Cyble Vision Alerts Malicious Ads Detected

Back


Id	cf0a9691-5716-42e0-bfa1-49b35d3a7892
Rulename	Cyble Vision Alerts Malicious Ads Detected
Description	Generates an incident when Cyble Intelligence detects a malicious advertisement, malvertising activity, or redirect attempting to impersonate a legitimate brand.
Severity	Low
Tactics	InitialAccess Execution
Techniques	T1189 T1566 T1059
Required data connectors	CybleVisionAlerts
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble Vision/Analytic Rules/Alerts_Malicious_ads.yaml
Version	1.0.0
Arm template	cf0a9691-5716-42e0-bfa1-49b35d3a7892.json

KQL

Alerts_malicious_ads
| where Service == "malicious_ads"
| extend MappedSeverity = Severity

YAML

queryPeriod: 30m
description: |
    'Generates an incident when Cyble Intelligence detects a malicious advertisement, malvertising activity, or redirect attempting to impersonate a legitimate brand.'
relevantTechniques:
- T1189
- T1566
- T1059
triggerThreshold: 0
customDetails:
  Service: Service
  AlertID: AlertID
  MappedSeverity: Severity
  IsLive: MA_IsLive
  Keyword: MA_Keyword_Nested
  Domain: MA_Domain_URL
  Status: Status
id: cf0a9691-5716-42e0-bfa1-49b35d3a7892
queryFrequency: 30m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble Vision/Analytic Rules/Alerts_Malicious_ads.yaml
incidentConfiguration:
  alertDetailsOverride: 
  groupingConfiguration:
    enabled: false
    matchingMethod: AllEntities
    reopenClosedIncident: false
    lookbackDuration: PT5H
  createIncident: true
  alertDescriptionFormat: |
    Cyble Intelligence detected a malicious advertisement or suspicious redirect.
    Domain {{MA_Domain_URL}}
    Brand/Keyword {{MA_Keyword_Nested}}
    Status Code {{MA_StatusCode}}    
  alertDisplayNameFormat: Malicious Ad Detected  {{MA_DomainName_Nested}}
query: |
  Alerts_malicious_ads
  | where Service == "malicious_ads"
  | extend MappedSeverity = Severity  
entityMappings:
- fieldMappings:
  - columnName: MA_Domain_URL
    identifier: Url
  entityType: URL
- fieldMappings:
  - columnName: MA_DomainName_Nested
    identifier: DomainName
  entityType: DNS
eventGroupingSettings:
  aggregationKind: AlertPerResult
triggerOperator: GreaterThan
tactics:
- InitialAccess
- Execution
status: Available
name: Cyble Vision Alerts Malicious Ads Detected
version: 1.0.0
severity: Low
requiredDataConnectors:
- connectorId: CybleVisionAlerts
  dataTypes:
  - CybleVisionAlerts_CL
kind: Scheduled
suppressionDuration: PT5M
enabled: true

ARM