Google DNS - Exchange online autodiscover abuse

Back


Id	424c2aca-5367-4247-917a-5d0f7035e40e
Rulename	Google DNS - Exchange online autodiscover abuse
Description	Detects possible Exchange online autodiscover abuse.
Severity	Medium
Tactics	InitialAccess CredentialAccess
Techniques	T1566 T1187
Required data connectors	GCPDNSDataConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformDNS/Analytic Rules/GCPDNSExchangeAutodiscoverAbuse.yaml
Version	1.0.0
Arm template	424c2aca-5367-4247-917a-5d0f7035e40e.json

KQL

GCPCloudDNS
| where Query has_any ('autodiscover.com.br', 'autodiscover.com.cn', 'autodiscover.com.co', 'autodiscover.es', 'autodiscover.fr', 'autodiscover.in', 'autodiscover.it', 'autodiscover.sg', 'autodiscover.uk', 'autodiscover.xyz', 'autodiscover.online')
| extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr

YAML

name: Google DNS - Exchange online autodiscover abuse
id: 424c2aca-5367-4247-917a-5d0f7035e40e
description: |
    'Detects possible Exchange online autodiscover abuse.'
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - columnName: DNSCustomEntity
    identifier: DomainName
  entityType: DNS
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
version: 1.0.0
triggerOperator: gt
query: |
  GCPCloudDNS
  | where Query has_any ('autodiscover.com.br', 'autodiscover.com.cn', 'autodiscover.com.co', 'autodiscover.es', 'autodiscover.fr', 'autodiscover.in', 'autodiscover.it', 'autodiscover.sg', 'autodiscover.uk', 'autodiscover.xyz', 'autodiscover.online')
  | extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr  
tactics:
- InitialAccess
- CredentialAccess
kind: Scheduled
queryFrequency: 1h
severity: Medium
queryPeriod: 1h
requiredDataConnectors:
- dataTypes:
  - GCPCloudDNS
  connectorId: GCPDNSDataConnector
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformDNS/Analytic Rules/GCPDNSExchangeAutodiscoverAbuse.yaml
relevantTechniques:
- T1566
- T1187

ARM