Corelight - Possible Typo Squatting or Punycode Phishing HTTP Request

Back


Id	6b579e98-abc9-4e7a-9efc-2f3408ba16c9
Rulename	Corelight - Possible Typo Squatting or Punycode Phishing HTTP Request
Description	Detects when an HTTP request was made to a domain that was using unicode/punycode.
Severity	Medium
Tactics	InitialAccess
Techniques	T1566
Required data connectors	Corelight
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Corelight/Analytic Rules/CorelightTypoSquattingOrPunycodePhishingHTTPRequest.yaml
Version	2.1.0
Arm template	6b579e98-abc9-4e7a-9efc-2f3408ba16c9.json

KQL

corelight_http
| where method =~ 'GET'
| where isempty(referrer)
| where host has 'xn--'

YAML

relevantTechniques:
- T1566
name: Corelight - Possible Typo Squatting or Punycode Phishing HTTP Request
queryFrequency: 1h
version: 2.1.0
triggerThreshold: 0
severity: Medium
requiredDataConnectors:
- connectorId: Corelight
  dataTypes:
  - Corelight_v2_http
  - corelight_http
tactics:
- InitialAccess
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Corelight/Analytic Rules/CorelightTypoSquattingOrPunycodePhishingHTTPRequest.yaml
query: |
  corelight_http
  | where method =~ 'GET'
  | where isempty(referrer)
  | where host has 'xn--'  
kind: Scheduled
entityMappings:
- fieldMappings:
  - columnName: id_orig_h
    identifier: Address
  entityType: IP
queryPeriod: 1h
triggerOperator: gt
id: 6b579e98-abc9-4e7a-9efc-2f3408ba16c9
status: Available
description: |
    'Detects when an HTTP request was made to a domain that was using unicode/punycode.'

ARM