CYFIRMA - Brand Intelligence - Social Media Handle Impersonation Detected High Rule
Id | 22f49d67-7da7-4809-8d07-89e4478aa6b0 |
Rulename | CYFIRMA - Brand Intelligence - Social Media Handle Impersonation Detected High Rule |
Description | “Detects high-severity alerts related to impersonation of official social media handles associated with your brand. These spoofed accounts may be used for phishing, disinformation, or fraud campaigns, posing significant reputational and security risks.” |
Severity | High |
Tactics | Reconnaissance ResourceDevelopment InitialAccess |
Techniques | T1589.003 T1591.002 T1585.001 T1566.002 |
Required data connectors | CyfirmaBrandIntelligenceAlertsDC |
Kind | Scheduled |
Query frequency | 5m |
Query period | 5m |
Trigger threshold | 0 |
Trigger operator | gt |
Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyfirma Brand Intelligence/Analytic Rules/BISocialMediaHandlerHighRule.yaml |
Version | 1.0.0 |
Arm template | 22f49d67-7da7-4809-8d07-89e4478aa6b0.json |
// High severity - Social Media Handle Impersonation
let timeFrame = 5m;
CyfirmaBISocialHandlersAlerts_CL
| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())
| extend
Description=description,
FirstSeen=first_seen,
LastSeen=last_seen,
RiskScore=risk_score,
AlertUID=alert_uid,
UID=uid,
AssetType=asset_type,
AssetValue=asset_value,
Impact=impact,
Recommendation=recommendation,
SourceSype=source_type,
ProviderName="CYFIRMA",
ProductName="DeCYFIR/DeTCT"
| project
TimeGenerated,
Description,
RiskScore,
FirstSeen,
LastSeen,
AlertUID,
UID,
AssetType,
AssetValue,
Impact,
Recommendation,
SourceSype,
ProductName,
ProviderName
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyfirma Brand Intelligence/Analytic Rules/BISocialMediaHandlerHighRule.yaml
triggerThreshold: 0
severity: High
incidentConfiguration:
createIncident: true
groupingConfiguration:
lookbackDuration: 5h
enabled: false
matchingMethod: AllEntities
reopenClosedIncident: false
queryFrequency: 5m
status: Available
customDetails:
TimeGenerated: TimeGenerated
FirstSeen: FirstSeen
Recommendation: Recommendation
RiskScore: RiskScore
AssetType: AssetType
LastSeen: LastSeen
Impact: Impact
AlertUID: AlertUID
SourceSype: SourceSype
Description: Description
AssetValue: AssetValue
UID: UID
relevantTechniques:
- T1589.003
- T1591.002
- T1585.001
- T1566.002
alertDetailsOverride:
alertDisplayNameFormat: 'CYFIRMA - High Severity Social Media Handle Impersonation Detected - {{AssetType}} : {{AssetValue}} '
alertDescriptionFormat: '{{Description}} '
alertDynamicProperties:
- alertProperty: ProductName
value: ProductName
- alertProperty: ProviderName
value: ProviderName
triggerOperator: gt
id: 22f49d67-7da7-4809-8d07-89e4478aa6b0
requiredDataConnectors:
- connectorId: CyfirmaBrandIntelligenceAlertsDC
dataTypes:
- CyfirmaBISocialHandlersAlerts_CL
version: 1.0.0
name: CYFIRMA - Brand Intelligence - Social Media Handle Impersonation Detected High Rule
eventGroupingSettings:
aggregationKind: AlertPerResult
description: |
"Detects high-severity alerts related to impersonation of official social media handles associated with your brand.
These spoofed accounts may be used for phishing, disinformation, or fraud campaigns, posing significant reputational and security risks."
query: |
// High severity - Social Media Handle Impersonation
let timeFrame = 5m;
CyfirmaBISocialHandlersAlerts_CL
| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())
| extend
Description=description,
FirstSeen=first_seen,
LastSeen=last_seen,
RiskScore=risk_score,
AlertUID=alert_uid,
UID=uid,
AssetType=asset_type,
AssetValue=asset_value,
Impact=impact,
Recommendation=recommendation,
SourceSype=source_type,
ProviderName="CYFIRMA",
ProductName="DeCYFIR/DeTCT"
| project
TimeGenerated,
Description,
RiskScore,
FirstSeen,
LastSeen,
AlertUID,
UID,
AssetType,
AssetValue,
Impact,
Recommendation,
SourceSype,
ProductName,
ProviderName
tactics:
- Reconnaissance
- ResourceDevelopment
- InitialAccess
queryPeriod: 5m
kind: Scheduled
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/22f49d67-7da7-4809-8d07-89e4478aa6b0')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/22f49d67-7da7-4809-8d07-89e4478aa6b0')]",
"properties": {
"alertDetailsOverride": {
"alertDescriptionFormat": "{{Description}} ",
"alertDisplayNameFormat": "CYFIRMA - High Severity Social Media Handle Impersonation Detected - {{AssetType}} : {{AssetValue}} ",
"alertDynamicProperties": [
{
"alertProperty": "ProductName",
"value": "ProductName"
},
{
"alertProperty": "ProviderName",
"value": "ProviderName"
}
]
},
"alertRuleTemplateName": "22f49d67-7da7-4809-8d07-89e4478aa6b0",
"customDetails": {
"AlertUID": "AlertUID",
"AssetType": "AssetType",
"AssetValue": "AssetValue",
"Description": "Description",
"FirstSeen": "FirstSeen",
"Impact": "Impact",
"LastSeen": "LastSeen",
"Recommendation": "Recommendation",
"RiskScore": "RiskScore",
"SourceSype": "SourceSype",
"TimeGenerated": "TimeGenerated",
"UID": "UID"
},
"description": "\"Detects high-severity alerts related to impersonation of official social media handles associated with your brand. \nThese spoofed accounts may be used for phishing, disinformation, or fraud campaigns, posing significant reputational and security risks.\"\n",
"displayName": "CYFIRMA - Brand Intelligence - Social Media Handle Impersonation Detected High Rule",
"enabled": true,
"entityMappings": null,
"eventGroupingSettings": {
"aggregationKind": "AlertPerResult"
},
"incidentConfiguration": {
"createIncident": true,
"groupingConfiguration": {
"enabled": false,
"lookbackDuration": "PT5H",
"matchingMethod": "AllEntities",
"reopenClosedIncident": false
}
},
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyfirma Brand Intelligence/Analytic Rules/BISocialMediaHandlerHighRule.yaml",
"query": "// High severity - Social Media Handle Impersonation\nlet timeFrame = 5m;\nCyfirmaBISocialHandlersAlerts_CL \n | where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())\n | extend\n Description=description,\n FirstSeen=first_seen,\n LastSeen=last_seen,\n RiskScore=risk_score,\n AlertUID=alert_uid,\n UID=uid,\n AssetType=asset_type,\n AssetValue=asset_value,\n Impact=impact,\n Recommendation=recommendation,\n SourceSype=source_type,\n ProviderName=\"CYFIRMA\",\n ProductName=\"DeCYFIR/DeTCT\"\n | project \n TimeGenerated,\n Description,\n RiskScore,\n FirstSeen,\n LastSeen,\n AlertUID,\n UID,\n AssetType,\n AssetValue,\n Impact,\n Recommendation,\n SourceSype,\n ProductName,\n ProviderName\n",
"queryFrequency": "PT5M",
"queryPeriod": "PT5M",
"severity": "High",
"status": "Available",
"subTechniques": [
"T1589.003",
"T1591.002",
"T1585.001",
"T1566.002"
],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"InitialAccess",
"Reconnaissance",
"ResourceDevelopment"
],
"techniques": [
"T1566",
"T1585",
"T1589",
"T1591"
],
"templateVersion": "1.0.0",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}