CYFIRMA - Data Breach and Web Monitoring - Dark Web Medium Rule

Back


Id	c0afeda7-4832-49a6-8d03-a5d137d513b5
Rulename	CYFIRMA - Data Breach and Web Monitoring - Dark Web Medium Rule
Description	“Detects critical alerts from CYFIRMA related to sensitive data or credentials leaked on dark web forums. These events often indicate unauthorized access or compromise of enterprise systems, cloud environments, or identity platforms. Immediate investigation is required to assess breach scope and initiate mitigation, including credential resets, access reviews, and threat actor tracking.”
Severity	Medium
Tactics	CredentialAccess Collection Exfiltration Impact
Techniques	T1552.001 T1555.003 T1212 T1119 T1048 T1486
Required data connectors	CyfirmaDigitalRiskAlertsConnector
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyfirma Digital Risk/Analytic Rules/DBWMDarkWebMediumRule.yaml
Version	1.0.1
Arm template	c0afeda7-4832-49a6-8d03-a5d137d513b5.json

KQL

// Medium severity - Data Breach and Web Monitoring - Dark Web
let timeFrame = 5m;
CyfirmaDBWMDarkWebAlerts_CL
| where severity == 'High' and TimeGenerated between (ago(timeFrame) .. now())
| extend
    Description=description,
    FirstSeen=first_seen,
    LastSeen=last_seen,
    RiskScore=risk_score,
    AlertUID=alert_uid,
    UID=uid,
    AssetType=asset_type,
    AssetValue=signature,
    Impact=impact,
    Recommendation='',
    ProviderName='CYFIRMA',
    ProductName='DeCYFIR/DeTCT',
    AlertTitle=Alert_title
| project
    TimeGenerated,
    Description,
    RiskScore,
    FirstSeen,
    LastSeen,
    AlertUID,
    UID,
    AssetType,
    AssetValue,
    Impact,
    ProductName,
    ProviderName,
    AlertTitle

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyfirma Digital Risk/Analytic Rules/DBWMDarkWebMediumRule.yaml
kind: Scheduled
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    lookbackDuration: PT5H
    enabled: false
    matchingMethod: AllEntities
    reopenClosedIncident: false
tactics:
- CredentialAccess
- Collection
- Exfiltration
- Impact
triggerThreshold: 0
relevantTechniques:
- T1552.001
- T1555.003
- T1212
- T1119
- T1048
- T1486
version: 1.0.1
customDetails:
  RiskScore: RiskScore
  TimeGenerated: TimeGenerated
  AssetType: AssetType
  FirstSeen: FirstSeen
  AssetValue: AssetValue
  UID: UID
  AlertUID: AlertUID
  Description: Description
  LastSeen: LastSeen
  Impact: Impact
eventGroupingSettings:
  aggregationKind: AlertPerResult
queryFrequency: 5m
name: CYFIRMA - Data Breach and Web Monitoring - Dark Web Medium Rule
description: |
  "Detects critical alerts from CYFIRMA related to sensitive data or credentials leaked on dark web forums. 
  These events often indicate unauthorized access or compromise of enterprise systems, cloud environments, or identity platforms. 
  Immediate investigation is required to assess breach scope and initiate mitigation, including credential resets, access reviews, and threat actor tracking."  
alertDetailsOverride:
  alertDynamicProperties:
  - value: ProductName
    alertProperty: ProductName
  - value: ProviderName
    alertProperty: ProviderName
  alertDescriptionFormat: '{{Description}} '
  alertDisplayNameFormat: 'CYFIRMA - Medium Severity Alert: Critical Data Exposure of Enterprise SSO on Dark Web- {{AlertTitle}} '
query: |
  // Medium severity - Data Breach and Web Monitoring - Dark Web
  let timeFrame = 5m;
  CyfirmaDBWMDarkWebAlerts_CL
  | where severity == 'High' and TimeGenerated between (ago(timeFrame) .. now())
  | extend
      Description=description,
      FirstSeen=first_seen,
      LastSeen=last_seen,
      RiskScore=risk_score,
      AlertUID=alert_uid,
      UID=uid,
      AssetType=asset_type,
      AssetValue=signature,
      Impact=impact,
      Recommendation='',
      ProviderName='CYFIRMA',
      ProductName='DeCYFIR/DeTCT',
      AlertTitle=Alert_title
  | project
      TimeGenerated,
      Description,
      RiskScore,
      FirstSeen,
      LastSeen,
      AlertUID,
      UID,
      AssetType,
      AssetValue,
      Impact,
      ProductName,
      ProviderName,
      AlertTitle  
queryPeriod: 5m
triggerOperator: gt
id: c0afeda7-4832-49a6-8d03-a5d137d513b5
status: Available
severity: Medium
requiredDataConnectors:
- dataTypes:
  - CyfirmaDBWMDarkWebAlerts_CL
  connectorId: CyfirmaDigitalRiskAlertsConnector

ARM