ProofpointPOD - Email sender in TI list

Back


Id	35a0792a-1269-431e-ac93-7ae2980d4dde
Rulename	ProofpointPOD - Email sender in TI list
Description	Email sender in TI list.
Severity	Medium
Tactics	Exfiltration InitialAccess
Techniques	T1078 T1567
Required data connectors	ProofpointPOD ThreatIntelligence ThreatIntelligenceTaxii
Kind	Scheduled
Query frequency	1d
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODEmailSenderInTIList.yaml
Version	1.1.2
Arm template	35a0792a-1269-431e-ac93-7ae2980d4dde.json

KQL

let dt_lookBack = 1h;
let ioc_lookBack = 14d;
ThreatIntelligenceIndicator
| where TimeGenerated >= ago(ioc_lookBack) and ExpirationDateTime > now()
| where Active == true
| where isnotempty(EmailSenderAddress)
| extend TI_emailEntity = EmailSenderAddress
// using innerunique to keep perf fast and result set low, we only need one match to indicate potential malicious activity that needs to be investigated
| join kind=innerunique (
       ProofpointPOD
       | where TimeGenerated >= ago(dt_lookBack)
       | where isnotempty(SrcUserUpn)
       | extend ProofpointPOD_TimeGenerated = TimeGenerated, ClientEmail = SrcUserUpn
)
on $left.TI_emailEntity == $right.ClientEmail
| where ProofpointPOD_TimeGenerated < ExpirationDateTime
| summarize ProofpointPOD_TimeGenerated = arg_max(ProofpointPOD_TimeGenerated, *) by IndicatorId, ClientEmail
| project ProofpointPOD_TimeGenerated, Description, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, ClientEmail
| extend timestamp = ProofpointPOD_TimeGenerated

YAML

queryPeriod: 14d
query: |
  let dt_lookBack = 1h;
  let ioc_lookBack = 14d;
  ThreatIntelligenceIndicator
  | where TimeGenerated >= ago(ioc_lookBack) and ExpirationDateTime > now()
  | where Active == true
  | where isnotempty(EmailSenderAddress)
  | extend TI_emailEntity = EmailSenderAddress
  // using innerunique to keep perf fast and result set low, we only need one match to indicate potential malicious activity that needs to be investigated
  | join kind=innerunique (
         ProofpointPOD
         | where TimeGenerated >= ago(dt_lookBack)
         | where isnotempty(SrcUserUpn)
         | extend ProofpointPOD_TimeGenerated = TimeGenerated, ClientEmail = SrcUserUpn
  )
  on $left.TI_emailEntity == $right.ClientEmail
  | where ProofpointPOD_TimeGenerated < ExpirationDateTime
  | summarize ProofpointPOD_TimeGenerated = arg_max(ProofpointPOD_TimeGenerated, *) by IndicatorId, ClientEmail
  | project ProofpointPOD_TimeGenerated, Description, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, ClientEmail
  | extend timestamp = ProofpointPOD_TimeGenerated  
name: ProofpointPOD - Email sender in TI list
entityMappings:
- fieldMappings:
  - columnName: ClientEmail
    identifier: FullName
  entityType: Account
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODEmailSenderInTIList.yaml
requiredDataConnectors:
- connectorId: ThreatIntelligence
  dataTypes:
  - ThreatIntelligenceIndicator
- connectorId: ThreatIntelligenceTaxii
  dataTypes:
  - ThreatIntelligenceIndicator
- connectorId: ProofpointPOD
  dataTypes:
  - ProofpointPOD_maillog_CL
description: |
    'Email sender in TI list.'
kind: Scheduled
version: 1.1.2
queryFrequency: 1d
severity: Medium
relevantTechniques:
- T1078
- T1567
triggerOperator: gt
triggerThreshold: 0
tactics:
- Exfiltration
- InitialAccess
id: 35a0792a-1269-431e-ac93-7ae2980d4dde

ARM