VTI - High Severity Domain Collision Detection

Back


Id	7be47078-657a-43cf-9c93-b4705a9f6134
Rulename	VTI - High Severity Domain Collision Detection
Description	This will alert when a collision is detected for EmailUrlInfo events with VTI high severity domain IoCs
Severity	High
Tactics	InitialAccess
Techniques	T1566
Required data connectors	VisaThreatIntelligence
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Visa Threat Intelligence (VTI)/Analytic Rules/VTIP_high_severity_domain.yaml
Version	1.0.0
Arm template	7be47078-657a-43cf-9c93-b4705a9f6134.json

KQL

EmailUrlInfo
| join kind=inner (VisaThreatIntelligenceIOC_CL  | where IOCType == "domain" and SourceSeverity == "High")
on $left.UrlDomain == $right.Value

YAML

name: VTI - High Severity Domain Collision Detection
relevantTechniques:
- T1566
id: 7be47078-657a-43cf-9c93-b4705a9f6134
suppressionEnabled: false
requiredDataConnectors:
- dataTypes:
  - VisaThreatIntelligenceIOC_CL
  - EmailUrlInfo
  connectorId: VisaThreatIntelligence
eventGroupingSettings:
  aggregationKind: SingleAlert
version: 1.0.0
severity: High
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Visa Threat Intelligence (VTI)/Analytic Rules/VTIP_high_severity_domain.yaml
queryPeriod: 1h
entityMappings:
- fieldMappings:
  - identifier: Url
    columnName: Url
  entityType: URL
- fieldMappings:
  - identifier: DomainName
    columnName: UrlDomain
  entityType: DNS
incidentConfiguration:
  groupingConfiguration:
    reopenClosedIncident: false
    matchingMethod: AllEntities
    lookbackDuration: 1h
    enabled: true
  createIncident: true
queryFrequency: 1h
suppressionDuration: 1h
query: |-
  EmailUrlInfo
  | join kind=inner (VisaThreatIntelligenceIOC_CL  | where IOCType == "domain" and SourceSeverity == "High")
  on $left.UrlDomain == $right.Value  
tactics:
- InitialAccess
kind: Scheduled
description: This will alert when a collision is detected for EmailUrlInfo events with VTI high severity domain IoCs
triggerOperator: gt

ARM