Egress Defend - Dangerous Attachment Detected

Back


Id	a0e55dd4-8454-4396-91e6-f28fec3d2cab
Rulename	Egress Defend - Dangerous Attachment Detected
Description	Defend has detected a user has a suspicious file type from a suspicious sender in their mailbox.
Severity	Medium
Tactics	Execution InitialAccess Persistence PrivilegeEscalation
Techniques	T1204 T0853 T0863 T1566 T1546 T1546
Required data connectors	EgressDefend
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Egress Defend/Analytic Rules/DangerousAttachmentReceived.yaml
Version	1.0.0
Arm template	a0e55dd4-8454-4396-91e6-f28fec3d2cab.json

KQL

DefendAuditData
| where ThreatLevel == "suspicious" or ThreatLevel == "dangerous"
| mv-expand todynamic(Attachments)
| where Attachments.name matches regex @"(?i)^.*\.(doc|docx|docm|pdf|xls|xlsx|xlsm|html|zip)$(?-i)"
| summarize attachmentCount=count() by TimeGenerated, tostring(Attachments.name), Subject, From, Account_0_FullName = trim(@"[^@.\w]+",Recipients), timesClicked = LinksClicked, SenderIP

YAML

triggerThreshold: 0
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: Account_0_FullName
- entityType: File
  fieldMappings:
  - identifier: Name
    columnName: Attachments_name
- entityType: Mailbox
  fieldMappings:
  - identifier: MailboxPrimaryAddress
    columnName: Account_0_FullName
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SenderIP
requiredDataConnectors:
- dataTypes:
  - EgressDefend_CL
  connectorId: EgressDefend
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Egress Defend/Analytic Rules/DangerousAttachmentReceived.yaml
tags:
- Defend
name: Egress Defend - Dangerous Attachment Detected
alertDetailsOverride:
  alertDisplayNameFormat: Alert - {{Account_0_FullName}} has suspicious attachment.
relevantTechniques:
- T1204
- T0853
- T0863
- T1566
- T1546
- T1546
status: Available
version: 1.0.0
queryPeriod: 30m
kind: Scheduled
id: a0e55dd4-8454-4396-91e6-f28fec3d2cab
query: |
  DefendAuditData
  | where ThreatLevel == "suspicious" or ThreatLevel == "dangerous"
  | mv-expand todynamic(Attachments)
  | where Attachments.name matches regex @"(?i)^.*\.(doc|docx|docm|pdf|xls|xlsx|xlsm|html|zip)$(?-i)"
  | summarize attachmentCount=count() by TimeGenerated, tostring(Attachments.name), Subject, From, Account_0_FullName = trim(@"[^@.\w]+",Recipients), timesClicked = LinksClicked, SenderIP  
description: |
    'Defend has detected a user has a suspicious file type from a suspicious sender in their mailbox.'
queryFrequency: 30m
severity: Medium
triggerOperator: gt
tactics:
- Execution
- InitialAccess
- Persistence
- PrivilegeEscalation

ARM