KnowBe4 Defend - Dangerous Attachment Detected

Back


Id	b75a4a7a-dedb-47be-b7e6-344f4d50af19
Rulename	KnowBe4 Defend - Dangerous Attachment Detected
Description	Defend has detected a user has a suspicious file type from a suspicious sender in their mailbox.
Severity	Medium
Tactics	Execution InitialAccess Persistence PrivilegeEscalation
Techniques	T1204 T0853 T0863 T1566 T1546 T1546
Required data connectors	KnowBe4Defend
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/KnowBe4 Defend/Analytic Rules/KnowBe4DangerousAttachmentReceived.yaml
Version	1.0.0
Arm template	b75a4a7a-dedb-47be-b7e6-344f4d50af19.json

KQL

DefendAuditData
| where ThreatLevel == "suspicious" or ThreatLevel == "dangerous"
| mv-expand todynamic(Attachments)
| where Attachments.name matches regex @"(?i)^.*\.(doc|docx|docm|pdf|xls|xlsx|xlsm|html|zip)$(?-i)"
| summarize attachmentCount=count() by TimeGenerated, tostring(Attachments.name), Subject, From, Account_0_FullName = trim(@"[^@.\w]+",Recipients), timesClicked = LinksClicked, SenderIP

YAML

requiredDataConnectors:
- datatypes:
  - KnowBe4Defend_CL
  connectorId: KnowBe4Defend
queryPeriod: 30m
triggerThreshold: 0
queryFrequency: 30m
version: 1.0.0
status: Available
severity: Medium
description: |
    'Defend has detected a user has a suspicious file type from a suspicious sender in their mailbox.'
name: KnowBe4 Defend - Dangerous Attachment Detected
tags:
- Defend
triggerOperator: gt
id: b75a4a7a-dedb-47be-b7e6-344f4d50af19
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/KnowBe4 Defend/Analytic Rules/KnowBe4DangerousAttachmentReceived.yaml
tactics:
- Execution
- InitialAccess
- Persistence
- PrivilegeEscalation
relevantTechniques:
- T1204
- T0853
- T0863
- T1566
- T1546
- T1546
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: Account_0_FullName
  entityType: Account
- fieldMappings:
  - identifier: Name
    columnName: Attachments_name
  entityType: File
- fieldMappings:
  - identifier: MailboxPrimaryAddress
    columnName: Account_0_FullName
  entityType: Mailbox
- fieldMappings:
  - identifier: Address
    columnName: SenderIP
  entityType: IP
kind: Scheduled
alertDetailsOverride:
  alertDisplayNameFormat: Alert - {{Account_0_FullName}} has suspicious attachment.
query: |
  DefendAuditData
  | where ThreatLevel == "suspicious" or ThreatLevel == "dangerous"
  | mv-expand todynamic(Attachments)
  | where Attachments.name matches regex @"(?i)^.*\.(doc|docx|docm|pdf|xls|xlsx|xlsm|html|zip)$(?-i)"
  | summarize attachmentCount=count() by TimeGenerated, tostring(Attachments.name), Subject, From, Account_0_FullName = trim(@"[^@.\w]+",Recipients), timesClicked = LinksClicked, SenderIP

ARM