Corelight - Possible Typo Squatting or Punycode Phishing HTTP Request

Back


Id	6b579e98-abc9-4e7a-9efc-2f3408ba16c9
Rulename	Corelight - Possible Typo Squatting or Punycode Phishing HTTP Request
Description	Detects when an HTTP request was made to a domain that was using unicode/punycode.
Severity	Medium
Tactics	InitialAccess
Techniques	T1566
Required data connectors	Corelight
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Corelight/Analytic Rules/CorelightTypoSquattingOrPunycodePhishingHTTPRequest.yaml
Version	2.1.0
Arm template	6b579e98-abc9-4e7a-9efc-2f3408ba16c9.json

KQL

corelight_http
| where method =~ 'GET'
| where isempty(referrer)
| where host has 'xn--'

YAML

id: 6b579e98-abc9-4e7a-9efc-2f3408ba16c9
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Corelight/Analytic Rules/CorelightTypoSquattingOrPunycodePhishingHTTPRequest.yaml
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: id_orig_h
  entityType: IP
requiredDataConnectors:
- dataTypes:
  - Corelight_v2_http
  - corelight_http
  connectorId: Corelight
queryFrequency: 1h
queryPeriod: 1h
status: Available
query: |
  corelight_http
  | where method =~ 'GET'
  | where isempty(referrer)
  | where host has 'xn--'  
name: Corelight - Possible Typo Squatting or Punycode Phishing HTTP Request
kind: Scheduled
tactics:
- InitialAccess
severity: Medium
relevantTechniques:
- T1566
triggerThreshold: 0
version: 2.1.0
description: |
    'Detects when an HTTP request was made to a domain that was using unicode/punycode.'

ARM