Egress Defend - Dangerous Attachment Detected

Back


Id	a0e55dd4-8454-4396-91e6-f28fec3d2cab
Rulename	Egress Defend - Dangerous Attachment Detected
Description	Defend has detected a user has a suspicious file type from a suspicious sender in their mailbox.
Severity	Medium
Tactics	Execution InitialAccess Persistence PrivilegeEscalation
Techniques	T1204 T0853 T0863 T1566 T1546 T1546
Required data connectors	EgressDefend
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Egress Defend/Analytic Rules/DangerousAttachmentReceived.yaml
Version	1.0.0
Arm template	a0e55dd4-8454-4396-91e6-f28fec3d2cab.json

KQL

DefendAuditData
| where ThreatLevel == "suspicious" or ThreatLevel == "dangerous"
| mv-expand todynamic(Attachments)
| where Attachments.name matches regex @"(?i)^.*\.(doc|docx|docm|pdf|xls|xlsx|xlsm|html|zip)$(?-i)"
| summarize attachmentCount=count() by TimeGenerated, tostring(Attachments.name), Subject, From, Account_0_FullName = trim(@"[^@.\w]+",Recipients), timesClicked = LinksClicked, SenderIP

YAML

id: a0e55dd4-8454-4396-91e6-f28fec3d2cab
requiredDataConnectors:
- dataTypes:
  - EgressDefend_CL
  connectorId: EgressDefend
name: Egress Defend - Dangerous Attachment Detected
version: 1.0.0
query: |
  DefendAuditData
  | where ThreatLevel == "suspicious" or ThreatLevel == "dangerous"
  | mv-expand todynamic(Attachments)
  | where Attachments.name matches regex @"(?i)^.*\.(doc|docx|docm|pdf|xls|xlsx|xlsm|html|zip)$(?-i)"
  | summarize attachmentCount=count() by TimeGenerated, tostring(Attachments.name), Subject, From, Account_0_FullName = trim(@"[^@.\w]+",Recipients), timesClicked = LinksClicked, SenderIP  
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: Account_0_FullName
  entityType: Account
- fieldMappings:
  - identifier: Name
    columnName: Attachments_name
  entityType: File
- fieldMappings:
  - identifier: MailboxPrimaryAddress
    columnName: Account_0_FullName
  entityType: Mailbox
- fieldMappings:
  - identifier: Address
    columnName: SenderIP
  entityType: IP
alertDetailsOverride:
  alertDisplayNameFormat: Alert - {{Account_0_FullName}} has suspicious attachment.
relevantTechniques:
- T1204
- T0853
- T0863
- T1566
- T1546
- T1546
tactics:
- Execution
- InitialAccess
- Persistence
- PrivilegeEscalation
triggerThreshold: 0
queryPeriod: 30m
queryFrequency: 30m
severity: Medium
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Egress Defend/Analytic Rules/DangerousAttachmentReceived.yaml
triggerOperator: gt
status: Available
description: |
    'Defend has detected a user has a suspicious file type from a suspicious sender in their mailbox.'
tags:
- Defend

ARM