Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

RecordedFuture Threat Hunting Domain All Actors

Back
Idacbf7ef6-f964-44c3-9031-7834ec68175f
RulenameRecordedFuture Threat Hunting Domain All Actors
DescriptionRecorded Future Threat Hunting domain correlation for all actors.
SeverityMedium
TacticsInitialAccess
CommandAndControl
TechniquesT1566
T1568
Required data connectorsThreatIntelligenceUploadIndicatorsAPI
KindScheduled
Query frequency15m
Query period1d
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Recorded Future/Analytic Rules/ThreatHunting/RecordedFutureThreatHuntingDomainAllActors.yaml
Version1.1.0
Arm templateacbf7ef6-f964-44c3-9031-7834ec68175f.json
Deploy To Azure
let ioc_lookBack = 1d;
// The source table (_Im_Dns) is an ASIM parser table, but can be replaced by any infrastructure table containing domain/dns data.
// The following workbook: Recorded Future - Domain Correlation will help researching available data and selecting tables and columns
_Im_Dns
| where isnotempty(Domain)
| extend lowerDomain=tolower(Domain)
| join kind=inner (
ThreatIntelIndicators
// Only look at Domain IOCs
| where ObservableKey == 'domain-name:value'
| where isnotempty(ObservableValue)
// Only look at Recorded Future Threat Hunt Indicators.
| where Data.description startswith "Recorded Future - Threat Hunt"
// Only work with the latest indicators
| where TimeGenerated >= ago(ioc_lookBack)
| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
| where IsActive == true and ValidUntil > now()
| extend lowerDomain=tolower(ObservableValue)
) on lowerDomain
// select column from the source table to match with Recorded Future $left.Domain
| mv-expand RecordedFuturePortalLink=parse_json(tostring(parse_json(Tags)))['recordedfutureportallink']
| project Domain=ObservableValue, Description=Data.description, Type, TimeGenerated, RecordedFuturePortalLink
eventGroupingSettings:
  aggregationKind: AlertPerResult
customDetails:
  ActorInformation: RecordedFuturePortalLink
kind: Scheduled
queryFrequency: 15m
queryPeriod: 1d
version: 1.1.0
description: |
    'Recorded Future Threat Hunting domain correlation for all actors.'
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - columnName: Domain
    identifier: DomainName
  entityType: DNS
tactics:
- InitialAccess
- CommandAndControl
relevantTechniques:
- T1566
- T1568
requiredDataConnectors:
- dataTypes:
  - ThreatIntelIndicators
  connectorId: ThreatIntelligenceUploadIndicatorsAPI
alertDetailsOverride:
  alertDynamicProperties:
  - value: RecordedFuturePortalLink
    alertProperty: AlertLink
  alertDisplayNameFormat: '{{Description}}'
  alertDescriptionFormat: '**{{Description}}**\n\nCorrelation found on {{Domain}} from the {{Type}} table.\n'
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    matchingMethod: AllEntities
    lookbackDuration: 1h
    reopenClosedIncident: false
    enabled: true
severity: Medium
id: acbf7ef6-f964-44c3-9031-7834ec68175f
query: |
  let ioc_lookBack = 1d;
  // The source table (_Im_Dns) is an ASIM parser table, but can be replaced by any infrastructure table containing domain/dns data.
  // The following workbook: Recorded Future - Domain Correlation will help researching available data and selecting tables and columns
  _Im_Dns
  | where isnotempty(Domain)
  | extend lowerDomain=tolower(Domain)
  | join kind=inner (
  ThreatIntelIndicators
  // Only look at Domain IOCs
  | where ObservableKey == 'domain-name:value'
  | where isnotempty(ObservableValue)
  // Only look at Recorded Future Threat Hunt Indicators.
  | where Data.description startswith "Recorded Future - Threat Hunt"
  // Only work with the latest indicators
  | where TimeGenerated >= ago(ioc_lookBack)
  | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
  | where IsActive == true and ValidUntil > now()
  | extend lowerDomain=tolower(ObservableValue)
  ) on lowerDomain
  // select column from the source table to match with Recorded Future $left.Domain
  | mv-expand RecordedFuturePortalLink=parse_json(tostring(parse_json(Tags)))['recordedfutureportallink']
  | project Domain=ObservableValue, Description=Data.description, Type, TimeGenerated, RecordedFuturePortalLink  
triggerOperator: gt
name: RecordedFuture Threat Hunting Domain All Actors
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Recorded Future/Analytic Rules/ThreatHunting/RecordedFutureThreatHuntingDomainAllActors.yaml
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/acbf7ef6-f964-44c3-9031-7834ec68175f')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/acbf7ef6-f964-44c3-9031-7834ec68175f')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "**{{Description}}**\\n\\nCorrelation found on {{Domain}} from the {{Type}} table.\\n",
          "alertDisplayNameFormat": "{{Description}}",
          "alertDynamicProperties": [
            {
              "alertProperty": "AlertLink",
              "value": "RecordedFuturePortalLink"
            }
          ]
        },
        "alertRuleTemplateName": "acbf7ef6-f964-44c3-9031-7834ec68175f",
        "customDetails": {
          "ActorInformation": "RecordedFuturePortalLink"
        },
        "description": "'Recorded Future Threat Hunting domain correlation for all actors.'\n",
        "displayName": "RecordedFuture Threat Hunting Domain All Actors",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "DNS",
            "fieldMappings": [
              {
                "columnName": "Domain",
                "identifier": "DomainName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "lookbackDuration": "PT1H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Recorded Future/Analytic Rules/ThreatHunting/RecordedFutureThreatHuntingDomainAllActors.yaml",
        "query": "let ioc_lookBack = 1d;\n// The source table (_Im_Dns) is an ASIM parser table, but can be replaced by any infrastructure table containing domain/dns data.\n// The following workbook: Recorded Future - Domain Correlation will help researching available data and selecting tables and columns\n_Im_Dns\n| where isnotempty(Domain)\n| extend lowerDomain=tolower(Domain)\n| join kind=inner (\nThreatIntelIndicators\n// Only look at Domain IOCs\n| where ObservableKey == 'domain-name:value'\n| where isnotempty(ObservableValue)\n// Only look at Recorded Future Threat Hunt Indicators.\n| where Data.description startswith \"Recorded Future - Threat Hunt\"\n// Only work with the latest indicators\n| where TimeGenerated >= ago(ioc_lookBack)\n| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id\n| where IsActive == true and ValidUntil > now()\n| extend lowerDomain=tolower(ObservableValue)\n) on lowerDomain\n// select column from the source table to match with Recorded Future $left.Domain\n| mv-expand RecordedFuturePortalLink=parse_json(tostring(parse_json(Tags)))['recordedfutureportallink']\n| project Domain=ObservableValue, Description=Data.description, Type, TimeGenerated, RecordedFuturePortalLink\n",
        "queryFrequency": "PT15M",
        "queryPeriod": "P1D",
        "severity": "Medium",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CommandAndControl",
          "InitialAccess"
        ],
        "techniques": [
          "T1566",
          "T1568"
        ],
        "templateVersion": "1.1.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}