Abnormal Security - Vendor compromise case detected | Microsoft Sentinel Analytic Rules

Back


Id	b15ea4c9-58da-44d8-90e4-6591d947e7e3
Rulename	Abnormal Security - Vendor compromise case detected
Description	Creates an incident when Abnormal Security opens a vendor case indicating a compromised or impersonated vendor domain (vendor email compromise). Surfaces the vendor domain and Abnormal insights so analysts can review related correspondence.
Severity	Medium
Tactics	InitialAccess
Techniques	T1566
Required data connectors	AbnormalSecurityPush
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AbnormalSecurity/Analytic%20Rules/AbnormalSecurity_VendorCompromise.yaml
Version	1.0.0
Arm template	b15ea4c9-58da-44d8-90e4-6591d947e7e3.json

KQL

ABNORMAL_SECURITY_VENDOR_CASE_CL
| where isnotempty(abx_body_abx_body_vendorCaseId_g)
// Collapse to one row per vendor case (earliest event in the window) so repeated
// events for the same case do not raise duplicate alerts.
| summarize arg_min(TimeGenerated, *) by CaseId = abx_body_abx_body_vendorCaseId_g
| extend
    VendorDomain = abx_body_abx_body_vendorDomain_s,
    Insights = abx_body_abx_body_insights_s,
    FirstObserved = abx_body_abx_body_firstObservedTime_t
| project TimeGenerated, VendorDomain, CaseId, Insights, FirstObserved

YAML

entityMappings:
- entityType: DNS
  fieldMappings:
  - identifier: DomainName
    columnName: VendorDomain
name: Abnormal Security - Vendor compromise case detected
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AbnormalSecurity/Analytic%20Rules/AbnormalSecurity_VendorCompromise.yaml
triggerOperator: gt
status: Available
suppressionDuration: PT5H
queryPeriod: 1h
requiredDataConnectors:
- connectorId: AbnormalSecurityPush
  dataTypes:
  - ABNORMAL_SECURITY_VENDOR_CASE_CL
tactics:
- InitialAccess
query: |
  ABNORMAL_SECURITY_VENDOR_CASE_CL
  | where isnotempty(abx_body_abx_body_vendorCaseId_g)
  // Collapse to one row per vendor case (earliest event in the window) so repeated
  // events for the same case do not raise duplicate alerts.
  | summarize arg_min(TimeGenerated, *) by CaseId = abx_body_abx_body_vendorCaseId_g
  | extend
      VendorDomain = abx_body_abx_body_vendorDomain_s,
      Insights = abx_body_abx_body_insights_s,
      FirstObserved = abx_body_abx_body_firstObservedTime_t
  | project TimeGenerated, VendorDomain, CaseId, Insights, FirstObserved
description: |
  'Creates an incident when Abnormal Security opens a vendor case indicating a
  compromised or impersonated vendor domain (vendor email compromise). Surfaces the
  vendor domain and Abnormal insights so analysts can review related correspondence.'
severity: Medium
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: PT5H
    enabled: true
    reopenClosedIncident: false
    matchingMethod: AllEntities
  createIncident: true
id: b15ea4c9-58da-44d8-90e4-6591d947e7e3
customDetails:
  VendorCaseId: CaseId
  VendorDomain: VendorDomain
suppressionEnabled: false
triggerThreshold: 0
queryFrequency: 1h
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDescriptionFormat: Abnormal Security opened vendor case {{CaseId}} for the domain {{VendorDomain}}. Review related correspondence for vendor email compromise.
  alertDisplayNameFormat: 'Abnormal Security: vendor compromise case for {{VendorDomain}}'
version: 1.0.0
relevantTechniques:
- T1566

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/b15ea4c9-58da-44d8-90e4-6591d947e7e3')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/b15ea4c9-58da-44d8-90e4-6591d947e7e3')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Abnormal Security opened vendor case {{CaseId}} for the domain {{VendorDomain}}. Review related correspondence for vendor email compromise.",
          "alertDisplayNameFormat": "Abnormal Security: vendor compromise case for {{VendorDomain}}"
        },
        "alertRuleTemplateName": "b15ea4c9-58da-44d8-90e4-6591d947e7e3",
        "customDetails": {
          "VendorCaseId": "CaseId",
          "VendorDomain": "VendorDomain"
        },
        "description": "'Creates an incident when Abnormal Security opens a vendor case indicating a\ncompromised or impersonated vendor domain (vendor email compromise). Surfaces the\nvendor domain and Abnormal insights so analysts can review related correspondence.'\n",
        "displayName": "Abnormal Security - Vendor compromise case detected",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "DNS",
            "fieldMappings": [
              {
                "columnName": "VendorDomain",
                "identifier": "DomainName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AbnormalSecurity/Analytic%20Rules/AbnormalSecurity_VendorCompromise.yaml",
        "query": "ABNORMAL_SECURITY_VENDOR_CASE_CL\n| where isnotempty(abx_body_abx_body_vendorCaseId_g)\n// Collapse to one row per vendor case (earliest event in the window) so repeated\n// events for the same case do not raise duplicate alerts.\n| summarize arg_min(TimeGenerated, *) by CaseId = abx_body_abx_body_vendorCaseId_g\n| extend\n    VendorDomain = abx_body_abx_body_vendorDomain_s,\n    Insights = abx_body_abx_body_insights_s,\n    FirstObserved = abx_body_abx_body_firstObservedTime_t\n| project TimeGenerated, VendorDomain, CaseId, Insights, FirstObserved\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1566"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}