Samsung Knox - Suspicious URL Accessed Events

Back


Id	18d4d4f3-6605-4fd2-968c-82c171409c1c
Rulename	Samsung Knox - Suspicious URL Accessed Events
Description	When a Knox device user clicks on URLs or links detected as suspicious (potentially phishing or malicious) with a high degree of confidence.
Severity	High
Tactics	InitialAccess
Techniques	T1566
Required data connectors	SamsungDCDefinition
Kind	NRT
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxSuspiciousURLs.yaml
Version	1.0.2
Arm template	18d4d4f3-6605-4fd2-968c-82c171409c1c.json

KQL

Samsung_Knox_User_CL 
| where Name == "SUSPICIOUS_URL_ACCESSED" 
and ConfidenceScore > 0.9

YAML

eventGroupingSettings:
  aggregationKind: SingleAlert
relevantTechniques:
- T1566
requiredDataConnectors:
- dataTypes:
  - Samsung_Knox_User_CL
  connectorId: SamsungDCDefinition
query: |
  Samsung_Knox_User_CL 
  | where Name == "SUSPICIOUS_URL_ACCESSED" 
  and ConfidenceScore > 0.9  
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    matchingMethod: AllEntities
    lookbackDuration: PT5H
    reopenClosedIncident: false
suppressionEnabled: false
kind: NRT
tactics:
- InitialAccess
id: 18d4d4f3-6605-4fd2-968c-82c171409c1c
name: Samsung Knox - Suspicious URL Accessed Events
suppressionDuration: PT5H
status: Available
version: 1.0.2
description: |
    'When a Knox device user clicks on URLs or links detected as suspicious (potentially phishing or malicious) with a high degree of confidence.'
entityMappings:
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: Url
severity: High
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxSuspiciousURLs.yaml

ARM