NordPass - User data detected in breach

Back


Id	c4d2eb42-a4ab-4db6-a270-3d2ed7e057a0
Rulename	NordPass - User data detected in breach
Description	This will alert you when Data Breach Scanner discovers data related to a member of your organization on the dark web.
Severity	High
Tactics	Exfiltration
Techniques	T1020
Required data connectors	NordPass
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_user_data_detected_in_breach.yaml
Version	1.0.0
Arm template	c4d2eb42-a4ab-4db6-a270-3d2ed7e057a0.json

KQL

NordPassEventLogs_CL
| where event_type == "breach"
| where action == "email_breached"
| extend TargetEmail = user_email

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_user_data_detected_in_breach.yaml
queryPeriod: 5m
description: |
    This will alert you when Data Breach Scanner discovers data related to a member of your organization on the dark web.
displayName: User data detected in breach
name: NordPass - User data detected in breach
triggerOperator: gt
incidentConfiguration:
  createIncident: false
kind: Scheduled
requiredDataConnectors:
- connectorId: NordPass
  dataTypes:
  - NordPassEventLogs_CL
triggerThreshold: 0
queryFrequency: 5m
tactics:
- Exfiltration
id: c4d2eb42-a4ab-4db6-a270-3d2ed7e057a0
version: 1.0.0
query: |
  NordPassEventLogs_CL
  | where event_type == "breach"
  | where action == "email_breached"
  | extend TargetEmail = user_email  
entityMappings:
- entityType: Mailbox
  fieldMappings:
  - identifier: MailboxPrimaryAddress
    columnName: TargetEmail
severity: High
relevantTechniques:
- T1020

ARM