PRODAFT USTA - Non-expired payment card exposed | Microsoft Sentinel Analytic Rules

Back


Id	674429c9-a858-436c-95b8-5808024ebd01
Rulename	PRODAFT USTA - Non-expired payment card exposed
Description	Identifies a new PRODAFT USTA Payment Card Fraud Intelligence ticket that exposes a payment card whose expiration date is still in the future. A non-expired card is immediately usable for fraudulent transactions and is therefore higher risk than an already-expired card. The full card number is never stored - only the BIN, last 4 digits, brand, and length are retained. Prioritize reissue of the affected card with the issuing bank and monitor for fraudulent activity.
Severity	High
Tactics	Impact
Techniques	T1657
Required data connectors	PRODAFTUstaPCFICCPDefinition
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PRODAFT%20USTA%20-%20Payment%20Card%20Fraud%20Intelligence/Analytic%20Rules/NonExpiredPaymentCardExposed.yaml
Version	1.0.0
Arm template	674429c9-a858-436c-95b8-5808024ebd01.json

KQL

PRODAFTUstaCompromisedCards
| where Created > ago(1h)
| where ExpirationDate > now()
| project
    TimeGenerated,
    Created,
    TicketId,
    CompanyName,
    CardBrand,
    CardBin,
    CardLast4,
    CardMasked,
    CardLength,
    ExpirationDate,
    Status

YAML

id: 674429c9-a858-436c-95b8-5808024ebd01
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PRODAFT%20USTA%20-%20Payment%20Card%20Fraud%20Intelligence/Analytic%20Rules/NonExpiredPaymentCardExposed.yaml
triggerOperator: gt
tactics:
- Impact
kind: Scheduled
requiredDataConnectors:
- dataTypes:
  - PRODAFTUstaCompromisedCards_CL
  connectorId: PRODAFTUstaPCFICCPDefinition
queryPeriod: 1h
severity: High
relevantTechniques:
- T1657
triggerThreshold: 0
version: 1.0.0
customDetails:
  Card: CardMasked
  Status: Status
  Company: CompanyName
  Expiration: ExpirationDate
  Brand: CardBrand
  Ticket: TicketId
name: PRODAFT USTA - Non-expired payment card exposed
status: Available
query: |
  PRODAFTUstaCompromisedCards
  | where Created > ago(1h)
  | where ExpirationDate > now()
  | project
      TimeGenerated,
      Created,
      TicketId,
      CompanyName,
      CardBrand,
      CardBin,
      CardLast4,
      CardMasked,
      CardLength,
      ExpirationDate,
      Status
description: |
  'Identifies a new PRODAFT USTA Payment Card Fraud Intelligence ticket that exposes a
  payment card whose expiration date is still in the future. A non-expired card is
  immediately usable for fraudulent transactions and is therefore higher risk than an
  already-expired card. The full card number is never stored - only the BIN, last 4 digits,
  brand, and length are retained. Prioritize reissue of the affected card with the issuing
  bank and monitor for fraudulent activity.'
queryFrequency: 1h
incidentConfiguration:
  groupingConfiguration:
    enabled: true
    lookbackDuration: 1h
    reopenClosedIncident: false
    matchingMethod: AnyAlert
  createIncident: true

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/674429c9-a858-436c-95b8-5808024ebd01')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/674429c9-a858-436c-95b8-5808024ebd01')]",
      "properties": {
        "alertRuleTemplateName": "674429c9-a858-436c-95b8-5808024ebd01",
        "customDetails": {
          "Brand": "CardBrand",
          "Card": "CardMasked",
          "Company": "CompanyName",
          "Expiration": "ExpirationDate",
          "Status": "Status",
          "Ticket": "TicketId"
        },
        "description": "'Identifies a new PRODAFT USTA Payment Card Fraud Intelligence ticket that exposes a\npayment card whose expiration date is still in the future. A non-expired card is\nimmediately usable for fraudulent transactions and is therefore higher risk than an\nalready-expired card. The full card number is never stored - only the BIN, last 4 digits,\nbrand, and length are retained. Prioritize reissue of the affected card with the issuing\nbank and monitor for fraudulent activity.'\n",
        "displayName": "PRODAFT USTA - Non-expired payment card exposed",
        "enabled": true,
        "entityMappings": null,
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "lookbackDuration": "PT1H",
            "matchingMethod": "AnyAlert",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PRODAFT%20USTA%20-%20Payment%20Card%20Fraud%20Intelligence/Analytic%20Rules/NonExpiredPaymentCardExposed.yaml",
        "query": "PRODAFTUstaCompromisedCards\n| where Created > ago(1h)\n| where ExpirationDate > now()\n| project\n    TimeGenerated,\n    Created,\n    TicketId,\n    CompanyName,\n    CardBrand,\n    CardBin,\n    CardLast4,\n    CardMasked,\n    CardLength,\n    ExpirationDate,\n    Status\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1657"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}