ProofpointPOD - Multiple large emails to the same recipient

Back


Id	d1aba9a3-5ab1-45ef-8ed4-da57dc3c0d32
Rulename	ProofpointPOD - Multiple large emails to the same recipient
Description	Detects when multiple emails with large size where sent to the same recipient.
Severity	Medium
Tactics	Exfiltration
Techniques	T1567
Required data connectors	ProofpointPOD
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Proofpoint%20On%20demand%28POD%29%20Email%20Security/Analytic%20Rules/ProofpointPODMultipleLargeEmailsToSameRecipient.yaml
Version	1.0.1
Arm template	d1aba9a3-5ab1-45ef-8ed4-da57dc3c0d32.json

KQL

let lbtime = 30m;
let msgthreshold = 3;
let msgszthreshold = 3000000;
ProofpointPOD
| where TimeGenerated > ago(lbtime)
| where EventType == 'message'
| where NetworkDirection == 'outbound'
| where NetworkBytes > msgszthreshold
| summarize count() by SrcUserUpn, DstUserUpn
| where count_ > msgthreshold
| extend AccountCustomEntity = SrcUserUpn

YAML

queryFrequency: 30m
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
  entityType: Account
triggerThreshold: 0
triggerOperator: gt
severity: Medium
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Proofpoint%20On%20demand%28POD%29%20Email%20Security/Analytic%20Rules/ProofpointPODMultipleLargeEmailsToSameRecipient.yaml
query: |
  let lbtime = 30m;
  let msgthreshold = 3;
  let msgszthreshold = 3000000;
  ProofpointPOD
  | where TimeGenerated > ago(lbtime)
  | where EventType == 'message'
  | where NetworkDirection == 'outbound'
  | where NetworkBytes > msgszthreshold
  | summarize count() by SrcUserUpn, DstUserUpn
  | where count_ > msgthreshold
  | extend AccountCustomEntity = SrcUserUpn
tactics:
- Exfiltration
queryPeriod: 30m
relevantTechniques:
- T1567
requiredDataConnectors:
- connectorId: ProofpointPOD
  dataTypes:
  - ProofpointPOD_message_CL
id: d1aba9a3-5ab1-45ef-8ed4-da57dc3c0d32
kind: Scheduled
version: 1.0.1
description: |
  'Detects when multiple emails with large size where sent to the same recipient.'
status: Available
name: ProofpointPOD - Multiple large emails to the same recipient

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/d1aba9a3-5ab1-45ef-8ed4-da57dc3c0d32')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/d1aba9a3-5ab1-45ef-8ed4-da57dc3c0d32')]",
      "properties": {
        "alertRuleTemplateName": "d1aba9a3-5ab1-45ef-8ed4-da57dc3c0d32",
        "customDetails": null,
        "description": "'Detects when multiple emails with large size where sent to the same recipient.'\n",
        "displayName": "ProofpointPOD - Multiple large emails to the same recipient",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "FullName"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Proofpoint%20On%20demand%28POD%29%20Email%20Security/Analytic%20Rules/ProofpointPODMultipleLargeEmailsToSameRecipient.yaml",
        "query": "let lbtime = 30m;\nlet msgthreshold = 3;\nlet msgszthreshold = 3000000;\nProofpointPOD\n| where TimeGenerated > ago(lbtime)\n| where EventType == 'message'\n| where NetworkDirection == 'outbound'\n| where NetworkBytes > msgszthreshold\n| summarize count() by SrcUserUpn, DstUserUpn\n| where count_ > msgthreshold\n| extend AccountCustomEntity = SrcUserUpn\n",
        "queryFrequency": "PT30M",
        "queryPeriod": "PT30M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Exfiltration"
        ],
        "techniques": [
          "T1567"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}