AR Microsoft Sentinel Analytic Rules ONLINE

Analytic rule catalog

Whisper Security - Newly Registered Domain on Threat ASN

Back
Id4f80ee8e-901f-538a-8603-cc4b49e80164
RulenameWhisper Security - Newly Registered Domain on Threat ASN
DescriptionIdentifies newly registered domains (under 7 days old) hosted on autonomous systems with elevated threat scores. This combination often indicates adversary infrastructure staging for phishing, malware delivery, or C2 operations.
SeverityHigh
TacticsResourceDevelopment
TechniquesT1583
Required data connectorsWhisperSecurityConnector
KindScheduled
Query frequency1h
Query period1d
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Whisper/Analytic%20Rules/NewlyRegisteredDomainThreatASN.yaml
Version1.0.0
Arm template4f80ee8e-901f-538a-8603-cc4b49e80164.json
Deploy To Azure
// MITRE ATT&CK: T1583.001 - Acquire Infrastructure: Domains
// Tactic: Resource Development
// Correlates newly registered domains with high-threat ASN reputation data
let maxDomainAgeDays = 7;
let asnThreatThreshold = 50;
// Defensive: WhisperInfraChainPipeline currently emits domainAge=-1 as a
// sentinel when the create date is unknown (tracked bug - proper fix needs
// CALL whisper.history() integration). Filter the sentinel out so the rule
// does not fire on every domain with an ASN.
let newDomains = WhisperInfraContext_CL
    | where TimeGenerated > ago(1d)
    | where domainAge >= 0 and domainAge < maxDomainAgeDays
    | where isnotempty(asns)
    | extend parsedAsn = tostring(split(asns, ",")[0])
    | extend parsedIp = tostring(split(ipAddresses, ",")[0])
    | project TimeGenerated, indicator, domainAge, parsedAsn, parsedIp, registrar, countries;
let threatAsns = WhisperASNReputation_CL
    | where TimeGenerated > ago(1d)
    | where maxThreatScore > asnThreatThreshold
    | project asn, asnName, reputationScore, reputationLevel, maxThreatScore;
newDomains
    | join kind=inner (threatAsns) on $left.parsedAsn == $right.asn
    | extend DnsDomain = indicator, IPAddress = parsedIp
    | project TimeGenerated, DnsDomain, IPAddress, domainAge, registrar, countries, asn, asnName, reputationScore, reputationLevel, maxThreatScore

incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: PT5H
    reopenClosedIncident: false
    matchingMethod: AllEntities
    enabled: true
  createIncident: true
name: Whisper Security - Newly Registered Domain on Threat ASN
triggerOperator: gt
query: |
  // MITRE ATT&CK: T1583.001 - Acquire Infrastructure: Domains
  // Tactic: Resource Development
  // Correlates newly registered domains with high-threat ASN reputation data
  let maxDomainAgeDays = 7;
  let asnThreatThreshold = 50;
  // Defensive: WhisperInfraChainPipeline currently emits domainAge=-1 as a
  // sentinel when the create date is unknown (tracked bug - proper fix needs
  // CALL whisper.history() integration). Filter the sentinel out so the rule
  // does not fire on every domain with an ASN.
  let newDomains = WhisperInfraContext_CL
      | where TimeGenerated > ago(1d)
      | where domainAge >= 0 and domainAge < maxDomainAgeDays
      | where isnotempty(asns)
      | extend parsedAsn = tostring(split(asns, ",")[0])
      | extend parsedIp = tostring(split(ipAddresses, ",")[0])
      | project TimeGenerated, indicator, domainAge, parsedAsn, parsedIp, registrar, countries;
  let threatAsns = WhisperASNReputation_CL
      | where TimeGenerated > ago(1d)
      | where maxThreatScore > asnThreatThreshold
      | project asn, asnName, reputationScore, reputationLevel, maxThreatScore;
  newDomains
      | join kind=inner (threatAsns) on $left.parsedAsn == $right.asn
      | extend DnsDomain = indicator, IPAddress = parsedIp
      | project TimeGenerated, DnsDomain, IPAddress, domainAge, registrar, countries, asn, asnName, reputationScore, reputationLevel, maxThreatScore
queryFrequency: 1h
description: |
  Identifies newly registered domains (under 7 days old) hosted on autonomous systems with elevated threat scores. This combination often indicates adversary infrastructure staging for phishing, malware delivery, or C2 operations.
id: 4f80ee8e-901f-538a-8603-cc4b49e80164
triggerThreshold: 0
queryPeriod: 1d
version: 1.0.0
kind: Scheduled
customDetails:
  ReputationScore: reputationScore
  MaxThreatScore: maxThreatScore
  ASNName: asnName
  DomainAgeDays: domainAge
status: Available
severity: High
requiredDataConnectors:
- connectorId: WhisperSecurityConnector
  dataTypes:
  - WhisperASNReputation_CL
  - WhisperInfraContext_CL
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Whisper/Analytic%20Rules/NewlyRegisteredDomainThreatASN.yaml
relevantTechniques:
- T1583
tactics:
- ResourceDevelopment
entityMappings:
- fieldMappings:
  - identifier: DomainName
    columnName: DnsDomain
  entityType: DNS
- fieldMappings:
  - identifier: Address
    columnName: IPAddress
  entityType: IP

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/4f80ee8e-901f-538a-8603-cc4b49e80164')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/4f80ee8e-901f-538a-8603-cc4b49e80164')]",
      "properties": {
        "alertRuleTemplateName": "4f80ee8e-901f-538a-8603-cc4b49e80164",
        "customDetails": {
          "ASNName": "asnName",
          "DomainAgeDays": "domainAge",
          "MaxThreatScore": "maxThreatScore",
          "ReputationScore": "reputationScore"
        },
        "description": "Identifies newly registered domains (under 7 days old) hosted on autonomous systems with elevated threat scores. This combination often indicates adversary infrastructure staging for phishing, malware delivery, or C2 operations.\n",
        "displayName": "Whisper Security - Newly Registered Domain on Threat ASN",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "DNS",
            "fieldMappings": [
              {
                "columnName": "DnsDomain",
                "identifier": "DomainName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPAddress",
                "identifier": "Address"
              }
            ]
          }
        ],
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Whisper/Analytic%20Rules/NewlyRegisteredDomainThreatASN.yaml",
        "query": "// MITRE ATT&CK: T1583.001 - Acquire Infrastructure: Domains\n// Tactic: Resource Development\n// Correlates newly registered domains with high-threat ASN reputation data\nlet maxDomainAgeDays = 7;\nlet asnThreatThreshold = 50;\n// Defensive: WhisperInfraChainPipeline currently emits domainAge=-1 as a\n// sentinel when the create date is unknown (tracked bug - proper fix needs\n// CALL whisper.history() integration). Filter the sentinel out so the rule\n// does not fire on every domain with an ASN.\nlet newDomains = WhisperInfraContext_CL\n    | where TimeGenerated > ago(1d)\n    | where domainAge >= 0 and domainAge < maxDomainAgeDays\n    | where isnotempty(asns)\n    | extend parsedAsn = tostring(split(asns, \",\")[0])\n    | extend parsedIp = tostring(split(ipAddresses, \",\")[0])\n    | project TimeGenerated, indicator, domainAge, parsedAsn, parsedIp, registrar, countries;\nlet threatAsns = WhisperASNReputation_CL\n    | where TimeGenerated > ago(1d)\n    | where maxThreatScore > asnThreatThreshold\n    | project asn, asnName, reputationScore, reputationLevel, maxThreatScore;\nnewDomains\n    | join kind=inner (threatAsns) on $left.parsedAsn == $right.asn\n    | extend DnsDomain = indicator, IPAddress = parsedIp\n    | project TimeGenerated, DnsDomain, IPAddress, domainAge, registrar, countries, asn, asnName, reputationScore, reputationLevel, maxThreatScore\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P1D",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "ResourceDevelopment"
        ],
        "techniques": [
          "T1583"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}