NordPass - User data detected in breach

Back


Id	c4d2eb42-a4ab-4db6-a270-3d2ed7e057a0
Rulename	NordPass - User data detected in breach
Description	This will alert you when Data Breach Scanner discovers data related to a member of your organization on the dark web.
Severity	High
Tactics	Exfiltration
Techniques	T1020
Required data connectors	NordPass
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_user_data_detected_in_breach.yaml
Version	1.0.0
Arm template	c4d2eb42-a4ab-4db6-a270-3d2ed7e057a0.json

KQL

NordPassEventLogs_CL
| where event_type == "breach"
| where action == "email_breached"
| extend TargetEmail = user_email

YAML

queryPeriod: 5m
query: |
  NordPassEventLogs_CL
  | where event_type == "breach"
  | where action == "email_breached"
  | extend TargetEmail = user_email  
name: NordPass - User data detected in breach
entityMappings:
- fieldMappings:
  - columnName: TargetEmail
    identifier: MailboxPrimaryAddress
  entityType: Mailbox
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_user_data_detected_in_breach.yaml
description: |
    This will alert you when Data Breach Scanner discovers data related to a member of your organization on the dark web.
kind: Scheduled
version: 1.0.0
displayName: User data detected in breach
queryFrequency: 5m
severity: High
requiredDataConnectors:
- connectorId: NordPass
  dataTypes:
  - NordPassEventLogs_CL
triggerOperator: gt
triggerThreshold: 0
incidentConfiguration:
  createIncident: false
tactics:
- Exfiltration
id: c4d2eb42-a4ab-4db6-a270-3d2ed7e057a0
relevantTechniques:
- T1020

ARM