ProofpointPOD - Multiple archived attachments to the same recipient

Back


Id	bda5a2bd-979b-4828-a91f-27c2a5048f7f
Rulename	ProofpointPOD - Multiple archived attachments to the same recipient
Description	Detects when multiple emails where sent to the same recipient with large archived attachments.
Severity	Medium
Tactics	Exfiltration
Techniques	T1567
Required data connectors	ProofpointPOD
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Proofpoint%20On%20demand%28POD%29%20Email%20Security/Analytic%20Rules/ProofpointPODMultipleArchivedAttachmentsToSameRecipient.yaml
Version	1.0.2
Arm template	bda5a2bd-979b-4828-a91f-27c2a5048f7f.json

KQL

let lbtime = 30m;
let msgthreshold = 3;
let compressedTypes = dynamic(['zip', 'rar', 'tar', 'x-7z-compressed']);
ProofpointPOD
| where TimeGenerated > ago(lbtime)
| where EventType == 'message'
| where NetworkDirection == 'outbound'
| extend attachedMimeType = todynamic(MsgParts)[0]['detectedMime']
| where attachedMimeType has_any (compressedTypes)
| summarize count(), make_set(attachedMimeType) by SrcUserUpn, DstUserUpn
| where count_ > msgthreshold
| extend AccountCustomEntity = SrcUserUpn

YAML

relevantTechniques:
- T1567
tactics:
- Exfiltration
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
  entityType: Account
triggerOperator: gt
description: |
  'Detects when multiple emails where sent to the same recipient with large archived attachments.'
triggerThreshold: 0
name: ProofpointPOD - Multiple archived attachments to the same recipient
queryFrequency: 30m
id: bda5a2bd-979b-4828-a91f-27c2a5048f7f
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Proofpoint%20On%20demand%28POD%29%20Email%20Security/Analytic%20Rules/ProofpointPODMultipleArchivedAttachmentsToSameRecipient.yaml
version: 1.0.2
requiredDataConnectors:
- connectorId: ProofpointPOD
  dataTypes:
  - ProofpointPOD_message_CL
queryPeriod: 30m
severity: Medium
query: |
  let lbtime = 30m;
  let msgthreshold = 3;
  let compressedTypes = dynamic(['zip', 'rar', 'tar', 'x-7z-compressed']);
  ProofpointPOD
  | where TimeGenerated > ago(lbtime)
  | where EventType == 'message'
  | where NetworkDirection == 'outbound'
  | extend attachedMimeType = todynamic(MsgParts)[0]['detectedMime']
  | where attachedMimeType has_any (compressedTypes)
  | summarize count(), make_set(attachedMimeType) by SrcUserUpn, DstUserUpn
  | where count_ > msgthreshold
  | extend AccountCustomEntity = SrcUserUpn
status: Available
kind: Scheduled

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/bda5a2bd-979b-4828-a91f-27c2a5048f7f')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/bda5a2bd-979b-4828-a91f-27c2a5048f7f')]",
      "properties": {
        "alertRuleTemplateName": "bda5a2bd-979b-4828-a91f-27c2a5048f7f",
        "customDetails": null,
        "description": "'Detects when multiple emails where sent to the same recipient with large archived attachments.'\n",
        "displayName": "ProofpointPOD - Multiple archived attachments to the same recipient",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "FullName"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Proofpoint%20On%20demand%28POD%29%20Email%20Security/Analytic%20Rules/ProofpointPODMultipleArchivedAttachmentsToSameRecipient.yaml",
        "query": "let lbtime = 30m;\nlet msgthreshold = 3;\nlet compressedTypes = dynamic(['zip', 'rar', 'tar', 'x-7z-compressed']);\nProofpointPOD\n| where TimeGenerated > ago(lbtime)\n| where EventType == 'message'\n| where NetworkDirection == 'outbound'\n| extend attachedMimeType = todynamic(MsgParts)[0]['detectedMime']\n| where attachedMimeType has_any (compressedTypes)\n| summarize count(), make_set(attachedMimeType) by SrcUserUpn, DstUserUpn\n| where count_ > msgthreshold\n| extend AccountCustomEntity = SrcUserUpn\n",
        "queryFrequency": "PT30M",
        "queryPeriod": "PT30M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Exfiltration"
        ],
        "techniques": [
          "T1567"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}