Egress Defend - Dangerous Attachment Detected

Back


Id	a0e55dd4-8454-4396-91e6-f28fec3d2cab
Rulename	Egress Defend - Dangerous Attachment Detected
Description	Defend has detected a user has a suspicious file type from a suspicious sender in their mailbox.
Severity	Medium
Tactics	Execution InitialAccess Persistence PrivilegeEscalation
Techniques	T1204 T0853 T0863 T1566 T1546 T1546
Required data connectors	EgressDefend
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Egress Defend/Analytic Rules/DangerousAttachmentReceived.yaml
Version	1.0.0
Arm template	a0e55dd4-8454-4396-91e6-f28fec3d2cab.json

KQL

DefendAuditData
| where ThreatLevel == "suspicious" or ThreatLevel == "dangerous"
| mv-expand todynamic(Attachments)
| where Attachments.name matches regex @"(?i)^.*\.(doc|docx|docm|pdf|xls|xlsx|xlsm|html|zip)$(?-i)"
| summarize attachmentCount=count() by TimeGenerated, tostring(Attachments.name), Subject, From, Account_0_FullName = trim(@"[^@.\w]+",Recipients), timesClicked = LinksClicked, SenderIP

YAML

kind: Scheduled
requiredDataConnectors:
- connectorId: EgressDefend
  dataTypes:
  - EgressDefend_CL
queryPeriod: 30m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Egress Defend/Analytic Rules/DangerousAttachmentReceived.yaml
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: Account_0_FullName
    identifier: FullName
- entityType: File
  fieldMappings:
  - columnName: Attachments_name
    identifier: Name
- entityType: Mailbox
  fieldMappings:
  - columnName: Account_0_FullName
    identifier: MailboxPrimaryAddress
- entityType: IP
  fieldMappings:
  - columnName: SenderIP
    identifier: Address
severity: Medium
version: 1.0.0
name: Egress Defend - Dangerous Attachment Detected
alertDetailsOverride:
  alertDisplayNameFormat: Alert - {{Account_0_FullName}} has suspicious attachment.
relevantTechniques:
- T1204
- T0853
- T0863
- T1566
- T1546
- T1546
tactics:
- Execution
- InitialAccess
- Persistence
- PrivilegeEscalation
triggerOperator: gt
id: a0e55dd4-8454-4396-91e6-f28fec3d2cab
tags:
- Defend
query: |
  DefendAuditData
  | where ThreatLevel == "suspicious" or ThreatLevel == "dangerous"
  | mv-expand todynamic(Attachments)
  | where Attachments.name matches regex @"(?i)^.*\.(doc|docx|docm|pdf|xls|xlsx|xlsm|html|zip)$(?-i)"
  | summarize attachmentCount=count() by TimeGenerated, tostring(Attachments.name), Subject, From, Account_0_FullName = trim(@"[^@.\w]+",Recipients), timesClicked = LinksClicked, SenderIP  
description: |
    'Defend has detected a user has a suspicious file type from a suspicious sender in their mailbox.'
queryFrequency: 30m
triggerThreshold: 0
status: Available

ARM