Corelight - Possible Typo Squatting or Punycode Phishing HTTP Request

Back


Id	6b579e98-abc9-4e7a-9efc-2f3408ba16c9
Rulename	Corelight - Possible Typo Squatting or Punycode Phishing HTTP Request
Description	Detects when an HTTP request was made to a domain that was using unicode/punycode.
Severity	Medium
Tactics	InitialAccess
Techniques	T1566
Required data connectors	Corelight
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Corelight/Analytic Rules/CorelightTypoSquattingOrPunycodePhishingHTTPRequest.yaml
Version	2.1.0
Arm template	6b579e98-abc9-4e7a-9efc-2f3408ba16c9.json

KQL

corelight_http
| where method =~ 'GET'
| where isempty(referrer)
| where host has 'xn--'

YAML

description: |
    'Detects when an HTTP request was made to a domain that was using unicode/punycode.'
kind: Scheduled
tactics:
- InitialAccess
requiredDataConnectors:
- connectorId: Corelight
  dataTypes:
  - Corelight_v2_http
  - corelight_http
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Corelight/Analytic Rules/CorelightTypoSquattingOrPunycodePhishingHTTPRequest.yaml
severity: Medium
name: Corelight - Possible Typo Squatting or Punycode Phishing HTTP Request
triggerThreshold: 0
queryPeriod: 1h
query: |
  corelight_http
  | where method =~ 'GET'
  | where isempty(referrer)
  | where host has 'xn--'  
relevantTechniques:
- T1566
id: 6b579e98-abc9-4e7a-9efc-2f3408ba16c9
queryFrequency: 1h
status: Available
triggerOperator: gt
version: 2.1.0
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: id_orig_h
    identifier: Address

ARM