Acronis - Multiple Inboxes with Malicious Content Detected

Back


Id	5090ad7b-4b47-4cab-9015-bffb43aecde8
Rulename	Acronis - Multiple Inboxes with Malicious Content Detected
Description	Many inboxes containing malicious content could indicate a potential ongoing phishing attack.
Severity	Medium
Tactics	InitialAccess
Techniques	T1566.002 T1566.001
Kind	Scheduled
Query frequency	1h
Query period	1d
Trigger threshold	2
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Acronis Cyber Protect Cloud/Analytic Rules/AcronisMultipleInboxesWithMaliciousContentDetected.yaml
Version	1.0.0
Arm template	5090ad7b-4b47-4cab-9015-bffb43aecde8.json

KQL

CommonSecurityLog
| where DeviceVendor == "Acronis"
| where DeviceEventClassID in
("MaliciousURLDetectedInM365MailboxBackup",
"MalwareDetectedInM365MailboxBackup",
"MaliciousEmailDetectedPerceptionPointWarning")
| summarize MaliciousContent = count() by DeviceName

YAML

relevantTechniques:
- T1566.002
- T1566.001
queryFrequency: 1h
triggerOperator: gt
description: Many inboxes containing malicious content could indicate a potential ongoing phishing attack.
triggerThreshold: 2
id: 5090ad7b-4b47-4cab-9015-bffb43aecde8
name: Acronis - Multiple Inboxes with Malicious Content Detected
queryPeriod: 1d
customDetails:
  DeviceName: DeviceName
query: |
  CommonSecurityLog
  | where DeviceVendor == "Acronis"
  | where DeviceEventClassID in
  ("MaliciousURLDetectedInM365MailboxBackup",
  "MalwareDetectedInM365MailboxBackup",
  "MaliciousEmailDetectedPerceptionPointWarning")
  | summarize MaliciousContent = count() by DeviceName  
severity: Medium
eventGroupingSettings:
  aggregationKind: SingleAlert
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    reopenClosedIncident: true
    lookbackDuration: P1D
    matchingMethod: AnyAlert
    enabled: true
entityMappings:
- fieldMappings:
  - columnName: DeviceName
    identifier: HostName
  entityType: Host
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Acronis Cyber Protect Cloud/Analytic Rules/AcronisMultipleInboxesWithMaliciousContentDetected.yaml
requiredDataConnectors: []
version: 1.0.0
tactics:
- InitialAccess
kind: Scheduled

ARM