AR Microsoft Sentinel Analytic Rules ONLINE

Analytic rule catalog

CYFIRMA - Brand Intelligence - Social Media Handle Impersonation Detected High Rule

Back
Id22f49d67-7da7-4809-8d07-89e4478aa6b0
RulenameCYFIRMA - Brand Intelligence - Social Media Handle Impersonation Detected High Rule
Description“Detects high-severity alerts related to impersonation of official social media handles associated with your brand.

These spoofed accounts may be used for phishing, disinformation, or fraud campaigns, posing significant reputational and security risks.”
SeverityHigh
TacticsReconnaissance
ResourceDevelopment
InitialAccess
TechniquesT1589.003
T1591.002
T1585.001
T1566.002
Required data connectorsCyfirmaBrandIntelligenceAlertsDC
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyfirma%20Brand%20Intelligence/Analytic%20Rules/BISocialMediaHandlerHighRule.yaml
Version1.0.1
Arm template22f49d67-7da7-4809-8d07-89e4478aa6b0.json
Deploy To Azure
// High severity - Social Media Handle Impersonation
let timeFrame = 5m;
CyfirmaBISocialHandlersAlerts_CL 
  | where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())
  | extend
      Description=description,
      FirstSeen=first_seen,
      LastSeen=last_seen,
      RiskScore=risk_score,
      AlertUID=alert_uid,
      UID=uid,
      AssetType=asset_type,
      AssetValue=asset_value,
      Impact=impact,
      Recommendation=recommendation,
      SourceSype=source_type,
      ProviderName="CYFIRMA",
      ProductName="DeCYFIR/DeTCT"
  | project 
      TimeGenerated,
      Description,
      RiskScore,
      FirstSeen,
      LastSeen,
      AlertUID,
      UID,
      AssetType,
      AssetValue,
      Impact,
      Recommendation,
      SourceSype,
      ProductName,
      ProviderName

name: CYFIRMA - Brand Intelligence - Social Media Handle Impersonation Detected High Rule
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyfirma%20Brand%20Intelligence/Analytic%20Rules/BISocialMediaHandlerHighRule.yaml
queryFrequency: 5m
triggerOperator: gt
status: Available
queryPeriod: 5m
requiredDataConnectors:
- connectorId: CyfirmaBrandIntelligenceAlertsDC
  dataTypes:
  - CyfirmaBISocialHandlersAlerts_CL
tactics:
- Reconnaissance
- ResourceDevelopment
- InitialAccess
query: |
  // High severity - Social Media Handle Impersonation
  let timeFrame = 5m;
  CyfirmaBISocialHandlersAlerts_CL 
    | where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())
    | extend
        Description=description,
        FirstSeen=first_seen,
        LastSeen=last_seen,
        RiskScore=risk_score,
        AlertUID=alert_uid,
        UID=uid,
        AssetType=asset_type,
        AssetValue=asset_value,
        Impact=impact,
        Recommendation=recommendation,
        SourceSype=source_type,
        ProviderName="CYFIRMA",
        ProductName="DeCYFIR/DeTCT"
    | project 
        TimeGenerated,
        Description,
        RiskScore,
        FirstSeen,
        LastSeen,
        AlertUID,
        UID,
        AssetType,
        AssetValue,
        Impact,
        Recommendation,
        SourceSype,
        ProductName,
        ProviderName
description: |
  "Detects high-severity alerts related to impersonation of official social media handles associated with your brand. 
  These spoofed accounts may be used for phishing, disinformation, or fraud campaigns, posing significant reputational and security risks."
severity: High
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: PT5H
    enabled: false
    reopenClosedIncident: false
    matchingMethod: AllEntities
  createIncident: true
kind: Scheduled
customDetails:
  Description: Description
  AlertUID: AlertUID
  TimeGenerated: TimeGenerated
  FirstSeen: FirstSeen
  LastSeen: LastSeen
  RiskScore: RiskScore
  UID: UID
  AssetType: AssetType
  AssetValue: AssetValue
  Impact: Impact
  SourceSype: SourceSype
  Recommendation: Recommendation
triggerThreshold: 0
id: 22f49d67-7da7-4809-8d07-89e4478aa6b0
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDescriptionFormat: '{{Description}} '
  alertDynamicProperties:
  - value: ProductName
    alertProperty: ProductName
  - value: ProviderName
    alertProperty: ProviderName
  alertDisplayNameFormat: 'CYFIRMA - High Severity Social Media Handle Impersonation Detected - {{AssetType}}  :  {{AssetValue}} '
version: 1.0.1
relevantTechniques:
- T1589.003
- T1591.002
- T1585.001
- T1566.002

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/22f49d67-7da7-4809-8d07-89e4478aa6b0')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/22f49d67-7da7-4809-8d07-89e4478aa6b0')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "{{Description}} ",
          "alertDisplayNameFormat": "CYFIRMA - High Severity Social Media Handle Impersonation Detected - {{AssetType}}  :  {{AssetValue}} ",
          "alertDynamicProperties": [
            {
              "alertProperty": "ProductName",
              "value": "ProductName"
            },
            {
              "alertProperty": "ProviderName",
              "value": "ProviderName"
            }
          ]
        },
        "alertRuleTemplateName": "22f49d67-7da7-4809-8d07-89e4478aa6b0",
        "customDetails": {
          "AlertUID": "AlertUID",
          "AssetType": "AssetType",
          "AssetValue": "AssetValue",
          "Description": "Description",
          "FirstSeen": "FirstSeen",
          "Impact": "Impact",
          "LastSeen": "LastSeen",
          "Recommendation": "Recommendation",
          "RiskScore": "RiskScore",
          "SourceSype": "SourceSype",
          "TimeGenerated": "TimeGenerated",
          "UID": "UID"
        },
        "description": "\"Detects high-severity alerts related to impersonation of official social media handles associated with your brand. \nThese spoofed accounts may be used for phishing, disinformation, or fraud campaigns, posing significant reputational and security risks.\"\n",
        "displayName": "CYFIRMA - Brand Intelligence - Social Media Handle Impersonation Detected High Rule",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyfirma%20Brand%20Intelligence/Analytic%20Rules/BISocialMediaHandlerHighRule.yaml",
        "query": "// High severity - Social Media Handle Impersonation\nlet timeFrame = 5m;\nCyfirmaBISocialHandlersAlerts_CL \n  | where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())\n  | extend\n      Description=description,\n      FirstSeen=first_seen,\n      LastSeen=last_seen,\n      RiskScore=risk_score,\n      AlertUID=alert_uid,\n      UID=uid,\n      AssetType=asset_type,\n      AssetValue=asset_value,\n      Impact=impact,\n      Recommendation=recommendation,\n      SourceSype=source_type,\n      ProviderName=\"CYFIRMA\",\n      ProductName=\"DeCYFIR/DeTCT\"\n  | project \n      TimeGenerated,\n      Description,\n      RiskScore,\n      FirstSeen,\n      LastSeen,\n      AlertUID,\n      UID,\n      AssetType,\n      AssetValue,\n      Impact,\n      Recommendation,\n      SourceSype,\n      ProductName,\n      ProviderName\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [
          "T1589.003",
          "T1591.002",
          "T1585.001",
          "T1566.002"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess",
          "Reconnaissance",
          "ResourceDevelopment"
        ],
        "techniques": [
          "T1566",
          "T1585",
          "T1589",
          "T1591"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}