PRODAFT USTA - Payment card exposed | Microsoft Sentinel Analytic Rules

Back


Id	bd550c7f-5455-48de-b23d-30fced82d02b
Rulename	PRODAFT USTA - Payment card exposed
Description	Identifies a new PRODAFT USTA Payment Card Fraud Intelligence ticket that exposes a compromised payment card belonging to the monitored company. These typically originate from card breaches, skimmers, or infostealer infections and indicate that a payment card may be available to fraudsters. The full card number is never stored - only the BIN, last 4 digits, brand, and length are retained. Investigate the exposure and, where the card is your own, coordinate reissue with the issuing bank.
Severity	Medium
Tactics	Impact
Techniques	T1657
Required data connectors	PRODAFTUstaPCFICCPDefinition
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PRODAFT%20USTA%20-%20Payment%20Card%20Fraud%20Intelligence/Analytic%20Rules/PaymentCardExposed.yaml
Version	1.0.0
Arm template	bd550c7f-5455-48de-b23d-30fced82d02b.json

KQL

PRODAFTUstaCompromisedCards
| where Created > ago(1h)
| project
    TimeGenerated,
    Created,
    TicketId,
    CompanyName,
    CardBrand,
    CardBin,
    CardLast4,
    CardMasked,
    CardLength,
    ExpirationDate,
    Status

YAML

id: bd550c7f-5455-48de-b23d-30fced82d02b
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PRODAFT%20USTA%20-%20Payment%20Card%20Fraud%20Intelligence/Analytic%20Rules/PaymentCardExposed.yaml
triggerOperator: gt
tactics:
- Impact
kind: Scheduled
requiredDataConnectors:
- dataTypes:
  - PRODAFTUstaCompromisedCards_CL
  connectorId: PRODAFTUstaPCFICCPDefinition
queryPeriod: 1h
severity: Medium
relevantTechniques:
- T1657
triggerThreshold: 0
version: 1.0.0
customDetails:
  Card: CardMasked
  Status: Status
  Company: CompanyName
  Expiration: ExpirationDate
  Brand: CardBrand
  Ticket: TicketId
name: PRODAFT USTA - Payment card exposed
status: Available
query: |
  PRODAFTUstaCompromisedCards
  | where Created > ago(1h)
  | project
      TimeGenerated,
      Created,
      TicketId,
      CompanyName,
      CardBrand,
      CardBin,
      CardLast4,
      CardMasked,
      CardLength,
      ExpirationDate,
      Status
description: |
  'Identifies a new PRODAFT USTA Payment Card Fraud Intelligence ticket that exposes a
  compromised payment card belonging to the monitored company. These typically originate
  from card breaches, skimmers, or infostealer infections and indicate that a payment card
  may be available to fraudsters. The full card number is never stored - only the BIN,
  last 4 digits, brand, and length are retained. Investigate the exposure and, where the
  card is your own, coordinate reissue with the issuing bank.'
queryFrequency: 1h
incidentConfiguration:
  groupingConfiguration:
    enabled: true
    lookbackDuration: 1h
    reopenClosedIncident: false
    matchingMethod: AnyAlert
  createIncident: true

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/bd550c7f-5455-48de-b23d-30fced82d02b')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/bd550c7f-5455-48de-b23d-30fced82d02b')]",
      "properties": {
        "alertRuleTemplateName": "bd550c7f-5455-48de-b23d-30fced82d02b",
        "customDetails": {
          "Brand": "CardBrand",
          "Card": "CardMasked",
          "Company": "CompanyName",
          "Expiration": "ExpirationDate",
          "Status": "Status",
          "Ticket": "TicketId"
        },
        "description": "'Identifies a new PRODAFT USTA Payment Card Fraud Intelligence ticket that exposes a\ncompromised payment card belonging to the monitored company. These typically originate\nfrom card breaches, skimmers, or infostealer infections and indicate that a payment card\nmay be available to fraudsters. The full card number is never stored - only the BIN,\nlast 4 digits, brand, and length are retained. Investigate the exposure and, where the\ncard is your own, coordinate reissue with the issuing bank.'\n",
        "displayName": "PRODAFT USTA - Payment card exposed",
        "enabled": true,
        "entityMappings": null,
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "lookbackDuration": "PT1H",
            "matchingMethod": "AnyAlert",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PRODAFT%20USTA%20-%20Payment%20Card%20Fraud%20Intelligence/Analytic%20Rules/PaymentCardExposed.yaml",
        "query": "PRODAFTUstaCompromisedCards\n| where Created > ago(1h)\n| project\n    TimeGenerated,\n    Created,\n    TicketId,\n    CompanyName,\n    CardBrand,\n    CardBin,\n    CardLast4,\n    CardMasked,\n    CardLength,\n    ExpirationDate,\n    Status\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1657"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}