CybleVision Alerts Cyber Crime Forum Alerts

Back


Id	b78c4641-cc16-48e0-9d05-c9b36a55d214
Rulename	CybleVision Alerts Cyber Crime Forum Alerts
Description	Detects discussions, marketplace posts, threat actor activity, and intelligence mentions from cybercrime forums. Extracts discussion metadata, topic details, URLs, emails, phone numbers, and content using Alerts_CyberCrimeForums parser.
Severity	Low
Tactics	Reconnaissance ResourceDevelopment Exfiltration
Techniques	T1598 T1585 T1589 T1646
Required data connectors	CybleVisionAlerts
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble Vision/Analytic Rules/Alerts_Cyber_Crime_Forum.yaml
Version	1.0.0
Arm template	b78c4641-cc16-48e0-9d05-c9b36a55d214.json

KQL

Alerts_cyber_crime_forums 
| where Service == "cyber_crime_forums" 
| extend MappedSeverity = Severity

YAML

relevantTechniques:
- T1598
- T1585
- T1589
- T1646
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: CF_Emails
    identifier: Name
- entityType: URL
  fieldMappings:
  - columnName: CF_Urls
    identifier: Url
- entityType: DNS
  fieldMappings:
  - columnName: CF_SourceName
    identifier: DomainName
eventGroupingSettings:
  aggregationKind: AlertPerResult
version: 1.0.0
query: |
  Alerts_cyber_crime_forums 
  | where Service == "cyber_crime_forums" 
  | extend MappedSeverity = Severity  
id: b78c4641-cc16-48e0-9d05-c9b36a55d214
suppressionDuration: PT5H
severity: Low
kind: Scheduled
queryFrequency: 30m
description: |
    'Detects discussions, marketplace posts, threat actor activity, and intelligence mentions from cybercrime forums. Extracts discussion metadata, topic details, URLs, emails, phone numbers, and content using Alerts_CyberCrimeForums parser.'
requiredDataConnectors:
- connectorId: CybleVisionAlerts
  dataTypes:
  - CybleVisionAlerts_CL
subTechniques: []
triggerOperator: GreaterThan
name: CybleVision Alerts Cyber Crime Forum Alerts
tactics:
- Reconnaissance
- ResourceDevelopment
- Exfiltration
alertDetailsOverride:
  alertDescriptionFormat: |
        A mention was detected on a cybercrime forum. Source {{CF_SourceName}} By {{CF_DiscussionBy}} Content {{CF_Content}}
  alertDynamicProperties: []
  alertDisplayNameFormat: CybleVision Forum Mention {{CF_TopicName}}
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble Vision/Analytic Rules/Alerts_Cyber_Crime_Forum.yaml
triggerThreshold: 0
queryPeriod: 30m
enabled: true
status: Available
customDetails:
  TopicID: CF_TopicID
  Tags: CF_Tags
  Status: Status
  DiscussionDate: CF_DiscussionDate
  Likes: CF_Likes
  TopicCreatedBy: CF_TopicCreatedBy
  Reputation: CF_Reputation
  TopicName: CF_TopicName
  TopicURL: CF_TopicURL
  DiscussionBy: CF_DiscussionBy
  Service: Service
  AlertID: AlertID
  MappedSeverity: Severity
  Content: CF_Content
  Phones: CF_Phones
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    lookbackDuration: PT5H
    enabled: false
    reopenClosedIncident: false
    matchingMethod: AllEntities

ARM