Valimail Enforce - Email Authentication Key Deleted

Back


Id	483078c6-d029-40f3-931a-30af0032008b
Rulename	Valimail Enforce - Email Authentication Key Deleted
Description	This query searches for deletion of SPF delegations or DKIM keys, which are medium-severity events that could degrade email authentication posture for a domain.
Severity	Medium
Tactics	DefenseEvasion
Techniques	T1562
Required data connectors	ValimailEnforce
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ValimailEnforce/Analytic Rules/ValimailEnforce_AuthKeyChanged.yaml
Version	1.0.0
Arm template	483078c6-d029-40f3-931a-30af0032008b.json

KQL

ValimailEnforceEvents_CL
| where EventSeverity == "Medium"
| where EventCategory in ("SPFConfiguration", "DKIMConfiguration")
| where IsHighValueEvent == true
| summarize
    EventCount = count(),
    FirstSeen = min(PerformedAt),
    LastSeen = max(PerformedAt),
    AffectedDomains = make_set(Subject),
    Actions = make_set(EventType)
  by User, EventCategory
| extend
    AccountName = tostring(split(User, "@")[0]),
    AccountDomain = tostring(split(User, "@")[1]),
    DomainName = tostring(AffectedDomains[0])

YAML

id: 483078c6-d029-40f3-931a-30af0032008b
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ValimailEnforce/Analytic Rules/ValimailEnforce_AuthKeyChanged.yaml
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: AccountName
  - identifier: UPNSuffix
    columnName: AccountDomain
  entityType: Account
- fieldMappings:
  - identifier: DomainName
    columnName: DomainName
  entityType: DNS
requiredDataConnectors:
- dataTypes:
  - ValimailEnforceEvents_CL
  connectorId: ValimailEnforce
queryFrequency: 1h
alertDetailsOverride:
  alertDisplayNameFormat: '{{EventCategory}} key deleted on {{EventCount}} domain(s) by {{User}}'
  alertDescriptionFormat: |
    User '{{User}}' deleted one or more {{EventCategory}} records affecting
    domains: {{AffectedDomains}}. This may weaken email authentication posture.    
queryPeriod: 1h
status: Available
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: 1d
    reopenClosedIncident: false
    matchingMethod: Selected
    groupByEntities:
    - Account
    enabled: true
  createIncident: true
query: |
  ValimailEnforceEvents_CL
  | where EventSeverity == "Medium"
  | where EventCategory in ("SPFConfiguration", "DKIMConfiguration")
  | where IsHighValueEvent == true
  | summarize
      EventCount = count(),
      FirstSeen = min(PerformedAt),
      LastSeen = max(PerformedAt),
      AffectedDomains = make_set(Subject),
      Actions = make_set(EventType)
    by User, EventCategory
  | extend
      AccountName = tostring(split(User, "@")[0]),
      AccountDomain = tostring(split(User, "@")[1]),
      DomainName = tostring(AffectedDomains[0])  
name: Valimail Enforce - Email Authentication Key Deleted
kind: Scheduled
tactics:
- DefenseEvasion
severity: Medium
relevantTechniques:
- T1562
triggerThreshold: 0
version: 1.0.0
description: |
  This query searches for deletion of SPF delegations or DKIM keys, which are medium-severity events
  that could degrade email authentication posture for a domain.

ARM