Infoblox - Data Exfiltration Attack

Back


Id	8db2b374-0337-49bd-94c9-cfbf8e5d83ad
Rulename	Infoblox - Data Exfiltration Attack
Description	Data exfiltration attack detected by Infoblox Threat Insight. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called InfobloxCDC.
Severity	Medium
Tactics	Impact
Techniques	T1498 T1565
Required data connectors	CefAma InfobloxCloudDataConnector InfobloxCloudDataConnectorAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-DataExfiltrationAttack.yaml
Version	1.0.2
Arm template	8db2b374-0337-49bd-94c9-cfbf8e5d83ad.json

KQL

let threshold = 1;
InfobloxCDC
| where DeviceEventClassID has_cs "RPZ"
| where InfobloxB1FeedName == "Threat Insight - Data Exfiltration"
| summarize count() by SourceIP
| where count_ > threshold
| join kind=innerunique (InfobloxCDC
  | where DeviceEventClassID has_cs "RPZ"
  | where InfobloxB1FeedName == "Threat Insight - Data Exfiltration"
  ) on SourceIP

YAML

relevantTechniques:
- T1498
- T1565
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    lookbackDuration: 7d
    enabled: true
    reopenClosedIncident: true
    matchingMethod: AllEntities
name: Infoblox - Data Exfiltration Attack
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog (InfobloxCDC)
  connectorId: InfobloxCloudDataConnector
- dataTypes:
  - CommonSecurityLog (InfobloxCDC)
  connectorId: InfobloxCloudDataConnectorAma
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: SourceIP
  entityType: IP
- fieldMappings:
  - identifier: HostName
    columnName: DeviceName
  - identifier: OSVersion
    columnName: InfobloxB1SrcOSVersion
  - identifier: FullName
    columnName: SourceUserName
  entityType: Host
- fieldMappings:
  - identifier: Name
    columnName: InfobloxB1FeedName
  - identifier: Category
    columnName: InfobloxB1FeedName
  entityType: Malware
triggerThreshold: 0
id: 8db2b374-0337-49bd-94c9-cfbf8e5d83ad
tactics:
- Impact
version: 1.0.2
customDetails:
  InfobloxB1FeedName: InfobloxB1FeedName
  SourceMACAddress: SourceMACAddress
  InfobloxB1PolicyName: InfobloxB1PolicyName
  InfobloxB1Action: InfobloxB1PolicyAction
  InfobloxB1Network: InfobloxB1Network
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-DataExfiltrationAttack.yaml
queryPeriod: 1h
kind: Scheduled
eventGroupingSettings:
  aggregationKind: SingleAlert
queryFrequency: 1h
severity: Medium
status: Available
description: |
    'Data exfiltration attack detected by Infoblox Threat Insight. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser).'
query: |
  let threshold = 1;
  InfobloxCDC
  | where DeviceEventClassID has_cs "RPZ"
  | where InfobloxB1FeedName == "Threat Insight - Data Exfiltration"
  | summarize count() by SourceIP
  | where count_ > threshold
  | join kind=innerunique (InfobloxCDC
    | where DeviceEventClassID has_cs "RPZ"
    | where InfobloxB1FeedName == "Threat Insight - Data Exfiltration"
    ) on SourceIP  
triggerOperator: gt

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/8db2b374-0337-49bd-94c9-cfbf8e5d83ad')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/8db2b374-0337-49bd-94c9-cfbf8e5d83ad')]",
      "properties": {
        "alertRuleTemplateName": "8db2b374-0337-49bd-94c9-cfbf8e5d83ad",
        "customDetails": {
          "InfobloxB1Action": "InfobloxB1PolicyAction",
          "InfobloxB1FeedName": "InfobloxB1FeedName",
          "InfobloxB1Network": "InfobloxB1Network",
          "InfobloxB1PolicyName": "InfobloxB1PolicyName",
          "SourceMACAddress": "SourceMACAddress"
        },
        "description": "'Data exfiltration attack detected by Infoblox Threat Insight. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser).'\n",
        "displayName": "Infoblox - Data Exfiltration Attack",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SourceIP",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "DeviceName",
                "identifier": "HostName"
              },
              {
                "columnName": "InfobloxB1SrcOSVersion",
                "identifier": "OSVersion"
              },
              {
                "columnName": "SourceUserName",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "Malware",
            "fieldMappings": [
              {
                "columnName": "InfobloxB1FeedName",
                "identifier": "Name"
              },
              {
                "columnName": "InfobloxB1FeedName",
                "identifier": "Category"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "lookbackDuration": "P7D",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": true
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-DataExfiltrationAttack.yaml",
        "query": "let threshold = 1;\nInfobloxCDC\n| where DeviceEventClassID has_cs \"RPZ\"\n| where InfobloxB1FeedName == \"Threat Insight - Data Exfiltration\"\n| summarize count() by SourceIP\n| where count_ > threshold\n| join kind=innerunique (InfobloxCDC\n  | where DeviceEventClassID has_cs \"RPZ\"\n  | where InfobloxB1FeedName == \"Threat Insight - Data Exfiltration\"\n  ) on SourceIP\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1498",
          "T1565"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}