KnowBe4 Defend - Dangerous Attachment Detected

Back


Id	b75a4a7a-dedb-47be-b7e6-344f4d50af19
Rulename	KnowBe4 Defend - Dangerous Attachment Detected
Description	Defend has detected a user has a suspicious file type from a suspicious sender in their mailbox.
Severity	Medium
Tactics	Execution InitialAccess Persistence PrivilegeEscalation
Techniques	T1204 T0853 T0863 T1566 T1546 T1546
Required data connectors	KnowBe4Defend
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/KnowBe4 Defend/Analytic Rules/KnowBe4DangerousAttachmentReceived.yaml
Version	1.0.0
Arm template	b75a4a7a-dedb-47be-b7e6-344f4d50af19.json

KQL

DefendAuditData
| where ThreatLevel == "suspicious" or ThreatLevel == "dangerous"
| mv-expand todynamic(Attachments)
| where Attachments.name matches regex @"(?i)^.*\.(doc|docx|docm|pdf|xls|xlsx|xlsm|html|zip)$(?-i)"
| summarize attachmentCount=count() by TimeGenerated, tostring(Attachments.name), Subject, From, Account_0_FullName = trim(@"[^@.\w]+",Recipients), timesClicked = LinksClicked, SenderIP

YAML

relevantTechniques:
- T1204
- T0853
- T0863
- T1566
- T1546
- T1546
queryFrequency: 30m
description: |
    'Defend has detected a user has a suspicious file type from a suspicious sender in their mailbox.'
tags:
- Defend
triggerThreshold: 0
id: b75a4a7a-dedb-47be-b7e6-344f4d50af19
name: KnowBe4 Defend - Dangerous Attachment Detected
queryPeriod: 30m
query: |
  DefendAuditData
  | where ThreatLevel == "suspicious" or ThreatLevel == "dangerous"
  | mv-expand todynamic(Attachments)
  | where Attachments.name matches regex @"(?i)^.*\.(doc|docx|docm|pdf|xls|xlsx|xlsm|html|zip)$(?-i)"
  | summarize attachmentCount=count() by TimeGenerated, tostring(Attachments.name), Subject, From, Account_0_FullName = trim(@"[^@.\w]+",Recipients), timesClicked = LinksClicked, SenderIP  
severity: Medium
triggerOperator: gt
entityMappings:
- fieldMappings:
  - columnName: Account_0_FullName
    identifier: FullName
  entityType: Account
- fieldMappings:
  - columnName: Attachments_name
    identifier: Name
  entityType: File
- fieldMappings:
  - columnName: Account_0_FullName
    identifier: MailboxPrimaryAddress
  entityType: Mailbox
- fieldMappings:
  - columnName: SenderIP
    identifier: Address
  entityType: IP
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/KnowBe4 Defend/Analytic Rules/KnowBe4DangerousAttachmentReceived.yaml
requiredDataConnectors:
- connectorId: KnowBe4Defend
  datatypes:
  - KnowBe4Defend_CL
alertDetailsOverride:
  alertDisplayNameFormat: Alert - {{Account_0_FullName}} has suspicious attachment.
status: Available
version: 1.0.0
tactics:
- Execution
- InitialAccess
- Persistence
- PrivilegeEscalation
kind: Scheduled

ARM