GSA - TI Domain Entity

Back


Id	4ef07345-5d89-4f5b-9c64-a180d81a6176
Rulename	GSA - TI Domain Entity
Description	This query identifies Domain indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in GSA NetworkAccessTraffic.
Severity	Medium
Tactics	CommandAndControl
Techniques	T1071
Required data connectors	AzureActiveDirectory
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Global Secure Access/Analytic Rules/GSA - TI Domain Entity.yaml
Arm template	4ef07345-5d89-4f5b-9c64-a180d81a6176.json

KQL

let dt_lookBack = 1h;
let ioc_lookBack = 14d;
let NetworkAccessTraff_ = NetworkAccessTraffic
| where TimeGenerated >= ago(dt_lookBack)
| where TrafficType == "internet"
| where isnotempty(DestinationFqdn)
| extend Domain = extract(@'([^.]+\.[^.]+)$', 1, DestinationFqdn)
| project-rename GSANetworkAccessTraffic_TimeGenerated = TimeGenerated;
let NetworkAccessTraffiDomains =
    NetworkAccessTraff_
    | distinct Domain;
ThreatIntelIndicators
  | extend IndicatorType = replace(@'\[|\]|"""', "", tostring(split(ObservableKey, ":", 0)))
  | where IndicatorType == "domain-name"
  | extend DomainName = tolower(ObservableValue)
  | where TimeGenerated >= ago(ioc_lookBack)
  | extend IndicatorId = tostring(split(Id, "--")[2])
  | where DomainName in (NetworkAccessTraffiDomains)
  | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id, ObservableValue
  | where IsActive and (ValidUntil > now() or isempty(ValidUntil))
  | extend Description = tostring(parse_json(Data).description)
  | extend TrafficLightProtocolLevel = tostring(parse_json(AdditionalFields).TLPLevel)
  | where Description !contains_cs "State: inactive;" and Description !contains_cs "State: falsepos;"
  | project-reorder *, IsActive, Tags, TrafficLightProtocolLevel, DomainName, Type
  | join kind=innerunique (NetworkAccessTraff_) on $left.DomainName == $right.Domain
  | extend GSAThreatType = ThreatType
  | summarize GSANetworkAccessTraffic_TimeGenerated = arg_max(GSANetworkAccessTraffic_TimeGenerated, *) by Id, DestinationFqdn
  | project-reorder *,
    Tags,
    TrafficLightProtocolLevel,
    Type,
    DomainName,
    UserPrincipalName,
    UserId,
    DeviceId,
    InitiatingProcessName,
    GSAThreatType,
    DestinationUrl,
    DestinationPort,
    SourceIp,
    SourcePort,
    HttpUserAgent

YAML

queryPeriod: 14d
kind: Scheduled
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: UserPrincipalName
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SourceIp
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: DestinationFqdn
- entityType: Process
  fieldMappings:
  - identifier: CommandLine
    columnName: InitiatingProcessName
requiredDataConnectors:
- connectorId: AzureActiveDirectory
  dataTypes:
  - NetworkAccessTrafficLogs
description: |
    This query identifies Domain indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in GSA NetworkAccessTraffic.
queryFrequency: 1h
triggerOperator: gt
query: |
  let dt_lookBack = 1h;
  let ioc_lookBack = 14d;
  let NetworkAccessTraff_ = NetworkAccessTraffic
  | where TimeGenerated >= ago(dt_lookBack)
  | where TrafficType == "internet"
  | where isnotempty(DestinationFqdn)
  | extend Domain = extract(@'([^.]+\.[^.]+)$', 1, DestinationFqdn)
  | project-rename GSANetworkAccessTraffic_TimeGenerated = TimeGenerated;
  let NetworkAccessTraffiDomains =
      NetworkAccessTraff_
      | distinct Domain;
  ThreatIntelIndicators
    | extend IndicatorType = replace(@'\[|\]|"""', "", tostring(split(ObservableKey, ":", 0)))
    | where IndicatorType == "domain-name"
    | extend DomainName = tolower(ObservableValue)
    | where TimeGenerated >= ago(ioc_lookBack)
    | extend IndicatorId = tostring(split(Id, "--")[2])
    | where DomainName in (NetworkAccessTraffiDomains)
    | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id, ObservableValue
    | where IsActive and (ValidUntil > now() or isempty(ValidUntil))
    | extend Description = tostring(parse_json(Data).description)
    | extend TrafficLightProtocolLevel = tostring(parse_json(AdditionalFields).TLPLevel)
    | where Description !contains_cs "State: inactive;" and Description !contains_cs "State: falsepos;"
    | project-reorder *, IsActive, Tags, TrafficLightProtocolLevel, DomainName, Type
    | join kind=innerunique (NetworkAccessTraff_) on $left.DomainName == $right.Domain
    | extend GSAThreatType = ThreatType
    | summarize GSANetworkAccessTraffic_TimeGenerated = arg_max(GSANetworkAccessTraffic_TimeGenerated, *) by Id, DestinationFqdn
    | project-reorder *,
      Tags,
      TrafficLightProtocolLevel,
      Type,
      DomainName,
      UserPrincipalName,
      UserId,
      DeviceId,
      InitiatingProcessName,
      GSAThreatType,
      DestinationUrl,
      DestinationPort,
      SourceIp,
      SourcePort,
      HttpUserAgent  
name: GSA - TI Domain Entity
id: 4ef07345-5d89-4f5b-9c64-a180d81a6176
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Global Secure Access/Analytic Rules/GSA - TI Domain Entity.yaml
severity: Medium
status: Available
relevantTechniques:
- T1071
triggerThreshold: 0
tactics:
- CommandAndControl

ARM