RecordedFuture Threat Hunting IP All Actors

Back


Id	e31bc14e-2b4c-42a4-af34-5bfd7d768aea
Rulename	RecordedFuture Threat Hunting IP All Actors
Description	Recorded Future Threat Hunting IP correlation for all actors.
Severity	Medium
Tactics	Exfiltration CommandAndControl
Techniques	T1041 T1568
Required data connectors	ThreatIntelligenceUploadIndicatorsAPI
Kind	Scheduled
Query frequency	15m
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Recorded Future/Analytic Rules/ThreatHunting/RecordedFutureThreatHuntingIPAllActors.yaml
Version	1.0.3
Arm template	e31bc14e-2b4c-42a4-af34-5bfd7d768aea.json

KQL

let ioc_lookBack = 1d;
// The source table (ASimNetworkSessionLogs) can be replaced by any infrastructure table containing ip data.
// The following workbook: Recorded Future - IP Correlation will help researching available data and selecting tables and columns  
imNetworkSession
| where isnotempty(DstIpAddr)
| join kind=inner (
ThreatIntelligenceIndicator
// Only look for IOCs
| where isnotempty(NetworkIP)
// Only look at Recorded Future Threat Hunt Indicators.
| where Description startswith "Recorded Future - Threat Hunt"
// Only work with the latest indicators  
| where TimeGenerated >= ago(ioc_lookBack)
| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
| where Active == true and ExpirationDateTime > now()
) on $left.DstIpAddr == $right.NetworkIP
// select column from the source table to match with Recorded Future ThreatIntelligenceIndicator $left.DstIpAddr
| mv-expand RecordedFuturePortalLink=parse_json(tostring(parse_json(Tags)[0]))['RecordedFuturePortalLink']
| project NetworkIP, Description, Type, TimeGenerated, RecordedFuturePortalLink

YAML

customDetails:
  ActorInformation: RecordedFuturePortalLink
id: e31bc14e-2b4c-42a4-af34-5bfd7d768aea
alertDetailsOverride:
  alertDescriptionFormat: '**{{Description}}**\n\nCorrelation found on {{NetworkIP}} from the {{Type}} table.\n'
  alertDynamicProperties:
  - alertProperty: AlertLink
    value: RecordedFuturePortalLink
  alertDisplayNameFormat: '{{Description}}'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Recorded Future/Analytic Rules/ThreatHunting/RecordedFutureThreatHuntingIPAllActors.yaml
description: |
    'Recorded Future Threat Hunting IP correlation for all actors.'
name: RecordedFuture Threat Hunting IP All Actors
incidentConfiguration:
  groupingConfiguration:
    matchingMethod: AllEntities
    reopenClosedIncident: false
    lookbackDuration: 1h
    enabled: true
  createIncident: true
relevantTechniques:
- T1041
- T1568
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: NetworkIP
triggerThreshold: 0
query: |
  let ioc_lookBack = 1d;
  // The source table (ASimNetworkSessionLogs) can be replaced by any infrastructure table containing ip data.
  // The following workbook: Recorded Future - IP Correlation will help researching available data and selecting tables and columns  
  imNetworkSession
  | where isnotempty(DstIpAddr)
  | join kind=inner (
  ThreatIntelligenceIndicator
  // Only look for IOCs
  | where isnotempty(NetworkIP)
  // Only look at Recorded Future Threat Hunt Indicators.
  | where Description startswith "Recorded Future - Threat Hunt"
  // Only work with the latest indicators  
  | where TimeGenerated >= ago(ioc_lookBack)
  | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
  | where Active == true and ExpirationDateTime > now()
  ) on $left.DstIpAddr == $right.NetworkIP
  // select column from the source table to match with Recorded Future ThreatIntelligenceIndicator $left.DstIpAddr
  | mv-expand RecordedFuturePortalLink=parse_json(tostring(parse_json(Tags)[0]))['RecordedFuturePortalLink']
  | project NetworkIP, Description, Type, TimeGenerated, RecordedFuturePortalLink  
severity: Medium
requiredDataConnectors:
- dataTypes:
  - ThreatIntelligenceIndicator
  connectorId: ThreatIntelligenceUploadIndicatorsAPI
eventGroupingSettings:
  aggregationKind: AlertPerResult
queryFrequency: 15m
queryPeriod: 1d
version: 1.0.3
kind: Scheduled
tactics:
- Exfiltration
- CommandAndControl
triggerOperator: gt

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/e31bc14e-2b4c-42a4-af34-5bfd7d768aea')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/e31bc14e-2b4c-42a4-af34-5bfd7d768aea')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "**{{Description}}**\\n\\nCorrelation found on {{NetworkIP}} from the {{Type}} table.\\n",
          "alertDisplayNameFormat": "{{Description}}",
          "alertDynamicProperties": [
            {
              "alertProperty": "AlertLink",
              "value": "RecordedFuturePortalLink"
            }
          ]
        },
        "alertRuleTemplateName": "e31bc14e-2b4c-42a4-af34-5bfd7d768aea",
        "customDetails": {
          "ActorInformation": "RecordedFuturePortalLink"
        },
        "description": "'Recorded Future Threat Hunting IP correlation for all actors.'\n",
        "displayName": "RecordedFuture Threat Hunting IP All Actors",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "NetworkIP",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "lookbackDuration": "PT1H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Recorded Future/Analytic Rules/ThreatHunting/RecordedFutureThreatHuntingIPAllActors.yaml",
        "query": "let ioc_lookBack = 1d;\n// The source table (ASimNetworkSessionLogs) can be replaced by any infrastructure table containing ip data.\n// The following workbook: Recorded Future - IP Correlation will help researching available data and selecting tables and columns  \nimNetworkSession\n| where isnotempty(DstIpAddr)\n| join kind=inner (\nThreatIntelligenceIndicator\n// Only look for IOCs\n| where isnotempty(NetworkIP)\n// Only look at Recorded Future Threat Hunt Indicators.\n| where Description startswith \"Recorded Future - Threat Hunt\"\n// Only work with the latest indicators  \n| where TimeGenerated >= ago(ioc_lookBack)\n| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId\n| where Active == true and ExpirationDateTime > now()\n) on $left.DstIpAddr == $right.NetworkIP\n// select column from the source table to match with Recorded Future ThreatIntelligenceIndicator $left.DstIpAddr\n| mv-expand RecordedFuturePortalLink=parse_json(tostring(parse_json(Tags)[0]))['RecordedFuturePortalLink']\n| project NetworkIP, Description, Type, TimeGenerated, RecordedFuturePortalLink\n",
        "queryFrequency": "PT15M",
        "queryPeriod": "P1D",
        "severity": "Medium",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CommandAndControl",
          "Exfiltration"
        ],
        "techniques": [
          "T1041",
          "T1568"
        ],
        "templateVersion": "1.0.3",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}