AR Microsoft Sentinel Analytic Rules ONLINE

Analytic rule catalog

Whisper Security - Newly Registered Domain on Threat ASN

Back
Id4f80ee8e-901f-538a-8603-cc4b49e80164
RulenameWhisper Security - Newly Registered Domain on Threat ASN
DescriptionIdentifies newly registered domains (under 7 days old) hosted on autonomous systems with elevated threat scores. This combination often indicates adversary infrastructure staging for phishing, malware delivery, or C2 operations.
SeverityHigh
TacticsResourceDevelopment
TechniquesT1583
Required data connectorsWhisperSecurityConnector
KindScheduled
Query frequency1h
Query period1d
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Whisper/Analytic%20Rules/NewlyRegisteredDomainThreatASN.yaml
Version1.0.0
Arm template4f80ee8e-901f-538a-8603-cc4b49e80164.json
Deploy To Azure
// MITRE ATT&CK: T1583.001 - Acquire Infrastructure: Domains
// Tactic: Resource Development
// Correlates newly registered domains with high-threat ASN reputation data
let maxDomainAgeDays = 7;
let asnThreatThreshold = 50;
// Defensive: WhisperInfraChainPipeline currently emits domainAge=-1 as a
// sentinel when the create date is unknown (tracked bug - proper fix needs
// CALL whisper.history() integration). Filter the sentinel out so the rule
// does not fire on every domain with an ASN.
let newDomains = WhisperInfraContext_CL
    | where TimeGenerated > ago(1d)
    | where domainAge >= 0 and domainAge < maxDomainAgeDays
    | where isnotempty(asns)
    | extend parsedAsn = tostring(split(asns, ",")[0])
    | extend parsedIp = tostring(split(ipAddresses, ",")[0])
    | project TimeGenerated, indicator, domainAge, parsedAsn, parsedIp, registrar, countries;
let threatAsns = WhisperASNReputation_CL
    | where TimeGenerated > ago(1d)
    | where maxThreatScore > asnThreatThreshold
    | project asn, asnName, reputationScore, reputationLevel, maxThreatScore;
newDomains
    | join kind=inner (threatAsns) on $left.parsedAsn == $right.asn
    | extend DnsDomain = indicator, IPAddress = parsedIp
    | project TimeGenerated, DnsDomain, IPAddress, domainAge, registrar, countries, asn, asnName, reputationScore, reputationLevel, maxThreatScore

relevantTechniques:
- T1583
queryPeriod: 1d
query: |
  // MITRE ATT&CK: T1583.001 - Acquire Infrastructure: Domains
  // Tactic: Resource Development
  // Correlates newly registered domains with high-threat ASN reputation data
  let maxDomainAgeDays = 7;
  let asnThreatThreshold = 50;
  // Defensive: WhisperInfraChainPipeline currently emits domainAge=-1 as a
  // sentinel when the create date is unknown (tracked bug - proper fix needs
  // CALL whisper.history() integration). Filter the sentinel out so the rule
  // does not fire on every domain with an ASN.
  let newDomains = WhisperInfraContext_CL
      | where TimeGenerated > ago(1d)
      | where domainAge >= 0 and domainAge < maxDomainAgeDays
      | where isnotempty(asns)
      | extend parsedAsn = tostring(split(asns, ",")[0])
      | extend parsedIp = tostring(split(ipAddresses, ",")[0])
      | project TimeGenerated, indicator, domainAge, parsedAsn, parsedIp, registrar, countries;
  let threatAsns = WhisperASNReputation_CL
      | where TimeGenerated > ago(1d)
      | where maxThreatScore > asnThreatThreshold
      | project asn, asnName, reputationScore, reputationLevel, maxThreatScore;
  newDomains
      | join kind=inner (threatAsns) on $left.parsedAsn == $right.asn
      | extend DnsDomain = indicator, IPAddress = parsedIp
      | project TimeGenerated, DnsDomain, IPAddress, domainAge, registrar, countries, asn, asnName, reputationScore, reputationLevel, maxThreatScore
id: 4f80ee8e-901f-538a-8603-cc4b49e80164
entityMappings:
- entityType: DNS
  fieldMappings:
  - identifier: DomainName
    columnName: DnsDomain
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPAddress
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: PT5H
    matchingMethod: AllEntities
    reopenClosedIncident: false
    enabled: true
  createIncident: true
description: |
  Identifies newly registered domains (under 7 days old) hosted on autonomous systems with elevated threat scores. This combination often indicates adversary infrastructure staging for phishing, malware delivery, or C2 operations.
kind: Scheduled
triggerOperator: gt
queryFrequency: 1h
severity: High
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Whisper/Analytic%20Rules/NewlyRegisteredDomainThreatASN.yaml
tactics:
- ResourceDevelopment
triggerThreshold: 0
status: Available
version: 1.0.0
requiredDataConnectors:
- connectorId: WhisperSecurityConnector
  dataTypes:
  - WhisperASNReputation_CL
  - WhisperInfraContext_CL
name: Whisper Security - Newly Registered Domain on Threat ASN
customDetails:
  ASNName: asnName
  DomainAgeDays: domainAge
  MaxThreatScore: maxThreatScore
  ReputationScore: reputationScore

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/4f80ee8e-901f-538a-8603-cc4b49e80164')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/4f80ee8e-901f-538a-8603-cc4b49e80164')]",
      "properties": {
        "alertRuleTemplateName": "4f80ee8e-901f-538a-8603-cc4b49e80164",
        "customDetails": {
          "ASNName": "asnName",
          "DomainAgeDays": "domainAge",
          "MaxThreatScore": "maxThreatScore",
          "ReputationScore": "reputationScore"
        },
        "description": "Identifies newly registered domains (under 7 days old) hosted on autonomous systems with elevated threat scores. This combination often indicates adversary infrastructure staging for phishing, malware delivery, or C2 operations.\n",
        "displayName": "Whisper Security - Newly Registered Domain on Threat ASN",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "DNS",
            "fieldMappings": [
              {
                "columnName": "DnsDomain",
                "identifier": "DomainName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPAddress",
                "identifier": "Address"
              }
            ]
          }
        ],
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Whisper/Analytic%20Rules/NewlyRegisteredDomainThreatASN.yaml",
        "query": "// MITRE ATT&CK: T1583.001 - Acquire Infrastructure: Domains\n// Tactic: Resource Development\n// Correlates newly registered domains with high-threat ASN reputation data\nlet maxDomainAgeDays = 7;\nlet asnThreatThreshold = 50;\n// Defensive: WhisperInfraChainPipeline currently emits domainAge=-1 as a\n// sentinel when the create date is unknown (tracked bug - proper fix needs\n// CALL whisper.history() integration). Filter the sentinel out so the rule\n// does not fire on every domain with an ASN.\nlet newDomains = WhisperInfraContext_CL\n    | where TimeGenerated > ago(1d)\n    | where domainAge >= 0 and domainAge < maxDomainAgeDays\n    | where isnotempty(asns)\n    | extend parsedAsn = tostring(split(asns, \",\")[0])\n    | extend parsedIp = tostring(split(ipAddresses, \",\")[0])\n    | project TimeGenerated, indicator, domainAge, parsedAsn, parsedIp, registrar, countries;\nlet threatAsns = WhisperASNReputation_CL\n    | where TimeGenerated > ago(1d)\n    | where maxThreatScore > asnThreatThreshold\n    | project asn, asnName, reputationScore, reputationLevel, maxThreatScore;\nnewDomains\n    | join kind=inner (threatAsns) on $left.parsedAsn == $right.asn\n    | extend DnsDomain = indicator, IPAddress = parsedIp\n    | project TimeGenerated, DnsDomain, IPAddress, domainAge, registrar, countries, asn, asnName, reputationScore, reputationLevel, maxThreatScore\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P1D",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "ResourceDevelopment"
        ],
        "techniques": [
          "T1583"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}