AR Microsoft Sentinel Analytic Rules ONLINE

Analytic rule catalog

CYFIRMA - Brand Intelligence - Social Media Handle Impersonation Detected Medium Rule

Back
Id710f4755-490d-4fa7-aef0-43b5a66edc7b
RulenameCYFIRMA - Brand Intelligence - Social Media Handle Impersonation Detected Medium Rule
Description“Detects high-severity alerts related to impersonation of official social media handles associated with your brand.

These spoofed accounts may be used for phishing, disinformation, or fraud campaigns, posing significant reputational and security risks.”
SeverityMedium
TacticsReconnaissance
ResourceDevelopment
InitialAccess
TechniquesT1589.003
T1591.002
T1585.001
T1566.002
Required data connectorsCyfirmaBrandIntelligenceAlertsDC
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyfirma%20Brand%20Intelligence/Analytic%20Rules/BISocialMediaHandlerMediumRule.yaml
Version1.0.1
Arm template710f4755-490d-4fa7-aef0-43b5a66edc7b.json
Deploy To Azure
// Medium severity - Social Media Handle Impersonation
let timeFrame = 5m;
CyfirmaBISocialHandlersAlerts_CL 
  | where severity == 'High' and TimeGenerated between (ago(timeFrame) .. now())
  | extend
      Description=description,
      FirstSeen=first_seen,
      LastSeen=last_seen,
      RiskScore=risk_score,
      AlertUID=alert_uid,
      UID=uid,
      AssetType=asset_type,
      AssetValue=asset_value,
      Impact=impact,
      Recommendation=recommendation,
      SourceSype=source_type,
      ProviderName="CYFIRMA",
      ProductName="DeCYFIR/DeTCT"
  | project 
      TimeGenerated,
      Description,
      RiskScore,
      FirstSeen,
      LastSeen,
      AlertUID,
      UID,
      AssetType,
      AssetValue,
      Impact,
      Recommendation,
      SourceSype,
      ProductName,
      ProviderName

name: CYFIRMA - Brand Intelligence - Social Media Handle Impersonation Detected Medium Rule
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyfirma%20Brand%20Intelligence/Analytic%20Rules/BISocialMediaHandlerMediumRule.yaml
queryFrequency: 5m
triggerOperator: gt
status: Available
queryPeriod: 5m
requiredDataConnectors:
- connectorId: CyfirmaBrandIntelligenceAlertsDC
  dataTypes:
  - CyfirmaBISocialHandlersAlerts_CL
tactics:
- Reconnaissance
- ResourceDevelopment
- InitialAccess
query: |
  // Medium severity - Social Media Handle Impersonation
  let timeFrame = 5m;
  CyfirmaBISocialHandlersAlerts_CL 
    | where severity == 'High' and TimeGenerated between (ago(timeFrame) .. now())
    | extend
        Description=description,
        FirstSeen=first_seen,
        LastSeen=last_seen,
        RiskScore=risk_score,
        AlertUID=alert_uid,
        UID=uid,
        AssetType=asset_type,
        AssetValue=asset_value,
        Impact=impact,
        Recommendation=recommendation,
        SourceSype=source_type,
        ProviderName="CYFIRMA",
        ProductName="DeCYFIR/DeTCT"
    | project 
        TimeGenerated,
        Description,
        RiskScore,
        FirstSeen,
        LastSeen,
        AlertUID,
        UID,
        AssetType,
        AssetValue,
        Impact,
        Recommendation,
        SourceSype,
        ProductName,
        ProviderName
description: |
  "Detects high-severity alerts related to impersonation of official social media handles associated with your brand. 
  These spoofed accounts may be used for phishing, disinformation, or fraud campaigns, posing significant reputational and security risks."
severity: Medium
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: PT5H
    enabled: false
    reopenClosedIncident: false
    matchingMethod: AllEntities
  createIncident: true
kind: Scheduled
customDetails:
  Description: Description
  AlertUID: AlertUID
  TimeGenerated: TimeGenerated
  FirstSeen: FirstSeen
  LastSeen: LastSeen
  RiskScore: RiskScore
  UID: UID
  AssetType: AssetType
  AssetValue: AssetValue
  Impact: Impact
  SourceSype: SourceSype
  Recommendation: Recommendation
triggerThreshold: 0
id: 710f4755-490d-4fa7-aef0-43b5a66edc7b
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDescriptionFormat: '{{Description}} '
  alertDynamicProperties:
  - value: ProductName
    alertProperty: ProductName
  - value: ProviderName
    alertProperty: ProviderName
  alertDisplayNameFormat: 'CYFIRMA - Medium Severity Social Media Handle Impersonation Detected - {{AssetType}}  :  {{AssetValue}} '
version: 1.0.1
relevantTechniques:
- T1589.003
- T1591.002
- T1585.001
- T1566.002

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/710f4755-490d-4fa7-aef0-43b5a66edc7b')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/710f4755-490d-4fa7-aef0-43b5a66edc7b')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "{{Description}} ",
          "alertDisplayNameFormat": "CYFIRMA - Medium Severity Social Media Handle Impersonation Detected - {{AssetType}}  :  {{AssetValue}} ",
          "alertDynamicProperties": [
            {
              "alertProperty": "ProductName",
              "value": "ProductName"
            },
            {
              "alertProperty": "ProviderName",
              "value": "ProviderName"
            }
          ]
        },
        "alertRuleTemplateName": "710f4755-490d-4fa7-aef0-43b5a66edc7b",
        "customDetails": {
          "AlertUID": "AlertUID",
          "AssetType": "AssetType",
          "AssetValue": "AssetValue",
          "Description": "Description",
          "FirstSeen": "FirstSeen",
          "Impact": "Impact",
          "LastSeen": "LastSeen",
          "Recommendation": "Recommendation",
          "RiskScore": "RiskScore",
          "SourceSype": "SourceSype",
          "TimeGenerated": "TimeGenerated",
          "UID": "UID"
        },
        "description": "\"Detects high-severity alerts related to impersonation of official social media handles associated with your brand. \nThese spoofed accounts may be used for phishing, disinformation, or fraud campaigns, posing significant reputational and security risks.\"\n",
        "displayName": "CYFIRMA - Brand Intelligence - Social Media Handle Impersonation Detected Medium Rule",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyfirma%20Brand%20Intelligence/Analytic%20Rules/BISocialMediaHandlerMediumRule.yaml",
        "query": "// Medium severity - Social Media Handle Impersonation\nlet timeFrame = 5m;\nCyfirmaBISocialHandlersAlerts_CL \n  | where severity == 'High' and TimeGenerated between (ago(timeFrame) .. now())\n  | extend\n      Description=description,\n      FirstSeen=first_seen,\n      LastSeen=last_seen,\n      RiskScore=risk_score,\n      AlertUID=alert_uid,\n      UID=uid,\n      AssetType=asset_type,\n      AssetValue=asset_value,\n      Impact=impact,\n      Recommendation=recommendation,\n      SourceSype=source_type,\n      ProviderName=\"CYFIRMA\",\n      ProductName=\"DeCYFIR/DeTCT\"\n  | project \n      TimeGenerated,\n      Description,\n      RiskScore,\n      FirstSeen,\n      LastSeen,\n      AlertUID,\n      UID,\n      AssetType,\n      AssetValue,\n      Impact,\n      Recommendation,\n      SourceSype,\n      ProductName,\n      ProviderName\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [
          "T1589.003",
          "T1591.002",
          "T1585.001",
          "T1566.002"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess",
          "Reconnaissance",
          "ResourceDevelopment"
        ],
        "techniques": [
          "T1566",
          "T1585",
          "T1589",
          "T1591"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}