*)', 1, SrcUserName)
  | where s_domain != rec_domain
  | summarize count() by SrcUserName
  | where count_ >= e_theshold
  | extend AccountCustomEntity = SrcUserName  
relevantTechniques:
- T1030
severity: Medium
tactics:
- Exfiltration
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoSEG/Analytic Rules/CiscoSEGMultipleLargeEmails.yaml
id: 1399a9a5-6200-411e-8c34-ca5658754cf7
version: 1.0.3
description: |
    'Detects possible data exfiltration.'
queryPeriod: 1h
name: Cisco SEG - Multiple large emails sent to external recipient
requiredDataConnectors:
- connectorId: CefAma
  dataTypes:
  - CommonSecurityLog
status: Available
triggerOperator: gt
queryFrequency: 1h
kind: Scheduled

ARM