Cyble Vision Alerts Malicious Ads Detected | Microsoft Sentinel Analytic Rules

Back


Id	cf0a9691-5716-42e0-bfa1-49b35d3a7892
Rulename	Cyble Vision Alerts Malicious Ads Detected
Description	Generates an incident when Cyble Intelligence detects a malicious advertisement, malvertising activity, or redirect attempting to impersonate a legitimate brand.
Severity	Low
Tactics	InitialAccess Execution
Techniques	T1189 T1566 T1059
Required data connectors	CybleVisionAlerts
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble%20Vision/Analytic%20Rules/Alerts_Malicious_ads.yaml
Version	1.0.0
Arm template	cf0a9691-5716-42e0-bfa1-49b35d3a7892.json

KQL

Alerts_malicious_ads
| where Service == "malicious_ads"
| extend MappedSeverity = Severity

YAML

incidentConfiguration:
  alertDetailsOverride: 
  alertDescriptionFormat: |
    Cyble Intelligence detected a malicious advertisement or suspicious redirect.
    Domain {{MA_Domain_URL}}
    Brand/Keyword {{MA_Keyword_Nested}}
    Status Code {{MA_StatusCode}}
  groupingConfiguration:
    lookbackDuration: PT5H
    reopenClosedIncident: false
    enabled: false
    matchingMethod: AllEntities
  alertDisplayNameFormat: Malicious Ad Detected  {{MA_DomainName_Nested}}
  createIncident: true
entityMappings:
- entityType: URL
  fieldMappings:
  - columnName: MA_Domain_URL
    identifier: Url
- entityType: DNS
  fieldMappings:
  - columnName: MA_DomainName_Nested
    identifier: DomainName
query: |
  Alerts_malicious_ads
  | where Service == "malicious_ads"
  | extend MappedSeverity = Severity
eventGroupingSettings:
  aggregationKind: AlertPerResult
id: cf0a9691-5716-42e0-bfa1-49b35d3a7892
queryFrequency: 30m
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble%20Vision/Analytic%20Rules/Alerts_Malicious_ads.yaml
enabled: true
suppressionDuration: PT5M
version: 1.0.0
severity: Low
relevantTechniques:
- T1189
- T1566
- T1059
name: Cyble Vision Alerts Malicious Ads Detected
kind: Scheduled
tactics:
- InitialAccess
- Execution
requiredDataConnectors:
- dataTypes:
  - CybleVisionAlerts_CL
  connectorId: CybleVisionAlerts
description: |
  'Generates an incident when Cyble Intelligence detects a malicious advertisement, malvertising activity, or redirect attempting to impersonate a legitimate brand.'
customDetails:
  Domain: MA_Domain_URL
  Keyword: MA_Keyword_Nested
  Service: Service
  IsLive: MA_IsLive
  AlertID: AlertID
  Status: Status
  MappedSeverity: Severity
triggerOperator: GreaterThan
triggerThreshold: 0
queryPeriod: 30m

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/cf0a9691-5716-42e0-bfa1-49b35d3a7892')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/cf0a9691-5716-42e0-bfa1-49b35d3a7892')]",
      "properties": {
        "alertRuleTemplateName": "cf0a9691-5716-42e0-bfa1-49b35d3a7892",
        "customDetails": {
          "AlertID": "AlertID",
          "Domain": "MA_Domain_URL",
          "IsLive": "MA_IsLive",
          "Keyword": "MA_Keyword_Nested",
          "MappedSeverity": "Severity",
          "Service": "Service",
          "Status": "Status"
        },
        "description": "'Generates an incident when Cyble Intelligence detects a malicious advertisement, malvertising activity, or redirect attempting to impersonate a legitimate brand.'\n",
        "displayName": "Cyble Vision Alerts Malicious Ads Detected",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "MA_Domain_URL",
                "identifier": "Url"
              }
            ]
          },
          {
            "entityType": "DNS",
            "fieldMappings": [
              {
                "columnName": "MA_DomainName_Nested",
                "identifier": "DomainName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "alertDescriptionFormat": "Cyble Intelligence detected a malicious advertisement or suspicious redirect.\nDomain {{MA_Domain_URL}}\nBrand/Keyword {{MA_Keyword_Nested}}\nStatus Code {{MA_StatusCode}}\n",
          "alertDetailsOverride": null,
          "alertDisplayNameFormat": "Malicious Ad Detected  {{MA_DomainName_Nested}}",
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble%20Vision/Analytic%20Rules/Alerts_Malicious_ads.yaml",
        "query": "Alerts_malicious_ads\n| where Service == \"malicious_ads\"\n| extend MappedSeverity = Severity\n",
        "queryFrequency": "PT30M",
        "queryPeriod": "PT30M",
        "severity": "Low",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5M",
        "suppressionEnabled": false,
        "tactics": [
          "Execution",
          "InitialAccess"
        ],
        "techniques": [
          "T1059",
          "T1189",
          "T1566"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}