SpyCloud Enterprise Malware Detection | Microsoft Sentinel Analytic Rules

Back


Id	7ba50f9e-2f94-462b-a54b-8642b8c041f5
Rulename	SpyCloud Enterprise Malware Detection
Description	This alert creates an incident when an malware record is detected in the SpyCloud watchlist data
Severity	High
Tactics	CredentialAccess
Techniques	T1555
Kind	Scheduled
Query frequency	12h
Query period	12h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SpyCloud%20Enterprise%20Protection/Analytic%20Rules/SpyCloudEnterpriseProtectionMalwareRule.yaml
Version	1.0.2
Arm template	7ba50f9e-2f94-462b-a54b-8642b8c041f5.json

KQL

SpyCloudBreachDataWatchlist_CL
| where Severity_s == '25'
| project TimeGenerated, Document_Id_g, Source_Id_s, SpyCloud_Publish_Date_t, Email_s, Domain_s, Password_s, Password_Plaintext_s, Username_s, Infected_Machine_Id_g, Infected_Path_s, Infected_Time_t, Target_Domain_s, Target_SubDomain_s, User_Hostname_s, User_OS_s, Target_URL_s,IP_Address_s

YAML

tactics:
- CredentialAccess
name: SpyCloud Enterprise Malware Detection
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SpyCloud%20Enterprise%20Protection/Analytic%20Rules/SpyCloudEnterpriseProtectionMalwareRule.yaml
version: 1.0.2
queryFrequency: 12h
requiredDataConnectors: []
customDetails:
  PublishDate: SpyCloud_Publish_Date_t
  Infected_Time: Infected_Time_t
  Password: Password_s
  Domain: Domain_s
  Password_Plaintext: Password_Plaintext_s
  Document_Id: Document_Id_g
  Source_Id: Source_Id_s
  Infected_Path: Infected_Path_s
  User_Host_Name: User_Hostname_s
id: 7ba50f9e-2f94-462b-a54b-8642b8c041f5
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - identifier: HostName
    columnName: Infected_Machine_Id_g
  - identifier: DnsDomain
    columnName: User_Hostname_s
  entityType: Host
- fieldMappings:
  - identifier: FullName
    columnName: Email_s
  - identifier: Name
    columnName: Username_s
  entityType: Account
- fieldMappings:
  - identifier: DomainName
    columnName: Target_Domain_s
  entityType: DNS
- fieldMappings:
  - identifier: DomainName
    columnName: Target_SubDomain_s
  entityType: DNS
- fieldMappings:
  - identifier: Address
    columnName: IP_Address_s
  entityType: IP
queryPeriod: 12h
alertDetailsOverride: 
severity: High
relevantTechniques:
- T1555
eventGroupingSettings:
  aggregationKind: AlertPerResult
sentinelEntitiesMappings: 
description: |
  'This alert creates an incident when an malware record is detected in the SpyCloud watchlist data'
triggerOperator: gt
suppressionDuration: 5h
status: Available
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    reopenClosedIncident: false
    enabled: true
    matchingMethod: AllEntities
    lookbackDuration: 12h
kind: Scheduled
query: |
  SpyCloudBreachDataWatchlist_CL
  | where Severity_s == '25'
  | project TimeGenerated, Document_Id_g, Source_Id_s, SpyCloud_Publish_Date_t, Email_s, Domain_s, Password_s, Password_Plaintext_s, Username_s, Infected_Machine_Id_g, Infected_Path_s, Infected_Time_t, Target_Domain_s, Target_SubDomain_s, User_Hostname_s, User_OS_s, Target_URL_s,IP_Address_s

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/7ba50f9e-2f94-462b-a54b-8642b8c041f5')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/7ba50f9e-2f94-462b-a54b-8642b8c041f5')]",
      "properties": {
        "alertDetailsOverride": null,
        "alertRuleTemplateName": "7ba50f9e-2f94-462b-a54b-8642b8c041f5",
        "customDetails": {
          "Document_Id": "Document_Id_g",
          "Domain": "Domain_s",
          "Infected_Path": "Infected_Path_s",
          "Infected_Time": "Infected_Time_t",
          "Password": "Password_s",
          "Password_Plaintext": "Password_Plaintext_s",
          "PublishDate": "SpyCloud_Publish_Date_t",
          "Source_Id": "Source_Id_s",
          "User_Host_Name": "User_Hostname_s"
        },
        "description": "'This alert creates an incident when an malware record is detected in the SpyCloud watchlist data'\n",
        "displayName": "SpyCloud Enterprise Malware Detection",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "Infected_Machine_Id_g",
                "identifier": "HostName"
              },
              {
                "columnName": "User_Hostname_s",
                "identifier": "DnsDomain"
              }
            ]
          },
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "Email_s",
                "identifier": "FullName"
              },
              {
                "columnName": "Username_s",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "DNS",
            "fieldMappings": [
              {
                "columnName": "Target_Domain_s",
                "identifier": "DomainName"
              }
            ]
          },
          {
            "entityType": "DNS",
            "fieldMappings": [
              {
                "columnName": "Target_SubDomain_s",
                "identifier": "DomainName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IP_Address_s",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "lookbackDuration": "PT12H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SpyCloud%20Enterprise%20Protection/Analytic%20Rules/SpyCloudEnterpriseProtectionMalwareRule.yaml",
        "query": "SpyCloudBreachDataWatchlist_CL\n| where Severity_s == '25'\n| project TimeGenerated, Document_Id_g, Source_Id_s, SpyCloud_Publish_Date_t, Email_s, Domain_s, Password_s, Password_Plaintext_s, Username_s, Infected_Machine_Id_g, Infected_Path_s, Infected_Time_t, Target_Domain_s, Target_SubDomain_s, User_Hostname_s, User_OS_s, Target_URL_s,IP_Address_s\n",
        "queryFrequency": "PT12H",
        "queryPeriod": "PT12H",
        "sentinelEntitiesMappings": null,
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess"
        ],
        "techniques": [
          "T1555"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}