RecordedFuture Threat Hunting Domain All Actors

Back


Id	acbf7ef6-f964-44c3-9031-7834ec68175f
Rulename	RecordedFuture Threat Hunting Domain All Actors
Description	Recorded Future Threat Hunting domain correlation for all actors.
Severity	Medium
Tactics	InitialAccess CommandAndControl
Techniques	T1566 T1568
Required data connectors	ThreatIntelligenceUploadIndicatorsAPI
Kind	Scheduled
Query frequency	15m
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Recorded Future/Analytic Rules/ThreatHunting/RecordedFutureThreatHuntingDomainAllActors.yaml
Version	1.1.0
Arm template	acbf7ef6-f964-44c3-9031-7834ec68175f.json

KQL

let ioc_lookBack = 1d;
// The source table (_Im_Dns) is an ASIM parser table, but can be replaced by any infrastructure table containing domain/dns data.
// The following workbook: Recorded Future - Domain Correlation will help researching available data and selecting tables and columns
_Im_Dns
| where isnotempty(Domain)
| extend lowerDomain=tolower(Domain)
| join kind=inner (
ThreatIntelIndicators
// Only look at Domain IOCs
| where ObservableKey == 'domain-name:value'
| where isnotempty(ObservableValue)
// Only look at Recorded Future Threat Hunt Indicators.
| where Data.description startswith "Recorded Future - Threat Hunt"
// Only work with the latest indicators
| where TimeGenerated >= ago(ioc_lookBack)
| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
| where IsActive == true and ValidUntil > now()
| extend lowerDomain=tolower(ObservableValue)
) on lowerDomain
// select column from the source table to match with Recorded Future $left.Domain
| mv-expand RecordedFuturePortalLink=parse_json(tostring(parse_json(Tags)))['recordedfutureportallink']
| project Domain=ObservableValue, Description=Data.description, Type, TimeGenerated, RecordedFuturePortalLink

YAML

entityMappings:
- entityType: DNS
  fieldMappings:
  - identifier: DomainName
    columnName: Domain
tactics:
- InitialAccess
- CommandAndControl
requiredDataConnectors:
- dataTypes:
  - ThreatIntelIndicators
  connectorId: ThreatIntelligenceUploadIndicatorsAPI
alertDetailsOverride:
  alertDisplayNameFormat: '{{Description}}'
  alertDescriptionFormat: '**{{Description}}**\n\nCorrelation found on {{Domain}} from the {{Type}} table.\n'
  alertDynamicProperties:
  - value: RecordedFuturePortalLink
    alertProperty: AlertLink
incidentConfiguration:
  groupingConfiguration:
    enabled: true
    lookbackDuration: 1h
    reopenClosedIncident: false
    matchingMethod: AllEntities
  createIncident: true
id: acbf7ef6-f964-44c3-9031-7834ec68175f
severity: Medium
eventGroupingSettings:
  aggregationKind: AlertPerResult
customDetails:
  ActorInformation: RecordedFuturePortalLink
query: |
  let ioc_lookBack = 1d;
  // The source table (_Im_Dns) is an ASIM parser table, but can be replaced by any infrastructure table containing domain/dns data.
  // The following workbook: Recorded Future - Domain Correlation will help researching available data and selecting tables and columns
  _Im_Dns
  | where isnotempty(Domain)
  | extend lowerDomain=tolower(Domain)
  | join kind=inner (
  ThreatIntelIndicators
  // Only look at Domain IOCs
  | where ObservableKey == 'domain-name:value'
  | where isnotempty(ObservableValue)
  // Only look at Recorded Future Threat Hunt Indicators.
  | where Data.description startswith "Recorded Future - Threat Hunt"
  // Only work with the latest indicators
  | where TimeGenerated >= ago(ioc_lookBack)
  | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
  | where IsActive == true and ValidUntil > now()
  | extend lowerDomain=tolower(ObservableValue)
  ) on lowerDomain
  // select column from the source table to match with Recorded Future $left.Domain
  | mv-expand RecordedFuturePortalLink=parse_json(tostring(parse_json(Tags)))['recordedfutureportallink']
  | project Domain=ObservableValue, Description=Data.description, Type, TimeGenerated, RecordedFuturePortalLink  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Recorded Future/Analytic Rules/ThreatHunting/RecordedFutureThreatHuntingDomainAllActors.yaml
kind: Scheduled
queryPeriod: 1d
version: 1.1.0
name: RecordedFuture Threat Hunting Domain All Actors
queryFrequency: 15m
triggerThreshold: 0
relevantTechniques:
- T1566
- T1568
description: |
    'Recorded Future Threat Hunting domain correlation for all actors.'
triggerOperator: gt

ARM