PRODAFT USTA - Corporate credential compromised | Microsoft Sentinel Analytic Rules

Back


Id	9ad6cf22-ffbb-4422-9933-9bbd0104f818
Rulename	PRODAFT USTA - Corporate credential compromised
Description	Identifies a new PRODAFT USTA Account Takeover Prevention ticket that exposes a corporate credential (IsCorporate = true). These typically originate from infostealer infections on a victim host and indicate that a valid corporate identity may be available to threat actors. Investigate the affected account, reset credentials, and review the victim host for malware.
Severity	High
Tactics	CredentialAccess InitialAccess
Techniques	T1555 T1078
Required data connectors	PRODAFTUstaATPCCPDefinition
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PRODAFT%20USTA%20-%20Account%20Takeover%20Prevention/Analytic%20Rules/CorporateCredentialCompromised.yaml
Version	1.0.0
Arm template	9ad6cf22-ffbb-4422-9933-9bbd0104f818.json

KQL

PRODAFTUstaCompromisedCredentials
| where Created > ago(1h)
| where IsCorporate == true
| project
    TimeGenerated,
    Created,
    TicketId,
    CompanyName,
    Username,
    Url,
    Source,
    PasswordScore,
    VictimComputerName,
    VictimOs,
    VictimCountry,
    VictimIp,
    VictimMalware,
    InfectionDate,
    Status

YAML

queryFrequency: 1h
entityMappings:
- fieldMappings:
  - columnName: Username
    identifier: FullName
  entityType: Account
- fieldMappings:
  - columnName: VictimComputerName
    identifier: HostName
  entityType: Host
- fieldMappings:
  - columnName: VictimIp
    identifier: Address
  entityType: IP
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    groupByEntities:
    - Account
    reopenClosedIncident: false
    matchingMethod: Selected
    lookbackDuration: 1h
    enabled: true
triggerThreshold: 0
triggerOperator: gt
severity: High
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PRODAFT%20USTA%20-%20Account%20Takeover%20Prevention/Analytic%20Rules/CorporateCredentialCompromised.yaml
query: |
  PRODAFTUstaCompromisedCredentials
  | where Created > ago(1h)
  | where IsCorporate == true
  | project
      TimeGenerated,
      Created,
      TicketId,
      CompanyName,
      Username,
      Url,
      Source,
      PasswordScore,
      VictimComputerName,
      VictimOs,
      VictimCountry,
      VictimIp,
      VictimMalware,
      InfectionDate,
      Status
tactics:
- CredentialAccess
- InitialAccess
queryPeriod: 1h
customDetails:
  PasswordScore: PasswordScore
  Company: CompanyName
  Ticket: TicketId
  Malware: VictimMalware
  Source: Source
relevantTechniques:
- T1555
- T1078
requiredDataConnectors:
- connectorId: PRODAFTUstaATPCCPDefinition
  dataTypes:
  - PRODAFTUstaCompromisedCredentials_CL
id: 9ad6cf22-ffbb-4422-9933-9bbd0104f818
kind: Scheduled
version: 1.0.0
description: |
  'Identifies a new PRODAFT USTA Account Takeover Prevention ticket that exposes a
  corporate credential (IsCorporate = true). These typically originate from infostealer
  infections on a victim host and indicate that a valid corporate identity may be
  available to threat actors. Investigate the affected account, reset credentials, and
  review the victim host for malware.'
status: Available
name: PRODAFT USTA - Corporate credential compromised

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/9ad6cf22-ffbb-4422-9933-9bbd0104f818')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/9ad6cf22-ffbb-4422-9933-9bbd0104f818')]",
      "properties": {
        "alertRuleTemplateName": "9ad6cf22-ffbb-4422-9933-9bbd0104f818",
        "customDetails": {
          "Company": "CompanyName",
          "Malware": "VictimMalware",
          "PasswordScore": "PasswordScore",
          "Source": "Source",
          "Ticket": "TicketId"
        },
        "description": "'Identifies a new PRODAFT USTA Account Takeover Prevention ticket that exposes a\ncorporate credential (IsCorporate = true). These typically originate from infostealer\ninfections on a victim host and indicate that a valid corporate identity may be\navailable to threat actors. Investigate the affected account, reset credentials, and\nreview the victim host for malware.'\n",
        "displayName": "PRODAFT USTA - Corporate credential compromised",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "Username",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "VictimComputerName",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "VictimIp",
                "identifier": "Address"
              }
            ]
          }
        ],
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByEntities": [
              "Account"
            ],
            "lookbackDuration": "PT1H",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PRODAFT%20USTA%20-%20Account%20Takeover%20Prevention/Analytic%20Rules/CorporateCredentialCompromised.yaml",
        "query": "PRODAFTUstaCompromisedCredentials\n| where Created > ago(1h)\n| where IsCorporate == true\n| project\n    TimeGenerated,\n    Created,\n    TicketId,\n    CompanyName,\n    Username,\n    Url,\n    Source,\n    PasswordScore,\n    VictimComputerName,\n    VictimOs,\n    VictimCountry,\n    VictimIp,\n    VictimMalware,\n    InfectionDate,\n    Status\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "InitialAccess"
        ],
        "techniques": [
          "T1078",
          "T1555"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}