Google DNS - Exchange online autodiscover abuse

Back


Id	424c2aca-5367-4247-917a-5d0f7035e40e
Rulename	Google DNS - Exchange online autodiscover abuse
Description	Detects possible Exchange online autodiscover abuse.
Severity	Medium
Tactics	InitialAccess CredentialAccess
Techniques	T1566 T1187
Required data connectors	GCPDNSDataConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformDNS/Analytic Rules/GCPDNSExchangeAutodiscoverAbuse.yaml
Version	1.0.0
Arm template	424c2aca-5367-4247-917a-5d0f7035e40e.json

KQL

GCPCloudDNS
| where Query has_any ('autodiscover.com.br', 'autodiscover.com.cn', 'autodiscover.com.co', 'autodiscover.es', 'autodiscover.fr', 'autodiscover.in', 'autodiscover.it', 'autodiscover.sg', 'autodiscover.uk', 'autodiscover.xyz', 'autodiscover.online')
| extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformDNS/Analytic Rules/GCPDNSExchangeAutodiscoverAbuse.yaml
version: 1.0.0
queryPeriod: 1h
query: |
  GCPCloudDNS
  | where Query has_any ('autodiscover.com.br', 'autodiscover.com.cn', 'autodiscover.com.co', 'autodiscover.es', 'autodiscover.fr', 'autodiscover.in', 'autodiscover.it', 'autodiscover.sg', 'autodiscover.uk', 'autodiscover.xyz', 'autodiscover.online')
  | extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr  
kind: Scheduled
name: Google DNS - Exchange online autodiscover abuse
triggerOperator: gt
severity: Medium
id: 424c2aca-5367-4247-917a-5d0f7035e40e
triggerThreshold: 0
entityMappings:
- entityType: DNS
  fieldMappings:
  - identifier: DomainName
    columnName: DNSCustomEntity
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
queryFrequency: 1h
description: |
    'Detects possible Exchange online autodiscover abuse.'
requiredDataConnectors:
- connectorId: GCPDNSDataConnector
  dataTypes:
  - GCPCloudDNS
relevantTechniques:
- T1566
- T1187
tactics:
- InitialAccess
- CredentialAccess

ARM