Acronis - Multiple Inboxes with Malicious Content Detected

Back


Id	5090ad7b-4b47-4cab-9015-bffb43aecde8
Rulename	Acronis - Multiple Inboxes with Malicious Content Detected
Description	Many inboxes containing malicious content could indicate a potential ongoing phishing attack.
Severity	Medium
Tactics	InitialAccess
Techniques	T1566.002 T1566.001
Kind	Scheduled
Query frequency	1h
Query period	1d
Trigger threshold	2
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Acronis Cyber Protect Cloud/Analytic Rules/AcronisMultipleInboxesWithMaliciousContentDetected.yaml
Version	1.0.0
Arm template	5090ad7b-4b47-4cab-9015-bffb43aecde8.json

KQL

CommonSecurityLog
| where DeviceVendor == "Acronis"
| where DeviceEventClassID in
("MaliciousURLDetectedInM365MailboxBackup",
"MalwareDetectedInM365MailboxBackup",
"MaliciousEmailDetectedPerceptionPointWarning")
| summarize MaliciousContent = count() by DeviceName

YAML

name: Acronis - Multiple Inboxes with Malicious Content Detected
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    lookbackDuration: P1D
    enabled: true
    matchingMethod: AnyAlert
    reopenClosedIncident: true
queryPeriod: 1d
eventGroupingSettings:
  aggregationKind: SingleAlert
requiredDataConnectors: []
id: 5090ad7b-4b47-4cab-9015-bffb43aecde8
kind: Scheduled
triggerThreshold: 2
entityMappings:
- entityType: Host
  fieldMappings:
  - columnName: DeviceName
    identifier: HostName
relevantTechniques:
- T1566.002
- T1566.001
queryFrequency: 1h
tactics:
- InitialAccess
triggerOperator: gt
query: |
  CommonSecurityLog
  | where DeviceVendor == "Acronis"
  | where DeviceEventClassID in
  ("MaliciousURLDetectedInM365MailboxBackup",
  "MalwareDetectedInM365MailboxBackup",
  "MaliciousEmailDetectedPerceptionPointWarning")
  | summarize MaliciousContent = count() by DeviceName  
version: 1.0.0
description: Many inboxes containing malicious content could indicate a potential ongoing phishing attack.
severity: Medium
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Acronis Cyber Protect Cloud/Analytic Rules/AcronisMultipleInboxesWithMaliciousContentDetected.yaml
customDetails:
  DeviceName: DeviceName

ARM