Valimail Enforce - DMARC Policy Weakened to None

Back


Id	44ec1fa4-a502-41ae-879a-3aad3557edce
Rulename	Valimail Enforce - DMARC Policy Weakened to None
Description	This query searches for DMARC policies changed to ’none’, which disables enforcement and leaves the domain vulnerable to spoofing and phishing attacks.
Severity	High
Tactics	DefenseEvasion InitialAccess
Techniques	T1566 T1562
Required data connectors	ValimailEnforce
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ValimailEnforce/Analytic Rules/ValimailEnforce_DMARCPolicyWeakened.yaml
Version	1.0.0
Arm template	44ec1fa4-a502-41ae-879a-3aad3557edce.json

KQL

ValimailEnforceEvents_CL
| where EventSeverity == "High"
| where EventType == "dmarc_policy_set_to_none"
| summarize
    EventCount = count(),
    FirstSeen = min(PerformedAt),
    LastSeen = max(PerformedAt),
    Changes = make_set(EventChange)
  by Subject, User, EventCategory
| extend
    AccountName = tostring(split(User, "@")[0]),
    AccountDomain = tostring(split(User, "@")[1]),
    DomainName = Subject

YAML

relevantTechniques:
- T1566
- T1562
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountName
    identifier: Name
  - columnName: AccountDomain
    identifier: UPNSuffix
- entityType: DNS
  fieldMappings:
  - columnName: DomainName
    identifier: DomainName
version: 1.0.0
id: 44ec1fa4-a502-41ae-879a-3aad3557edce
severity: High
kind: Scheduled
queryFrequency: 1h
description: |
  This query searches for DMARC policies changed to 'none', which disables enforcement
  and leaves the domain vulnerable to spoofing and phishing attacks.  
requiredDataConnectors:
- connectorId: ValimailEnforce
  dataTypes:
  - ValimailEnforceEvents_CL
triggerOperator: gt
name: Valimail Enforce - DMARC Policy Weakened to None
tactics:
- DefenseEvasion
- InitialAccess
alertDetailsOverride:
  alertDescriptionFormat: |
    The DMARC policy for domain '{{Subject}}' was set to 'none' by '{{User}}',
    disabling email authentication enforcement. This may expose the domain to spoofing.    
  alertDisplayNameFormat: DMARC policy set to NONE on domain {{Subject}} by {{User}}
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ValimailEnforce/Analytic Rules/ValimailEnforce_DMARCPolicyWeakened.yaml
triggerThreshold: 0
queryPeriod: 1h
query: |
  ValimailEnforceEvents_CL
  | where EventSeverity == "High"
  | where EventType == "dmarc_policy_set_to_none"
  | summarize
      EventCount = count(),
      FirstSeen = min(PerformedAt),
      LastSeen = max(PerformedAt),
      Changes = make_set(EventChange)
    by Subject, User, EventCategory
  | extend
      AccountName = tostring(split(User, "@")[0]),
      AccountDomain = tostring(split(User, "@")[1]),
      DomainName = Subject  
status: Available
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    matchingMethod: Selected
    groupByEntities:
    - DNS
    reopenClosedIncident: false
    enabled: true
    lookbackDuration: 1d

ARM