PRODAFT USTA - Corporate credential compromised | Microsoft Sentinel Analytic Rules

Back


Id	9ad6cf22-ffbb-4422-9933-9bbd0104f818
Rulename	PRODAFT USTA - Corporate credential compromised
Description	Identifies a new PRODAFT USTA Account Takeover Prevention ticket that exposes a corporate credential (IsCorporate = true). These typically originate from infostealer infections on a victim host and indicate that a valid corporate identity may be available to threat actors. Investigate the affected account, reset credentials, and review the victim host for malware.
Severity	High
Tactics	CredentialAccess InitialAccess
Techniques	T1555 T1078
Required data connectors	PRODAFTUstaATPCCPDefinition
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PRODAFT%20USTA%20-%20Account%20Takeover%20Prevention/Analytic%20Rules/CorporateCredentialCompromised.yaml
Version	1.0.0
Arm template	9ad6cf22-ffbb-4422-9933-9bbd0104f818.json

KQL

PRODAFTUstaCompromisedCredentials
| where Created > ago(1h)
| where IsCorporate == true
| project
    TimeGenerated,
    Created,
    TicketId,
    CompanyName,
    Username,
    Url,
    Source,
    PasswordScore,
    VictimComputerName,
    VictimOs,
    VictimCountry,
    VictimIp,
    VictimMalware,
    InfectionDate,
    Status

YAML

queryFrequency: 1h
triggerThreshold: 0
relevantTechniques:
- T1555
- T1078
tactics:
- CredentialAccess
- InitialAccess
status: Available
name: PRODAFT USTA - Corporate credential compromised
description: |
  'Identifies a new PRODAFT USTA Account Takeover Prevention ticket that exposes a
  corporate credential (IsCorporate = true). These typically originate from infostealer
  infections on a victim host and indicate that a valid corporate identity may be
  available to threat actors. Investigate the affected account, reset credentials, and
  review the victim host for malware.'
customDetails:
  Source: Source
  PasswordScore: PasswordScore
  Company: CompanyName
  Ticket: TicketId
  Malware: VictimMalware
version: 1.0.0
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PRODAFT%20USTA%20-%20Account%20Takeover%20Prevention/Analytic%20Rules/CorporateCredentialCompromised.yaml
id: 9ad6cf22-ffbb-4422-9933-9bbd0104f818
requiredDataConnectors:
- dataTypes:
  - PRODAFTUstaCompromisedCredentials_CL
  connectorId: PRODAFTUstaATPCCPDefinition
severity: High
incidentConfiguration:
  groupingConfiguration:
    matchingMethod: Selected
    groupByEntities:
    - Account
    lookbackDuration: 1h
    reopenClosedIncident: false
    enabled: true
  createIncident: true
triggerOperator: gt
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: Username
    identifier: FullName
- entityType: Host
  fieldMappings:
  - columnName: VictimComputerName
    identifier: HostName
- entityType: IP
  fieldMappings:
  - columnName: VictimIp
    identifier: Address
queryPeriod: 1h
query: |
  PRODAFTUstaCompromisedCredentials
  | where Created > ago(1h)
  | where IsCorporate == true
  | project
      TimeGenerated,
      Created,
      TicketId,
      CompanyName,
      Username,
      Url,
      Source,
      PasswordScore,
      VictimComputerName,
      VictimOs,
      VictimCountry,
      VictimIp,
      VictimMalware,
      InfectionDate,
      Status

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/9ad6cf22-ffbb-4422-9933-9bbd0104f818')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/9ad6cf22-ffbb-4422-9933-9bbd0104f818')]",
      "properties": {
        "alertRuleTemplateName": "9ad6cf22-ffbb-4422-9933-9bbd0104f818",
        "customDetails": {
          "Company": "CompanyName",
          "Malware": "VictimMalware",
          "PasswordScore": "PasswordScore",
          "Source": "Source",
          "Ticket": "TicketId"
        },
        "description": "'Identifies a new PRODAFT USTA Account Takeover Prevention ticket that exposes a\ncorporate credential (IsCorporate = true). These typically originate from infostealer\ninfections on a victim host and indicate that a valid corporate identity may be\navailable to threat actors. Investigate the affected account, reset credentials, and\nreview the victim host for malware.'\n",
        "displayName": "PRODAFT USTA - Corporate credential compromised",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "Username",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "VictimComputerName",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "VictimIp",
                "identifier": "Address"
              }
            ]
          }
        ],
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByEntities": [
              "Account"
            ],
            "lookbackDuration": "PT1H",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PRODAFT%20USTA%20-%20Account%20Takeover%20Prevention/Analytic%20Rules/CorporateCredentialCompromised.yaml",
        "query": "PRODAFTUstaCompromisedCredentials\n| where Created > ago(1h)\n| where IsCorporate == true\n| project\n    TimeGenerated,\n    Created,\n    TicketId,\n    CompanyName,\n    Username,\n    Url,\n    Source,\n    PasswordScore,\n    VictimComputerName,\n    VictimOs,\n    VictimCountry,\n    VictimIp,\n    VictimMalware,\n    InfectionDate,\n    Status\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "InitialAccess"
        ],
        "techniques": [
          "T1078",
          "T1555"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}