Cisco SEG - Multiple large emails sent to external recipient

Back


Id	1399a9a5-6200-411e-8c34-ca5658754cf7
Rulename	Cisco SEG - Multiple large emails sent to external recipient
Description	Detects possible data exfiltration.
Severity	Medium
Tactics	Exfiltration
Techniques	T1030
Required data connectors	CefAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoSEG/Analytic Rules/CiscoSEGMultipleLargeEmails.yaml
Version	1.0.3
Arm template	1399a9a5-6200-411e-8c34-ca5658754cf7.json

KQL

let e_theshold = 3;
let s_threshold = 10000000;
CiscoSEGEvent
| where AdditionalFields[15]['ESAMsgSize'] > s_threshold
| where NetworkDirection =~ 'Outgoing'
| extend rec_domain = extract(@'@(.*)', 1, DstUserName)
| extend s_domain = extract(@'@(.*)', 1, SrcUserName)
| where s_domain != rec_domain
| summarize count() by SrcUserName
| where count_ >= e_theshold
| extend AccountCustomEntity = SrcUserName

YAML

id: 1399a9a5-6200-411e-8c34-ca5658754cf7
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoSEG/Analytic Rules/CiscoSEGMultipleLargeEmails.yaml
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
  entityType: Account
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma
queryFrequency: 1h
queryPeriod: 1h
status: Available
query: |
  let e_theshold = 3;
  let s_threshold = 10000000;
  CiscoSEGEvent
  | where AdditionalFields[15]['ESAMsgSize'] > s_threshold
  | where NetworkDirection =~ 'Outgoing'
  | extend rec_domain = extract(@'@(.*)', 1, DstUserName)
  | extend s_domain = extract(@'@(.*)', 1, SrcUserName)
  | where s_domain != rec_domain
  | summarize count() by SrcUserName
  | where count_ >= e_theshold
  | extend AccountCustomEntity = SrcUserName  
name: Cisco SEG - Multiple large emails sent to external recipient
kind: Scheduled
tactics:
- Exfiltration
severity: Medium
relevantTechniques:
- T1030
triggerThreshold: 0
version: 1.0.3
description: |
    'Detects possible data exfiltration.'

ARM