Abnormal Security - Vendor compromise case detected | Microsoft Sentinel Analytic Rules

Back


Id	b15ea4c9-58da-44d8-90e4-6591d947e7e3
Rulename	Abnormal Security - Vendor compromise case detected
Description	Creates an incident when Abnormal Security opens a vendor case indicating a compromised or impersonated vendor domain (vendor email compromise). Surfaces the vendor domain and Abnormal insights so analysts can review related correspondence.
Severity	Medium
Tactics	InitialAccess
Techniques	T1566
Required data connectors	AbnormalSecurityPush
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AbnormalSecurity/Analytic%20Rules/AbnormalSecurity_VendorCompromise.yaml
Version	1.0.0
Arm template	b15ea4c9-58da-44d8-90e4-6591d947e7e3.json

KQL

ABNORMAL_SECURITY_VENDOR_CASE_CL
| where isnotempty(abx_body_abx_body_vendorCaseId_g)
// Collapse to one row per vendor case (earliest event in the window) so repeated
// events for the same case do not raise duplicate alerts.
| summarize arg_min(TimeGenerated, *) by CaseId = abx_body_abx_body_vendorCaseId_g
| extend
    VendorDomain = abx_body_abx_body_vendorDomain_s,
    Insights = abx_body_abx_body_insights_s,
    FirstObserved = abx_body_abx_body_firstObservedTime_t
| project TimeGenerated, VendorDomain, CaseId, Insights, FirstObserved

YAML

incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: PT5H
    reopenClosedIncident: false
    matchingMethod: AllEntities
    enabled: true
  createIncident: true
name: Abnormal Security - Vendor compromise case detected
suppressionDuration: PT5H
suppressionEnabled: false
triggerOperator: gt
query: |
  ABNORMAL_SECURITY_VENDOR_CASE_CL
  | where isnotempty(abx_body_abx_body_vendorCaseId_g)
  // Collapse to one row per vendor case (earliest event in the window) so repeated
  // events for the same case do not raise duplicate alerts.
  | summarize arg_min(TimeGenerated, *) by CaseId = abx_body_abx_body_vendorCaseId_g
  | extend
      VendorDomain = abx_body_abx_body_vendorDomain_s,
      Insights = abx_body_abx_body_insights_s,
      FirstObserved = abx_body_abx_body_firstObservedTime_t
  | project TimeGenerated, VendorDomain, CaseId, Insights, FirstObserved
queryFrequency: 1h
description: |
  'Creates an incident when Abnormal Security opens a vendor case indicating a
  compromised or impersonated vendor domain (vendor email compromise). Surfaces the
  vendor domain and Abnormal insights so analysts can review related correspondence.'
id: b15ea4c9-58da-44d8-90e4-6591d947e7e3
triggerThreshold: 0
queryPeriod: 1h
version: 1.0.0
kind: Scheduled
customDetails:
  VendorCaseId: CaseId
  VendorDomain: VendorDomain
status: Available
eventGroupingSettings:
  aggregationKind: AlertPerResult
severity: Medium
requiredDataConnectors:
- connectorId: AbnormalSecurityPush
  dataTypes:
  - ABNORMAL_SECURITY_VENDOR_CASE_CL
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AbnormalSecurity/Analytic%20Rules/AbnormalSecurity_VendorCompromise.yaml
alertDetailsOverride:
  alertDescriptionFormat: Abnormal Security opened vendor case {{CaseId}} for the domain {{VendorDomain}}. Review related correspondence for vendor email compromise.
  alertDisplayNameFormat: 'Abnormal Security: vendor compromise case for {{VendorDomain}}'
relevantTechniques:
- T1566
tactics:
- InitialAccess
entityMappings:
- fieldMappings:
  - identifier: DomainName
    columnName: VendorDomain
  entityType: DNS

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/b15ea4c9-58da-44d8-90e4-6591d947e7e3')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/b15ea4c9-58da-44d8-90e4-6591d947e7e3')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Abnormal Security opened vendor case {{CaseId}} for the domain {{VendorDomain}}. Review related correspondence for vendor email compromise.",
          "alertDisplayNameFormat": "Abnormal Security: vendor compromise case for {{VendorDomain}}"
        },
        "alertRuleTemplateName": "b15ea4c9-58da-44d8-90e4-6591d947e7e3",
        "customDetails": {
          "VendorCaseId": "CaseId",
          "VendorDomain": "VendorDomain"
        },
        "description": "'Creates an incident when Abnormal Security opens a vendor case indicating a\ncompromised or impersonated vendor domain (vendor email compromise). Surfaces the\nvendor domain and Abnormal insights so analysts can review related correspondence.'\n",
        "displayName": "Abnormal Security - Vendor compromise case detected",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "DNS",
            "fieldMappings": [
              {
                "columnName": "VendorDomain",
                "identifier": "DomainName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AbnormalSecurity/Analytic%20Rules/AbnormalSecurity_VendorCompromise.yaml",
        "query": "ABNORMAL_SECURITY_VENDOR_CASE_CL\n| where isnotempty(abx_body_abx_body_vendorCaseId_g)\n// Collapse to one row per vendor case (earliest event in the window) so repeated\n// events for the same case do not raise duplicate alerts.\n| summarize arg_min(TimeGenerated, *) by CaseId = abx_body_abx_body_vendorCaseId_g\n| extend\n    VendorDomain = abx_body_abx_body_vendorDomain_s,\n    Insights = abx_body_abx_body_insights_s,\n    FirstObserved = abx_body_abx_body_firstObservedTime_t\n| project TimeGenerated, VendorDomain, CaseId, Insights, FirstObserved\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1566"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}