Google DNS - Exchange online autodiscover abuse

Back


Id	424c2aca-5367-4247-917a-5d0f7035e40e
Rulename	Google DNS - Exchange online autodiscover abuse
Description	Detects possible Exchange online autodiscover abuse.
Severity	Medium
Tactics	InitialAccess CredentialAccess
Techniques	T1566 T1187
Required data connectors	GCPDNSDataConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformDNS/Analytic Rules/GCPDNSExchangeAutodiscoverAbuse.yaml
Version	1.0.0
Arm template	424c2aca-5367-4247-917a-5d0f7035e40e.json

KQL

GCPCloudDNS
| where Query has_any ('autodiscover.com.br', 'autodiscover.com.cn', 'autodiscover.com.co', 'autodiscover.es', 'autodiscover.fr', 'autodiscover.in', 'autodiscover.it', 'autodiscover.sg', 'autodiscover.uk', 'autodiscover.xyz', 'autodiscover.online')
| extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr

YAML

queryPeriod: 1h
query: |
  GCPCloudDNS
  | where Query has_any ('autodiscover.com.br', 'autodiscover.com.cn', 'autodiscover.com.co', 'autodiscover.es', 'autodiscover.fr', 'autodiscover.in', 'autodiscover.it', 'autodiscover.sg', 'autodiscover.uk', 'autodiscover.xyz', 'autodiscover.online')
  | extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr  
name: Google DNS - Exchange online autodiscover abuse
entityMappings:
- fieldMappings:
  - columnName: DNSCustomEntity
    identifier: DomainName
  entityType: DNS
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformDNS/Analytic Rules/GCPDNSExchangeAutodiscoverAbuse.yaml
requiredDataConnectors:
- connectorId: GCPDNSDataConnector
  dataTypes:
  - GCPCloudDNS
description: |
    'Detects possible Exchange online autodiscover abuse.'
kind: Scheduled
version: 1.0.0
queryFrequency: 1h
severity: Medium
relevantTechniques:
- T1566
- T1187
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
- CredentialAccess
id: 424c2aca-5367-4247-917a-5d0f7035e40e

ARM