Cisco SEG - Multiple large emails sent to external recipient

Back


Id	1399a9a5-6200-411e-8c34-ca5658754cf7
Rulename	Cisco SEG - Multiple large emails sent to external recipient
Description	Detects possible data exfiltration.
Severity	Medium
Tactics	Exfiltration
Techniques	T1030
Required data connectors	CefAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoSEG/Analytic Rules/CiscoSEGMultipleLargeEmails.yaml
Version	1.0.3
Arm template	1399a9a5-6200-411e-8c34-ca5658754cf7.json

KQL

let e_theshold = 3;
let s_threshold = 10000000;
CiscoSEGEvent
| where AdditionalFields[15]['ESAMsgSize'] > s_threshold
| where NetworkDirection =~ 'Outgoing'
| extend rec_domain = extract(@'@(.*)', 1, DstUserName)
| extend s_domain = extract(@'@(.*)', 1, SrcUserName)
| where s_domain != rec_domain
| summarize count() by SrcUserName
| where count_ >= e_theshold
| extend AccountCustomEntity = SrcUserName

YAML

status: Available
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
query: |
  let e_theshold = 3;
  let s_threshold = 10000000;
  CiscoSEGEvent
  | where AdditionalFields[15]['ESAMsgSize'] > s_threshold
  | where NetworkDirection =~ 'Outgoing'
  | extend rec_domain = extract(@'@(.*)', 1, DstUserName)
  | extend s_domain = extract(@'@(.*)', 1, SrcUserName)
  | where s_domain != rec_domain
  | summarize count() by SrcUserName
  | where count_ >= e_theshold
  | extend AccountCustomEntity = SrcUserName  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoSEG/Analytic Rules/CiscoSEGMultipleLargeEmails.yaml
tactics:
- Exfiltration
triggerThreshold: 0
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
requiredDataConnectors:
- connectorId: CefAma
  dataTypes:
  - CommonSecurityLog
kind: Scheduled
relevantTechniques:
- T1030
description: |
    'Detects possible data exfiltration.'
name: Cisco SEG - Multiple large emails sent to external recipient
version: 1.0.3
id: 1399a9a5-6200-411e-8c34-ca5658754cf7
severity: Medium

ARM