PRODAFT USTA - Corporate credential compromised | Microsoft Sentinel Analytic Rules

Back


Id	9ad6cf22-ffbb-4422-9933-9bbd0104f818
Rulename	PRODAFT USTA - Corporate credential compromised
Description	Identifies a new PRODAFT USTA Account Takeover Prevention ticket that exposes a corporate credential (IsCorporate = true). These typically originate from infostealer infections on a victim host and indicate that a valid corporate identity may be available to threat actors. Investigate the affected account, reset credentials, and review the victim host for malware.
Severity	High
Tactics	CredentialAccess InitialAccess
Techniques	T1555 T1078
Required data connectors	PRODAFTUstaATPCCPDefinition
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PRODAFT%20USTA%20-%20Account%20Takeover%20Prevention/Analytic%20Rules/CorporateCredentialCompromised.yaml
Version	1.0.0
Arm template	9ad6cf22-ffbb-4422-9933-9bbd0104f818.json

KQL

PRODAFTUstaCompromisedCredentials
| where Created > ago(1h)
| where IsCorporate == true
| project
    TimeGenerated,
    Created,
    TicketId,
    CompanyName,
    Username,
    Url,
    Source,
    PasswordScore,
    VictimComputerName,
    VictimOs,
    VictimCountry,
    VictimIp,
    VictimMalware,
    InfectionDate,
    Status

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: Username
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: VictimComputerName
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: VictimIp
name: PRODAFT USTA - Corporate credential compromised
kind: Scheduled
triggerOperator: gt
status: Available
queryPeriod: 1h
requiredDataConnectors:
- connectorId: PRODAFTUstaATPCCPDefinition
  dataTypes:
  - PRODAFTUstaCompromisedCredentials_CL
tactics:
- CredentialAccess
- InitialAccess
query: |
  PRODAFTUstaCompromisedCredentials
  | where Created > ago(1h)
  | where IsCorporate == true
  | project
      TimeGenerated,
      Created,
      TicketId,
      CompanyName,
      Username,
      Url,
      Source,
      PasswordScore,
      VictimComputerName,
      VictimOs,
      VictimCountry,
      VictimIp,
      VictimMalware,
      InfectionDate,
      Status
description: |
  'Identifies a new PRODAFT USTA Account Takeover Prevention ticket that exposes a
  corporate credential (IsCorporate = true). These typically originate from infostealer
  infections on a victim host and indicate that a valid corporate identity may be
  available to threat actors. Investigate the affected account, reset credentials, and
  review the victim host for malware.'
severity: High
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: 1h
    groupByEntities:
    - Account
    enabled: true
    matchingMethod: Selected
    reopenClosedIncident: false
  createIncident: true
id: 9ad6cf22-ffbb-4422-9933-9bbd0104f818
customDetails:
  PasswordScore: PasswordScore
  Company: CompanyName
  Source: Source
  Ticket: TicketId
  Malware: VictimMalware
triggerThreshold: 0
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PRODAFT%20USTA%20-%20Account%20Takeover%20Prevention/Analytic%20Rules/CorporateCredentialCompromised.yaml
version: 1.0.0
relevantTechniques:
- T1555
- T1078

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/9ad6cf22-ffbb-4422-9933-9bbd0104f818')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/9ad6cf22-ffbb-4422-9933-9bbd0104f818')]",
      "properties": {
        "alertRuleTemplateName": "9ad6cf22-ffbb-4422-9933-9bbd0104f818",
        "customDetails": {
          "Company": "CompanyName",
          "Malware": "VictimMalware",
          "PasswordScore": "PasswordScore",
          "Source": "Source",
          "Ticket": "TicketId"
        },
        "description": "'Identifies a new PRODAFT USTA Account Takeover Prevention ticket that exposes a\ncorporate credential (IsCorporate = true). These typically originate from infostealer\ninfections on a victim host and indicate that a valid corporate identity may be\navailable to threat actors. Investigate the affected account, reset credentials, and\nreview the victim host for malware.'\n",
        "displayName": "PRODAFT USTA - Corporate credential compromised",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "Username",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "VictimComputerName",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "VictimIp",
                "identifier": "Address"
              }
            ]
          }
        ],
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByEntities": [
              "Account"
            ],
            "lookbackDuration": "PT1H",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PRODAFT%20USTA%20-%20Account%20Takeover%20Prevention/Analytic%20Rules/CorporateCredentialCompromised.yaml",
        "query": "PRODAFTUstaCompromisedCredentials\n| where Created > ago(1h)\n| where IsCorporate == true\n| project\n    TimeGenerated,\n    Created,\n    TicketId,\n    CompanyName,\n    Username,\n    Url,\n    Source,\n    PasswordScore,\n    VictimComputerName,\n    VictimOs,\n    VictimCountry,\n    VictimIp,\n    VictimMalware,\n    InfectionDate,\n    Status\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "InitialAccess"
        ],
        "techniques": [
          "T1078",
          "T1555"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}