Valimail Enforce - DMARC Policy Weakened to None

Back


Id	44ec1fa4-a502-41ae-879a-3aad3557edce
Rulename	Valimail Enforce - DMARC Policy Weakened to None
Description	This query searches for DMARC policies changed to ’none’, which disables enforcement and leaves the domain vulnerable to spoofing and phishing attacks.
Severity	High
Tactics	DefenseEvasion InitialAccess
Techniques	T1566 T1562
Required data connectors	ValimailEnforce
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ValimailEnforce/Analytic Rules/ValimailEnforce_DMARCPolicyWeakened.yaml
Version	1.0.0
Arm template	44ec1fa4-a502-41ae-879a-3aad3557edce.json

KQL

ValimailEnforceEvents_CL
| where EventSeverity == "High"
| where EventType == "dmarc_policy_set_to_none"
| summarize
    EventCount = count(),
    FirstSeen = min(PerformedAt),
    LastSeen = max(PerformedAt),
    Changes = make_set(EventChange)
  by Subject, User, EventCategory
| extend
    AccountName = tostring(split(User, "@")[0]),
    AccountDomain = tostring(split(User, "@")[1]),
    DomainName = Subject

YAML

id: 44ec1fa4-a502-41ae-879a-3aad3557edce
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ValimailEnforce/Analytic Rules/ValimailEnforce_DMARCPolicyWeakened.yaml
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: AccountName
  - identifier: UPNSuffix
    columnName: AccountDomain
  entityType: Account
- fieldMappings:
  - identifier: DomainName
    columnName: DomainName
  entityType: DNS
requiredDataConnectors:
- dataTypes:
  - ValimailEnforceEvents_CL
  connectorId: ValimailEnforce
queryFrequency: 1h
alertDetailsOverride:
  alertDisplayNameFormat: DMARC policy set to NONE on domain {{Subject}} by {{User}}
  alertDescriptionFormat: |
    The DMARC policy for domain '{{Subject}}' was set to 'none' by '{{User}}',
    disabling email authentication enforcement. This may expose the domain to spoofing.    
queryPeriod: 1h
status: Available
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: 1d
    reopenClosedIncident: false
    matchingMethod: Selected
    groupByEntities:
    - DNS
    enabled: true
  createIncident: true
query: |
  ValimailEnforceEvents_CL
  | where EventSeverity == "High"
  | where EventType == "dmarc_policy_set_to_none"
  | summarize
      EventCount = count(),
      FirstSeen = min(PerformedAt),
      LastSeen = max(PerformedAt),
      Changes = make_set(EventChange)
    by Subject, User, EventCategory
  | extend
      AccountName = tostring(split(User, "@")[0]),
      AccountDomain = tostring(split(User, "@")[1]),
      DomainName = Subject  
name: Valimail Enforce - DMARC Policy Weakened to None
kind: Scheduled
tactics:
- DefenseEvasion
- InitialAccess
severity: High
relevantTechniques:
- T1566
- T1562
triggerThreshold: 0
version: 1.0.0
description: |
  This query searches for DMARC policies changed to 'none', which disables enforcement
  and leaves the domain vulnerable to spoofing and phishing attacks.

ARM