CybleVision Alerts Cyber Crime Forum Alerts

Back


Id	b78c4641-cc16-48e0-9d05-c9b36a55d214
Rulename	CybleVision Alerts Cyber Crime Forum Alerts
Description	Detects discussions, marketplace posts, threat actor activity, and intelligence mentions from cybercrime forums. Extracts discussion metadata, topic details, URLs, emails, phone numbers, and content using Alerts_CyberCrimeForums parser.
Severity	Low
Tactics	Reconnaissance ResourceDevelopment Exfiltration
Techniques	T1598 T1585 T1589 T1646
Required data connectors	CybleVisionAlerts
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble Vision/Analytic Rules/Alerts_Cyber_Crime_Forum.yaml
Version	1.0.0
Arm template	b78c4641-cc16-48e0-9d05-c9b36a55d214.json

KQL

Alerts_cyber_crime_forums 
| where Service == "cyber_crime_forums" 
| extend MappedSeverity = Severity

YAML

queryPeriod: 30m
severity: Low
description: |
    'Detects discussions, marketplace posts, threat actor activity, and intelligence mentions from cybercrime forums. Extracts discussion metadata, topic details, URLs, emails, phone numbers, and content using Alerts_CyberCrimeForums parser.'
subTechniques: []
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: CF_Emails
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: CF_Urls
- entityType: DNS
  fieldMappings:
  - identifier: DomainName
    columnName: CF_SourceName
triggerOperator: GreaterThan
status: Available
tactics:
- Reconnaissance
- ResourceDevelopment
- Exfiltration
relevantTechniques:
- T1598
- T1585
- T1589
- T1646
id: b78c4641-cc16-48e0-9d05-c9b36a55d214
triggerThreshold: 0
suppressionDuration: PT5H
queryFrequency: 30m
incidentConfiguration:
  groupingConfiguration:
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
    enabled: false
  createIncident: true
enabled: true
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble Vision/Analytic Rules/Alerts_Cyber_Crime_Forum.yaml
query: |
  Alerts_cyber_crime_forums 
  | where Service == "cyber_crime_forums" 
  | extend MappedSeverity = Severity  
version: 1.0.0
customDetails:
  Likes: CF_Likes
  AlertID: AlertID
  TopicName: CF_TopicName
  Phones: CF_Phones
  TopicURL: CF_TopicURL
  Content: CF_Content
  Status: Status
  MappedSeverity: Severity
  DiscussionDate: CF_DiscussionDate
  TopicID: CF_TopicID
  DiscussionBy: CF_DiscussionBy
  Reputation: CF_Reputation
  Tags: CF_Tags
  TopicCreatedBy: CF_TopicCreatedBy
  Service: Service
requiredDataConnectors:
- dataTypes:
  - CybleVisionAlerts_CL
  connectorId: CybleVisionAlerts
alertDetailsOverride:
  alertDynamicProperties: []
  alertDisplayNameFormat: CybleVision Forum Mention {{CF_TopicName}}
  alertDescriptionFormat: |
        A mention was detected on a cybercrime forum. Source {{CF_SourceName}} By {{CF_DiscussionBy}} Content {{CF_Content}}
eventGroupingSettings:
  aggregationKind: AlertPerResult
name: CybleVision Alerts Cyber Crime Forum Alerts
kind: Scheduled

ARM