Cyren High-Risk URL Indicators | Microsoft Sentinel Analytic Rules

Back


Id	6e8f9c4b-2a3b-5c6d-0e1f-d2e3f4a5b6c7
Rulename	Cyren High-Risk URL Indicators
Description	Detects high-risk URL indicators (risk score >= 80) from Cyren malware URL threat intelligence feeds in the last 24 hours. These URLs are associated with malware distribution, phishing campaigns, or other malicious content hosting.
Severity	High
Tactics	InitialAccess Execution
Techniques	T1566 T1189
Required data connectors	CyrenThreatIntel
Kind	Scheduled
Query frequency	1h
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CyrenThreatIntelligence/Analytic%20Rules/Cyren%20-%20High%20Risk%20URL%20Indicators.yaml
Version	1.0.0
Arm template	6e8f9c4b-2a3b-5c6d-0e1f-d2e3f4a5b6c7.json

KQL

Cyren_Indicators_CL
| where TimeGenerated > ago(1d)
| where isnotempty(url_s)
| extend Risk = toint(risk_d)
| where Risk >= 80
| summarize 
    DetectionCount = count(), 
    MaxRisk = max(Risk), 
    Categories = make_set(category_s) 
  by URL = url_s, Domain = domain_s, Source = source_s
| where DetectionCount >= 1
| extend 
    MaliciousURL = URL,
    ThreatCategories = strcat_array(Categories, ", ")

YAML

suppressionEnabled: false
entityMappings:
- fieldMappings:
  - identifier: Url
    columnName: MaliciousURL
  entityType: URL
id: 6e8f9c4b-2a3b-5c6d-0e1f-d2e3f4a5b6c7
suppressionDuration: 1h
triggerOperator: gt
tactics:
- InitialAccess
- Execution
kind: Scheduled
requiredDataConnectors:
- dataTypes:
  - Cyren_Indicators_CL
  connectorId: CyrenThreatIntel
queryPeriod: 1d
eventGroupingSettings:
  aggregationKind: AlertPerResult
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CyrenThreatIntelligence/Analytic%20Rules/Cyren%20-%20High%20Risk%20URL%20Indicators.yaml
severity: High
relevantTechniques:
- T1566
- T1189
triggerThreshold: 0
version: 1.0.0
customDetails:
  RiskScore: MaxRisk
  Domain: Domain
  Categories: ThreatCategories
  DetectionCount: DetectionCount
  Source: Source
name: Cyren High-Risk URL Indicators
status: Available
query: |
  Cyren_Indicators_CL
  | where TimeGenerated > ago(1d)
  | where isnotempty(url_s)
  | extend Risk = toint(risk_d)
  | where Risk >= 80
  | summarize 
      DetectionCount = count(), 
      MaxRisk = max(Risk), 
      Categories = make_set(category_s) 
    by URL = url_s, Domain = domain_s, Source = source_s
  | where DetectionCount >= 1
  | extend 
      MaliciousURL = URL,
      ThreatCategories = strcat_array(Categories, ", ")
description: |
  'Detects high-risk URL indicators (risk score >= 80) from Cyren malware URL threat intelligence feeds in the last 24 hours.
  These URLs are associated with malware distribution, phishing campaigns, or other malicious content hosting.'
queryFrequency: 1h
incidentConfiguration:
  groupingConfiguration:
    enabled: true
    lookbackDuration: 1d
    reopenClosedIncident: false
    groupByEntities:
    - URL
    matchingMethod: Selected
  createIncident: true

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/6e8f9c4b-2a3b-5c6d-0e1f-d2e3f4a5b6c7')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/6e8f9c4b-2a3b-5c6d-0e1f-d2e3f4a5b6c7')]",
      "properties": {
        "alertRuleTemplateName": "6e8f9c4b-2a3b-5c6d-0e1f-d2e3f4a5b6c7",
        "customDetails": {
          "Categories": "ThreatCategories",
          "DetectionCount": "DetectionCount",
          "Domain": "Domain",
          "RiskScore": "MaxRisk",
          "Source": "Source"
        },
        "description": "'Detects high-risk URL indicators (risk score >= 80) from Cyren malware URL threat intelligence feeds in the last 24 hours.\nThese URLs are associated with malware distribution, phishing campaigns, or other malicious content hosting.'\n",
        "displayName": "Cyren High-Risk URL Indicators",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "MaliciousURL",
                "identifier": "Url"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByEntities": [
              "URL"
            ],
            "lookbackDuration": "P1D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CyrenThreatIntelligence/Analytic%20Rules/Cyren%20-%20High%20Risk%20URL%20Indicators.yaml",
        "query": "Cyren_Indicators_CL\n| where TimeGenerated > ago(1d)\n| where isnotempty(url_s)\n| extend Risk = toint(risk_d)\n| where Risk >= 80\n| summarize \n    DetectionCount = count(), \n    MaxRisk = max(Risk), \n    Categories = make_set(category_s) \n  by URL = url_s, Domain = domain_s, Source = source_s\n| where DetectionCount >= 1\n| extend \n    MaliciousURL = URL,\n    ThreatCategories = strcat_array(Categories, \", \")\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P1D",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Execution",
          "InitialAccess"
        ],
        "techniques": [
          "T1189",
          "T1566"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}