Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Cyber Evil Twin Site Informational

Back
Id5f39eedb-a8e7-461a-a313-32ef8bc8e3a8
RulenameCyber Evil Twin Site (Informational)
DescriptionNew Cyber Evil Twin Site with severity Informational found
SeverityInformational
TacticsDefenseEvasion
TechniquesT1497
Required data connectorsCBSPollingIDAzureFunctions
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTM360/Analytic Rules/cyber_evil_twin_site_informational.yaml
Version1.0.0
Arm template5f39eedb-a8e7-461a-a313-32ef8bc8e3a8.json
Deploy To Azure
CBSLog_Azure_1_CL | where severity_s == "Informational" | where type_s == "Cyber Evil Twin Site" | where status_s != "Closed" or status_s != "Resolved"
description: New Cyber Evil Twin Site with severity Informational found
status: Available
queryPeriod: 5m
suppressionDuration: 5h
triggerThreshold: 0
id: 5f39eedb-a8e7-461a-a313-32ef8bc8e3a8
version: 1.0.0
requiredDataConnectors:
- connectorId: CBSPollingIDAzureFunctions
  dataTypes:
  - CBSLog_Azure_1_CL
tactics:
- DefenseEvasion
severity: Informational
triggerOperator: gt
eventGroupingSettings:
  aggregationKind: SingleAlert
query: CBSLog_Azure_1_CL | where severity_s == "Informational" | where type_s == "Cyber Evil Twin Site" | where status_s != "Closed" or status_s != "Resolved"
incidentConfiguration:
  groupingConfiguration:
    reopenClosedIncident: false
    matchingMethod: AllEntities
    lookbackDuration: PT5H
    enabled: false
  createIncident: true
name: Cyber Evil Twin Site (Informational)
queryFrequency: 5m
suppressionEnabled: false
kind: Scheduled
relevantTechniques:
- T1497
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTM360/Analytic Rules/cyber_evil_twin_site_informational.yaml
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/5f39eedb-a8e7-461a-a313-32ef8bc8e3a8')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/5f39eedb-a8e7-461a-a313-32ef8bc8e3a8')]",
      "properties": {
        "alertRuleTemplateName": "5f39eedb-a8e7-461a-a313-32ef8bc8e3a8",
        "customDetails": null,
        "description": "New Cyber Evil Twin Site with severity Informational found",
        "displayName": "Cyber Evil Twin Site (Informational)",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTM360/Analytic Rules/cyber_evil_twin_site_informational.yaml",
        "query": "CBSLog_Azure_1_CL | where severity_s == \"Informational\" | where type_s == \"Cyber Evil Twin Site\" | where status_s != \"Closed\" or status_s != \"Resolved\"",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "Informational",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion"
        ],
        "techniques": [
          "T1497"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}