Mimecast Secure Email Gateway - Impersonation Protect

Back


Id	7034abc9-6b66-4533-9bf3-056672fd9d9e
Rulename	Mimecast Secure Email Gateway - Impersonation Protect
Description	Detects threats from impersonation mail under targeted threat protection
Severity	High
Tactics	Discovery LateralMovement Collection
Techniques	T1114
Required data connectors	MimecastSIEMAPI
Kind	Scheduled
Query frequency	5m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Impersonation.yaml
Version	1.0.0
Arm template	7034abc9-6b66-4533-9bf3-056672fd9d9e.json

KQL

MimecastSIEM_CL| where mimecastEventId_s == "mail_ttp_impersonation"

YAML

relevantTechniques:
- T1114
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    lookbackDuration: 1d
    enabled: true
    reopenClosedIncident: false
    matchingMethod: AllEntities
name: Mimecast Secure Email Gateway - Impersonation Protect
requiredDataConnectors:
- dataTypes:
  - MimecastSIEM_CL
  connectorId: MimecastSIEMAPI
entityMappings:
- fieldMappings:
  - identifier: Sender
    columnName: Sender_s
  - identifier: SenderIP
    columnName: IP_s
  - identifier: Recipient
    columnName: Recipient_s
  entityType: MailMessage
triggerThreshold: 0
id: 7034abc9-6b66-4533-9bf3-056672fd9d9e
tactics:
- Discovery
- LateralMovement
- Collection
version: 1.0.0
customDetails:
  Hits: Hits_s
  TaggedExternal: TaggedExternal_s
  CustomThreatDict: CustomThreatDictionary_s
  Route: Route_s
  TaggedMalicious: TaggedMalicious_s
  CustomName: CustomName_s
  SimilarMCExtDomain: SimilarMimecastExternalDomain_s
  MsgId: MsgId_s
  InternalName: InternalName_s
  Definition: Definition_s
  SimilarIntDomain: SimilarInternalDomain_s
  ReplyMismatch: ReplyMismatch_s
  ThreatDictionary: ThreatDictionary_s
  SimilarCustExtDomain: SimilarCustomExternalDomain_s
  NewDomain: NewDomain_s
  Action: Action_s
  Subject: Subject_s
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Impersonation.yaml
queryPeriod: 15m
kind: Scheduled
eventGroupingSettings:
  aggregationKind: SingleAlert
enabled: true
suppressionDuration: 5h
queryFrequency: 5m
severity: High
suppressionEnabled: false
description: Detects threats from impersonation mail under targeted threat protection
query: MimecastSIEM_CL| where mimecastEventId_s == "mail_ttp_impersonation"
triggerOperator: gt

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/7034abc9-6b66-4533-9bf3-056672fd9d9e')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/7034abc9-6b66-4533-9bf3-056672fd9d9e')]",
      "properties": {
        "alertRuleTemplateName": "7034abc9-6b66-4533-9bf3-056672fd9d9e",
        "customDetails": {
          "Action": "Action_s",
          "CustomName": "CustomName_s",
          "CustomThreatDict": "CustomThreatDictionary_s",
          "Definition": "Definition_s",
          "Hits": "Hits_s",
          "InternalName": "InternalName_s",
          "MsgId": "MsgId_s",
          "NewDomain": "NewDomain_s",
          "ReplyMismatch": "ReplyMismatch_s",
          "Route": "Route_s",
          "SimilarCustExtDomain": "SimilarCustomExternalDomain_s",
          "SimilarIntDomain": "SimilarInternalDomain_s",
          "SimilarMCExtDomain": "SimilarMimecastExternalDomain_s",
          "Subject": "Subject_s",
          "TaggedExternal": "TaggedExternal_s",
          "TaggedMalicious": "TaggedMalicious_s",
          "ThreatDictionary": "ThreatDictionary_s"
        },
        "description": "Detects threats from impersonation mail under targeted threat protection",
        "displayName": "Mimecast Secure Email Gateway - Impersonation Protect",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "MailMessage",
            "fieldMappings": [
              {
                "columnName": "Sender_s",
                "identifier": "Sender"
              },
              {
                "columnName": "IP_s",
                "identifier": "SenderIP"
              },
              {
                "columnName": "Recipient_s",
                "identifier": "Recipient"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "lookbackDuration": "P1D",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Impersonation.yaml",
        "query": "MimecastSIEM_CL| where mimecastEventId_s == \"mail_ttp_impersonation\"",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT15M",
        "severity": "High",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "Collection",
          "Discovery",
          "LateralMovement"
        ],
        "techniques": [
          "T1114"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}