Digital Guardian - Bulk exfiltration to external domain

Back


Id	5f75a873-b524-4ba5-a3b8-2c20db517148
Rulename	Digital Guardian - Bulk exfiltration to external domain
Description	Detects bulk exfiltration to external domain.
Severity	Medium
Tactics	Exfiltration
Techniques	T1048
Required data connectors	DigitalGuardianDLP SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Digital Guardian Data Loss Prevention/Analytic Rules/DigitalGuardianFilesSentToExternalDomain.yaml
Version	1.0.1
Arm template	5f75a873-b524-4ba5-a3b8-2c20db517148.json

KQL

let threshold = 10;
let corp_domain = dynamic(['example.com']);
DigitalGuardianDLPEvent
| where NetworkApplicationProtocol =~ 'SMTP'
| where isnotempty(inspected_document)
| extend s_domain = extract(@'@(.*)', 1, SrcUserName)
| extend d_domain = extract(@'@(.*)', 1, DstUserName)
| where s_domain in~ (corp_domain)
| where d_domain !in (corp_domain)
| summarize f = dcount(inspected_document) by SrcUserName, DstUserName, bin(TimeGenerated, 30m)
| where  f >= threshold
| extend AccountCustomEntity = SrcUserName

YAML

relevantTechniques:
- T1048
name: Digital Guardian - Bulk exfiltration to external domain
requiredDataConnectors:
- dataTypes:
  - DigitalGuardianDLPEvent
  connectorId: DigitalGuardianDLP
- datatypes:
  - Syslog
  connectorId: SyslogAma
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
  entityType: Account
triggerThreshold: 0
id: 5f75a873-b524-4ba5-a3b8-2c20db517148
tactics:
- Exfiltration
version: 1.0.1
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Digital Guardian Data Loss Prevention/Analytic Rules/DigitalGuardianFilesSentToExternalDomain.yaml
queryPeriod: 1h
kind: Scheduled
queryFrequency: 1h
severity: Medium
status: Available
description: |
    'Detects bulk exfiltration to external domain.'
query: |
  let threshold = 10;
  let corp_domain = dynamic(['example.com']);
  DigitalGuardianDLPEvent
  | where NetworkApplicationProtocol =~ 'SMTP'
  | where isnotempty(inspected_document)
  | extend s_domain = extract(@'@(.*)', 1, SrcUserName)
  | extend d_domain = extract(@'@(.*)', 1, DstUserName)
  | where s_domain in~ (corp_domain)
  | where d_domain !in (corp_domain)
  | summarize f = dcount(inspected_document) by SrcUserName, DstUserName, bin(TimeGenerated, 30m)
  | where  f >= threshold
  | extend AccountCustomEntity = SrcUserName  
triggerOperator: gt

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/5f75a873-b524-4ba5-a3b8-2c20db517148')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/5f75a873-b524-4ba5-a3b8-2c20db517148')]",
      "properties": {
        "alertRuleTemplateName": "5f75a873-b524-4ba5-a3b8-2c20db517148",
        "customDetails": null,
        "description": "'Detects bulk exfiltration to external domain.'\n",
        "displayName": "Digital Guardian - Bulk exfiltration to external domain",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "Name"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Digital Guardian Data Loss Prevention/Analytic Rules/DigitalGuardianFilesSentToExternalDomain.yaml",
        "query": "let threshold = 10;\nlet corp_domain = dynamic(['example.com']);\nDigitalGuardianDLPEvent\n| where NetworkApplicationProtocol =~ 'SMTP'\n| where isnotempty(inspected_document)\n| extend s_domain = extract(@'@(.*)', 1, SrcUserName)\n| extend d_domain = extract(@'@(.*)', 1, DstUserName)\n| where s_domain in~ (corp_domain)\n| where d_domain !in (corp_domain)\n| summarize f = dcount(inspected_document) by SrcUserName, DstUserName, bin(TimeGenerated, 30m)\n| where  f >= threshold\n| extend AccountCustomEntity = SrcUserName\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Exfiltration"
        ],
        "techniques": [
          "T1048"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}