TacitRed - Repeat Compromise Detection

Back


Id	a1b2c3d4-e5f6-7890-abcd-ef1234567890
Rulename	TacitRed - Repeat Compromise Detection
Description	Detects users who have been compromised multiple times within a 7-day window. This may indicate a persistent threat or inadequate remediation. Ref: https://data443.com/tacitred-attack-surface-intelligence/
Severity	High
Tactics	CredentialAccess Persistence
Techniques	T1078
Required data connectors	TacitRedThreatIntel
Kind	Scheduled
Query frequency	1h
Query period	7d
Trigger threshold	0
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/TacitRedThreatIntelligence/Analytic Rules/TacitRed - Repeat Compromise Detection.yaml
Version	1.0.1
Arm template	a1b2c3d4-e5f6-7890-abcd-ef1234567890.json

KQL

let lookback = 7d;
TacitRed_Findings_CL
| where TimeGenerated >= ago(lookback)
| summarize
    CompromiseCount = count(),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated),
    Sources = make_set(source_s),
    AvgConfidence = avg(confidence_d)
  by email_s, domain_s
| where CompromiseCount > 1
| extend
    Email = tostring(email_s),
    Domain = tostring(domain_s)
| project
    Email,
    Domain,
    CompromiseCount,
    FirstSeen,
    LastSeen,
    Sources,
    AvgConfidence

YAML

eventGroupingSettings:
  aggregationKind: AlertPerResult
triggerThreshold: 0
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: Email
- entityType: DNS
  fieldMappings:
  - identifier: DomainName
    columnName: Domain
requiredDataConnectors:
- dataTypes:
  - TacitRed_Findings_CL
  connectorId: TacitRedThreatIntel
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/TacitRedThreatIntelligence/Analytic Rules/TacitRed - Repeat Compromise Detection.yaml
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    lookbackDuration: 5h
    reopenClosedIncident: false
    enabled: true
    groupByEntities:
    - Account
    matchingMethod: Selected
name: TacitRed - Repeat Compromise Detection
relevantTechniques:
- T1078
query: |-
  let lookback = 7d;
  TacitRed_Findings_CL
  | where TimeGenerated >= ago(lookback)
  | summarize
      CompromiseCount = count(),
      FirstSeen = min(TimeGenerated),
      LastSeen = max(TimeGenerated),
      Sources = make_set(source_s),
      AvgConfidence = avg(confidence_d)
    by email_s, domain_s
  | where CompromiseCount > 1
  | extend
      Email = tostring(email_s),
      Domain = tostring(domain_s)
  | project
      Email,
      Domain,
      CompromiseCount,
      FirstSeen,
      LastSeen,
      Sources,
      AvgConfidence  
version: 1.0.1
queryPeriod: 7d
kind: Scheduled
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
description: |-
  Detects users who have been compromised multiple times within a 7-day window.
  This may indicate a persistent threat or inadequate remediation.

  Ref: https://data443.com/tacitred-attack-surface-intelligence/  
queryFrequency: 1h
severity: High
triggerOperator: GreaterThan
tactics:
- CredentialAccess
- Persistence
suppressionDuration: 5h

ARM