Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Cyber Evil Twin Site Low

Back
Id8a9b7cdd-4fae-46fc-ab06-65c8f61e5f12
RulenameCyber Evil Twin Site (Low)
DescriptionNew Cyber Evil Twin Site with severity Low found
SeverityLow
TacticsDefenseEvasion
TechniquesT1497
Required data connectorsCBSPollingIDAzureFunctions
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTM360/Analytic Rules/cyber_evil_twin_site_low.yaml
Version1.0.0
Arm template8a9b7cdd-4fae-46fc-ab06-65c8f61e5f12.json
Deploy To Azure
CBSLog_Azure_1_CL | where severity_s == "Low" | where type_s == "Cyber Evil Twin Site" | where status_s != "Closed" or status_s != "Resolved"
queryPeriod: 5m
eventGroupingSettings:
  aggregationKind: SingleAlert
name: Cyber Evil Twin Site (Low)
description: New Cyber Evil Twin Site with severity Low found
status: Available
suppressionEnabled: false
requiredDataConnectors:
- dataTypes:
  - CBSLog_Azure_1_CL
  connectorId: CBSPollingIDAzureFunctions
suppressionDuration: 5h
id: 8a9b7cdd-4fae-46fc-ab06-65c8f61e5f12
version: 1.0.0
triggerOperator: gt
triggerThreshold: 0
query: CBSLog_Azure_1_CL | where severity_s == "Low" | where type_s == "Cyber Evil Twin Site" | where status_s != "Closed" or status_s != "Resolved"
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTM360/Analytic Rules/cyber_evil_twin_site_low.yaml
incidentConfiguration:
  groupingConfiguration:
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
    enabled: false
  createIncident: true
tactics:
- DefenseEvasion
relevantTechniques:
- T1497
queryFrequency: 5m
kind: Scheduled
severity: Low
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/8a9b7cdd-4fae-46fc-ab06-65c8f61e5f12')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/8a9b7cdd-4fae-46fc-ab06-65c8f61e5f12')]",
      "properties": {
        "alertRuleTemplateName": "8a9b7cdd-4fae-46fc-ab06-65c8f61e5f12",
        "customDetails": null,
        "description": "New Cyber Evil Twin Site with severity Low found",
        "displayName": "Cyber Evil Twin Site (Low)",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTM360/Analytic Rules/cyber_evil_twin_site_low.yaml",
        "query": "CBSLog_Azure_1_CL | where severity_s == \"Low\" | where type_s == \"Cyber Evil Twin Site\" | where status_s != \"Closed\" or status_s != \"Resolved\"",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "Low",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion"
        ],
        "techniques": [
          "T1497"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}