Abnormal Security - High-risk email attack detected | Microsoft Sentinel Analytic Rules

Back


Id	8effd19a-abab-433a-9184-ae67ac51e6d0
Rulename	Abnormal Security - High-risk email attack detected
Description	Identifies email attacks detected by Abnormal Security whose attack type maps to a high-risk category (credential phishing, Business Email Compromise, invoice/payment fraud, malware, extortion, sensitive-data phishing, internal account-takeover attacks, or scams). Lower-risk categories such as Spam, Graymail, and Reconnaissance are intentionally excluded. Use this to triage targeted email threats that reached a mailbox.
Severity	High
Tactics	InitialAccess
Techniques	T1566
Required data connectors	AbnormalSecurityPush
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AbnormalSecurity/Analytic%20Rules/AbnormalSecurity_HighRiskEmailAttack.yaml
Version	1.0.0
Arm template	8effd19a-abab-433a-9184-ae67ac51e6d0.json

KQL

ABNORMAL_SECURITY_THREAT_LOG_CL
| where abx_body_abx_body_attack_type_s in~ (
    "Phishing: Credential",
    "Social Engineering (BEC)",
    "Invoice/Payment Fraud (BEC)",
    "Malware",
    "Extortion",
    "Phishing: Sensitive Data",
    "Internal-to-Internal Attacks (Email Account Takeover)",
    "Scam")
| extend
    RecipientEmail = abx_body_abx_body_recipient_address_s,
    SenderEmail = abx_body_abx_body_from_address_s,
    SenderName = abx_body_abx_body_from_name_s,
    SenderIP = abx_body_abx_body_sender_ip_address_s,
    Subject = abx_body_abx_body_subject_s,
    MessageId = abx_body_abx_body_internet_message_id_s,
    AttackType = abx_body_abx_body_attack_type_s,
    AttackScore = abx_body_abx_body_attack_score_d,
    RemediationStatus = abx_body_abx_body_remediation_status_s,
    PortalUrl = abx_body_abx_body_abx_portal_url_s
| project TimeGenerated, RecipientEmail, SenderEmail, SenderName, SenderIP, Subject, MessageId, AttackType, AttackScore, RemediationStatus, PortalUrl

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: RecipientEmail
- entityType: MailMessage
  fieldMappings:
  - identifier: Recipient
    columnName: RecipientEmail
  - identifier: Sender
    columnName: SenderEmail
  - identifier: NetworkMessageId
    columnName: MessageId
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SenderIP
name: Abnormal Security - High-risk email attack detected
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AbnormalSecurity/Analytic%20Rules/AbnormalSecurity_HighRiskEmailAttack.yaml
triggerOperator: gt
status: Available
suppressionDuration: PT5H
queryPeriod: 1h
requiredDataConnectors:
- connectorId: AbnormalSecurityPush
  dataTypes:
  - ABNORMAL_SECURITY_THREAT_LOG_CL
tactics:
- InitialAccess
query: |
  ABNORMAL_SECURITY_THREAT_LOG_CL
  | where abx_body_abx_body_attack_type_s in~ (
      "Phishing: Credential",
      "Social Engineering (BEC)",
      "Invoice/Payment Fraud (BEC)",
      "Malware",
      "Extortion",
      "Phishing: Sensitive Data",
      "Internal-to-Internal Attacks (Email Account Takeover)",
      "Scam")
  | extend
      RecipientEmail = abx_body_abx_body_recipient_address_s,
      SenderEmail = abx_body_abx_body_from_address_s,
      SenderName = abx_body_abx_body_from_name_s,
      SenderIP = abx_body_abx_body_sender_ip_address_s,
      Subject = abx_body_abx_body_subject_s,
      MessageId = abx_body_abx_body_internet_message_id_s,
      AttackType = abx_body_abx_body_attack_type_s,
      AttackScore = abx_body_abx_body_attack_score_d,
      RemediationStatus = abx_body_abx_body_remediation_status_s,
      PortalUrl = abx_body_abx_body_abx_portal_url_s
  | project TimeGenerated, RecipientEmail, SenderEmail, SenderName, SenderIP, Subject, MessageId, AttackType, AttackScore, RemediationStatus, PortalUrl
description: |
  'Identifies email attacks detected by Abnormal Security whose attack type maps to a
  high-risk category (credential phishing, Business Email Compromise, invoice/payment
  fraud, malware, extortion, sensitive-data phishing, internal account-takeover attacks,
  or scams). Lower-risk categories such as Spam, Graymail, and Reconnaissance are
  intentionally excluded. Use this to triage targeted email threats that reached a mailbox.'
severity: High
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: PT5H
    enabled: false
    reopenClosedIncident: false
    matchingMethod: AllEntities
  createIncident: true
id: 8effd19a-abab-433a-9184-ae67ac51e6d0
customDetails:
  AbnormalPortalUrl: PortalUrl
  AttackScore: AttackScore
  AttackType: AttackType
  RemediationStatus: RemediationStatus
suppressionEnabled: false
triggerThreshold: 0
queryFrequency: 1h
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDescriptionFormat: Abnormal Security detected a {{AttackType}} attack from {{SenderEmail}} to {{RecipientEmail}}. See attack score and remediation status in the custom details.
  alertDisplayNameFormat: 'Abnormal Security: {{AttackType}} email delivered to {{RecipientEmail}}'
version: 1.0.0
relevantTechniques:
- T1566

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/8effd19a-abab-433a-9184-ae67ac51e6d0')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/8effd19a-abab-433a-9184-ae67ac51e6d0')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Abnormal Security detected a {{AttackType}} attack from {{SenderEmail}} to {{RecipientEmail}}. See attack score and remediation status in the custom details.",
          "alertDisplayNameFormat": "Abnormal Security: {{AttackType}} email delivered to {{RecipientEmail}}"
        },
        "alertRuleTemplateName": "8effd19a-abab-433a-9184-ae67ac51e6d0",
        "customDetails": {
          "AbnormalPortalUrl": "PortalUrl",
          "AttackScore": "AttackScore",
          "AttackType": "AttackType",
          "RemediationStatus": "RemediationStatus"
        },
        "description": "'Identifies email attacks detected by Abnormal Security whose attack type maps to a\nhigh-risk category (credential phishing, Business Email Compromise, invoice/payment\nfraud, malware, extortion, sensitive-data phishing, internal account-takeover attacks,\nor scams). Lower-risk categories such as Spam, Graymail, and Reconnaissance are\nintentionally excluded. Use this to triage targeted email threats that reached a mailbox.'\n",
        "displayName": "Abnormal Security - High-risk email attack detected",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "RecipientEmail",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "MailMessage",
            "fieldMappings": [
              {
                "columnName": "RecipientEmail",
                "identifier": "Recipient"
              },
              {
                "columnName": "SenderEmail",
                "identifier": "Sender"
              },
              {
                "columnName": "MessageId",
                "identifier": "NetworkMessageId"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SenderIP",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AbnormalSecurity/Analytic%20Rules/AbnormalSecurity_HighRiskEmailAttack.yaml",
        "query": "ABNORMAL_SECURITY_THREAT_LOG_CL\n| where abx_body_abx_body_attack_type_s in~ (\n    \"Phishing: Credential\",\n    \"Social Engineering (BEC)\",\n    \"Invoice/Payment Fraud (BEC)\",\n    \"Malware\",\n    \"Extortion\",\n    \"Phishing: Sensitive Data\",\n    \"Internal-to-Internal Attacks (Email Account Takeover)\",\n    \"Scam\")\n| extend\n    RecipientEmail = abx_body_abx_body_recipient_address_s,\n    SenderEmail = abx_body_abx_body_from_address_s,\n    SenderName = abx_body_abx_body_from_name_s,\n    SenderIP = abx_body_abx_body_sender_ip_address_s,\n    Subject = abx_body_abx_body_subject_s,\n    MessageId = abx_body_abx_body_internet_message_id_s,\n    AttackType = abx_body_abx_body_attack_type_s,\n    AttackScore = abx_body_abx_body_attack_score_d,\n    RemediationStatus = abx_body_abx_body_remediation_status_s,\n    PortalUrl = abx_body_abx_body_abx_portal_url_s\n| project TimeGenerated, RecipientEmail, SenderEmail, SenderName, SenderIP, Subject, MessageId, AttackType, AttackScore, RemediationStatus, PortalUrl\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1566"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}