CYFIRMA - Brand Intelligence - Social Media Handle Impersonation Detected Medium Rule
Id | 710f4755-490d-4fa7-aef0-43b5a66edc7b |
Rulename | CYFIRMA - Brand Intelligence - Social Media Handle Impersonation Detected Medium Rule |
Description | “Detects high-severity alerts related to impersonation of official social media handles associated with your brand. These spoofed accounts may be used for phishing, disinformation, or fraud campaigns, posing significant reputational and security risks.” |
Severity | Medium |
Tactics | Reconnaissance ResourceDevelopment InitialAccess |
Techniques | T1589.003 T1591.002 T1585.001 T1566.002 |
Required data connectors | CyfirmaBrandIntelligenceAlertsDC |
Kind | Scheduled |
Query frequency | 5m |
Query period | 5m |
Trigger threshold | 0 |
Trigger operator | gt |
Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyfirma Brand Intelligence/Analytic Rules/BISocialMediaHandlerMediumRule.yaml |
Version | 1.0.0 |
Arm template | 710f4755-490d-4fa7-aef0-43b5a66edc7b.json |
// Medium severity - Social Media Handle Impersonation
let timeFrame = 5m;
CyfirmaBISocialHandlersAlerts_CL
| where severity == 'High' and TimeGenerated between (ago(timeFrame) .. now())
| extend
Description=description,
FirstSeen=first_seen,
LastSeen=last_seen,
RiskScore=risk_score,
AlertUID=alert_uid,
UID=uid,
AssetType=asset_type,
AssetValue=asset_value,
Impact=impact,
Recommendation=recommendation,
SourceSype=source_type,
ProviderName="CYFIRMA",
ProductName="DeCYFIR/DeTCT"
| project
TimeGenerated,
Description,
RiskScore,
FirstSeen,
LastSeen,
AlertUID,
UID,
AssetType,
AssetValue,
Impact,
Recommendation,
SourceSype,
ProductName,
ProviderName
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyfirma Brand Intelligence/Analytic Rules/BISocialMediaHandlerMediumRule.yaml
triggerThreshold: 0
severity: Medium
incidentConfiguration:
createIncident: true
groupingConfiguration:
lookbackDuration: 5h
enabled: false
matchingMethod: AllEntities
reopenClosedIncident: false
queryFrequency: 5m
status: Available
customDetails:
TimeGenerated: TimeGenerated
FirstSeen: FirstSeen
Recommendation: Recommendation
RiskScore: RiskScore
AssetType: AssetType
LastSeen: LastSeen
Impact: Impact
AlertUID: AlertUID
SourceSype: SourceSype
Description: Description
AssetValue: AssetValue
UID: UID
relevantTechniques:
- T1589.003
- T1591.002
- T1585.001
- T1566.002
alertDetailsOverride:
alertDisplayNameFormat: 'CYFIRMA - Medium Severity Social Media Handle Impersonation Detected - {{AssetType}} : {{AssetValue}} '
alertDescriptionFormat: '{{Description}} '
alertDynamicProperties:
- alertProperty: ProductName
value: ProductName
- alertProperty: ProviderName
value: ProviderName
triggerOperator: gt
id: 710f4755-490d-4fa7-aef0-43b5a66edc7b
requiredDataConnectors:
- connectorId: CyfirmaBrandIntelligenceAlertsDC
dataTypes:
- CyfirmaBISocialHandlersAlerts_CL
version: 1.0.0
name: CYFIRMA - Brand Intelligence - Social Media Handle Impersonation Detected Medium Rule
eventGroupingSettings:
aggregationKind: AlertPerResult
description: |
"Detects high-severity alerts related to impersonation of official social media handles associated with your brand.
These spoofed accounts may be used for phishing, disinformation, or fraud campaigns, posing significant reputational and security risks."
query: |
// Medium severity - Social Media Handle Impersonation
let timeFrame = 5m;
CyfirmaBISocialHandlersAlerts_CL
| where severity == 'High' and TimeGenerated between (ago(timeFrame) .. now())
| extend
Description=description,
FirstSeen=first_seen,
LastSeen=last_seen,
RiskScore=risk_score,
AlertUID=alert_uid,
UID=uid,
AssetType=asset_type,
AssetValue=asset_value,
Impact=impact,
Recommendation=recommendation,
SourceSype=source_type,
ProviderName="CYFIRMA",
ProductName="DeCYFIR/DeTCT"
| project
TimeGenerated,
Description,
RiskScore,
FirstSeen,
LastSeen,
AlertUID,
UID,
AssetType,
AssetValue,
Impact,
Recommendation,
SourceSype,
ProductName,
ProviderName
tactics:
- Reconnaissance
- ResourceDevelopment
- InitialAccess
queryPeriod: 5m
kind: Scheduled
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/710f4755-490d-4fa7-aef0-43b5a66edc7b')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/710f4755-490d-4fa7-aef0-43b5a66edc7b')]",
"properties": {
"alertDetailsOverride": {
"alertDescriptionFormat": "{{Description}} ",
"alertDisplayNameFormat": "CYFIRMA - Medium Severity Social Media Handle Impersonation Detected - {{AssetType}} : {{AssetValue}} ",
"alertDynamicProperties": [
{
"alertProperty": "ProductName",
"value": "ProductName"
},
{
"alertProperty": "ProviderName",
"value": "ProviderName"
}
]
},
"alertRuleTemplateName": "710f4755-490d-4fa7-aef0-43b5a66edc7b",
"customDetails": {
"AlertUID": "AlertUID",
"AssetType": "AssetType",
"AssetValue": "AssetValue",
"Description": "Description",
"FirstSeen": "FirstSeen",
"Impact": "Impact",
"LastSeen": "LastSeen",
"Recommendation": "Recommendation",
"RiskScore": "RiskScore",
"SourceSype": "SourceSype",
"TimeGenerated": "TimeGenerated",
"UID": "UID"
},
"description": "\"Detects high-severity alerts related to impersonation of official social media handles associated with your brand. \nThese spoofed accounts may be used for phishing, disinformation, or fraud campaigns, posing significant reputational and security risks.\"\n",
"displayName": "CYFIRMA - Brand Intelligence - Social Media Handle Impersonation Detected Medium Rule",
"enabled": true,
"entityMappings": null,
"eventGroupingSettings": {
"aggregationKind": "AlertPerResult"
},
"incidentConfiguration": {
"createIncident": true,
"groupingConfiguration": {
"enabled": false,
"lookbackDuration": "PT5H",
"matchingMethod": "AllEntities",
"reopenClosedIncident": false
}
},
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyfirma Brand Intelligence/Analytic Rules/BISocialMediaHandlerMediumRule.yaml",
"query": "// Medium severity - Social Media Handle Impersonation\nlet timeFrame = 5m;\nCyfirmaBISocialHandlersAlerts_CL \n | where severity == 'High' and TimeGenerated between (ago(timeFrame) .. now())\n | extend\n Description=description,\n FirstSeen=first_seen,\n LastSeen=last_seen,\n RiskScore=risk_score,\n AlertUID=alert_uid,\n UID=uid,\n AssetType=asset_type,\n AssetValue=asset_value,\n Impact=impact,\n Recommendation=recommendation,\n SourceSype=source_type,\n ProviderName=\"CYFIRMA\",\n ProductName=\"DeCYFIR/DeTCT\"\n | project \n TimeGenerated,\n Description,\n RiskScore,\n FirstSeen,\n LastSeen,\n AlertUID,\n UID,\n AssetType,\n AssetValue,\n Impact,\n Recommendation,\n SourceSype,\n ProductName,\n ProviderName\n",
"queryFrequency": "PT5M",
"queryPeriod": "PT5M",
"severity": "Medium",
"status": "Available",
"subTechniques": [
"T1589.003",
"T1591.002",
"T1585.001",
"T1566.002"
],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"InitialAccess",
"Reconnaissance",
"ResourceDevelopment"
],
"techniques": [
"T1566",
"T1585",
"T1589",
"T1591"
],
"templateVersion": "1.0.0",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}