Corelight - Possible Typo Squatting or Punycode Phishing HTTP Request

Back


Id	6b579e98-abc9-4e7a-9efc-2f3408ba16c9
Rulename	Corelight - Possible Typo Squatting or Punycode Phishing HTTP Request
Description	Detects when an HTTP request was made to a domain that was using unicode/punycode.
Severity	Medium
Tactics	InitialAccess
Techniques	T1566
Required data connectors	Corelight
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Corelight/Analytic Rules/CorelightTypoSquattingOrPunycodePhishingHTTPRequest.yaml
Version	2.1.0
Arm template	6b579e98-abc9-4e7a-9efc-2f3408ba16c9.json

KQL

corelight_http
| where method =~ 'GET'
| where isempty(referrer)
| where host has 'xn--'

YAML

description: |
    'Detects when an HTTP request was made to a domain that was using unicode/punycode.'
triggerThreshold: 0
queryPeriod: 1h
triggerOperator: gt
kind: Scheduled
relevantTechniques:
- T1566
query: |
  corelight_http
  | where method =~ 'GET'
  | where isempty(referrer)
  | where host has 'xn--'  
queryFrequency: 1h
requiredDataConnectors:
- connectorId: Corelight
  dataTypes:
  - Corelight_v2_http
  - corelight_http
name: Corelight - Possible Typo Squatting or Punycode Phishing HTTP Request
severity: Medium
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: id_orig_h
  entityType: IP
version: 2.1.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Corelight/Analytic Rules/CorelightTypoSquattingOrPunycodePhishingHTTPRequest.yaml
status: Available
id: 6b579e98-abc9-4e7a-9efc-2f3408ba16c9
tactics:
- InitialAccess

ARM