KnowBe4 Defend - Dangerous Attachment Detected

Back


Id	b75a4a7a-dedb-47be-b7e6-344f4d50af19
Rulename	KnowBe4 Defend - Dangerous Attachment Detected
Description	Defend has detected a user has a suspicious file type from a suspicious sender in their mailbox.
Severity	Medium
Tactics	Execution InitialAccess Persistence PrivilegeEscalation
Techniques	T1204 T0853 T0863 T1566 T1546 T1546
Required data connectors	KnowBe4Defend
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/KnowBe4 Defend/Analytic Rules/KnowBe4DangerousAttachmentReceived.yaml
Version	1.0.0
Arm template	b75a4a7a-dedb-47be-b7e6-344f4d50af19.json

KQL

DefendAuditData
| where ThreatLevel == "suspicious" or ThreatLevel == "dangerous"
| mv-expand todynamic(Attachments)
| where Attachments.name matches regex @"(?i)^.*\.(doc|docx|docm|pdf|xls|xlsx|xlsm|html|zip)$(?-i)"
| summarize attachmentCount=count() by TimeGenerated, tostring(Attachments.name), Subject, From, Account_0_FullName = trim(@"[^@.\w]+",Recipients), timesClicked = LinksClicked, SenderIP

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/KnowBe4 Defend/Analytic Rules/KnowBe4DangerousAttachmentReceived.yaml
query: |
  DefendAuditData
  | where ThreatLevel == "suspicious" or ThreatLevel == "dangerous"
  | mv-expand todynamic(Attachments)
  | where Attachments.name matches regex @"(?i)^.*\.(doc|docx|docm|pdf|xls|xlsx|xlsm|html|zip)$(?-i)"
  | summarize attachmentCount=count() by TimeGenerated, tostring(Attachments.name), Subject, From, Account_0_FullName = trim(@"[^@.\w]+",Recipients), timesClicked = LinksClicked, SenderIP  
tags:
- Defend
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: Account_0_FullName
- entityType: File
  fieldMappings:
  - identifier: Name
    columnName: Attachments_name
- entityType: Mailbox
  fieldMappings:
  - identifier: MailboxPrimaryAddress
    columnName: Account_0_FullName
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SenderIP
kind: Scheduled
triggerOperator: gt
requiredDataConnectors:
- datatypes:
  - KnowBe4Defend_CL
  connectorId: KnowBe4Defend
tactics:
- Execution
- InitialAccess
- Persistence
- PrivilegeEscalation
triggerThreshold: 0
description: |
    'Defend has detected a user has a suspicious file type from a suspicious sender in their mailbox.'
queryPeriod: 30m
version: 1.0.0
queryFrequency: 30m
severity: Medium
alertDetailsOverride:
  alertDisplayNameFormat: Alert - {{Account_0_FullName}} has suspicious attachment.
name: KnowBe4 Defend - Dangerous Attachment Detected
id: b75a4a7a-dedb-47be-b7e6-344f4d50af19
status: Available
relevantTechniques:
- T1204
- T0853
- T0863
- T1566
- T1546
- T1546

ARM