Corelight - Possible Typo Squatting or Punycode Phishing HTTP Request

Back


Id	6b579e98-abc9-4e7a-9efc-2f3408ba16c9
Rulename	Corelight - Possible Typo Squatting or Punycode Phishing HTTP Request
Description	Detects when an HTTP request was made to a domain that was using unicode/punycode.
Severity	Medium
Tactics	InitialAccess
Techniques	T1566
Required data connectors	Corelight
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Corelight/Analytic Rules/CorelightTypoSquattingOrPunycodePhishingHTTPRequest.yaml
Version	2.1.0
Arm template	6b579e98-abc9-4e7a-9efc-2f3408ba16c9.json

KQL

corelight_http
| where method =~ 'GET'
| where isempty(referrer)
| where host has 'xn--'

YAML

query: |
  corelight_http
  | where method =~ 'GET'
  | where isempty(referrer)
  | where host has 'xn--'  
status: Available
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Corelight/Analytic Rules/CorelightTypoSquattingOrPunycodePhishingHTTPRequest.yaml
requiredDataConnectors:
- dataTypes:
  - Corelight_v2_http
  - corelight_http
  connectorId: Corelight
id: 6b579e98-abc9-4e7a-9efc-2f3408ba16c9
tactics:
- InitialAccess
queryPeriod: 1h
queryFrequency: 1h
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: id_orig_h
version: 2.1.0
triggerOperator: gt
relevantTechniques:
- T1566
severity: Medium
kind: Scheduled
name: Corelight - Possible Typo Squatting or Punycode Phishing HTTP Request
description: |
    'Detects when an HTTP request was made to a domain that was using unicode/punycode.'

ARM