TacitRed - Repeat Compromise Detection | Microsoft Sentinel Analytic Rules

Back


Id	a1b2c3d4-e5f6-7890-abcd-ef1234567890
Rulename	TacitRed - Repeat Compromise Detection
Description	Detects users who have been compromised multiple times within a 7-day window. This may indicate a persistent threat or inadequate remediation. Ref: https://data443.com/tacitred-attack-surface-intelligence/
Severity	High
Tactics	CredentialAccess Persistence
Techniques	T1078
Required data connectors	TacitRedThreatIntel
Kind	Scheduled
Query frequency	1h
Query period	7d
Trigger threshold	0
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/TacitRedThreatIntelligence/Analytic%20Rules/TacitRed%20-%20Repeat%20Compromise%20Detection.yaml
Version	1.0.1
Arm template	a1b2c3d4-e5f6-7890-abcd-ef1234567890.json

KQL

let lookback = 7d;
TacitRed_Findings_CL
| where TimeGenerated >= ago(lookback)
| summarize
    CompromiseCount = count(),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated),
    Sources = make_set(source_s),
    AvgConfidence = avg(confidence_d)
  by email_s, domain_s
| where CompromiseCount > 1
| extend
    Email = tostring(email_s),
    Domain = tostring(domain_s)
| project
    Email,
    Domain,
    CompromiseCount,
    FirstSeen,
    LastSeen,
    Sources,
    AvgConfidence

YAML

kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/TacitRedThreatIntelligence/Analytic%20Rules/TacitRed%20-%20Repeat%20Compromise%20Detection.yaml
version: 1.0.1
requiredDataConnectors:
- dataTypes:
  - TacitRed_Findings_CL
  connectorId: TacitRedThreatIntel
relevantTechniques:
- T1078
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: 5h
    matchingMethod: Selected
    reopenClosedIncident: false
    groupByEntities:
    - Account
    enabled: true
  createIncident: true
suppressionEnabled: false
query: |-
  let lookback = 7d;
  TacitRed_Findings_CL
  | where TimeGenerated >= ago(lookback)
  | summarize
      CompromiseCount = count(),
      FirstSeen = min(TimeGenerated),
      LastSeen = max(TimeGenerated),
      Sources = make_set(source_s),
      AvgConfidence = avg(confidence_d)
    by email_s, domain_s
  | where CompromiseCount > 1
  | extend
      Email = tostring(email_s),
      Domain = tostring(domain_s)
  | project
      Email,
      Domain,
      CompromiseCount,
      FirstSeen,
      LastSeen,
      Sources,
      AvgConfidence
tactics:
- CredentialAccess
- Persistence
queryFrequency: 1h
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
triggerThreshold: 0
triggerOperator: GreaterThan
name: TacitRed - Repeat Compromise Detection
queryPeriod: 7d
severity: High
entityMappings:
- fieldMappings:
  - columnName: Email
    identifier: Name
  entityType: Account
- fieldMappings:
  - columnName: Domain
    identifier: DomainName
  entityType: DNS
suppressionDuration: 5h
eventGroupingSettings:
  aggregationKind: AlertPerResult
description: |-
  Detects users who have been compromised multiple times within a 7-day window.
  This may indicate a persistent threat or inadequate remediation.

  Ref: https://data443.com/tacitred-attack-surface-intelligence/

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/a1b2c3d4-e5f6-7890-abcd-ef1234567890')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/a1b2c3d4-e5f6-7890-abcd-ef1234567890')]",
      "properties": {
        "alertRuleTemplateName": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "customDetails": null,
        "description": "Detects users who have been compromised multiple times within a 7-day window.\nThis may indicate a persistent threat or inadequate remediation.\n\nRef: https://data443.com/tacitred-attack-surface-intelligence/",
        "displayName": "TacitRed - Repeat Compromise Detection",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "Email",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "DNS",
            "fieldMappings": [
              {
                "columnName": "Domain",
                "identifier": "DomainName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByEntities": [
              "Account"
            ],
            "lookbackDuration": "PT5H",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/TacitRedThreatIntelligence/Analytic%20Rules/TacitRed%20-%20Repeat%20Compromise%20Detection.yaml",
        "query": "let lookback = 7d;\nTacitRed_Findings_CL\n| where TimeGenerated >= ago(lookback)\n| summarize\n    CompromiseCount = count(),\n    FirstSeen = min(TimeGenerated),\n    LastSeen = max(TimeGenerated),\n    Sources = make_set(source_s),\n    AvgConfidence = avg(confidence_d)\n  by email_s, domain_s\n| where CompromiseCount > 1\n| extend\n    Email = tostring(email_s),\n    Domain = tostring(domain_s)\n| project\n    Email,\n    Domain,\n    CompromiseCount,\n    FirstSeen,\n    LastSeen,\n    Sources,\n    AvgConfidence",
        "queryFrequency": "PT1H",
        "queryPeriod": "P7D",
        "severity": "High",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "Persistence"
        ],
        "techniques": [
          "T1078"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}