NordPass - Domain data detected in breach

Back


Id	e3f2b6c9-df0c-4b36-a376-bb2762e4dbdc
Rulename	NordPass - Domain data detected in breach
Description	This will alert you when Data Breach Scanner discovers data related to your organization’s domains on the dark web. !This rule should be enabled only by the organizations that have set up Data Breach Scanner in NordPass.
Severity	High
Tactics	Exfiltration
Techniques	T1020
Required data connectors	NordPass
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_domain_data_detected_in_breach.yaml
Version	1.0.0
Arm template	e3f2b6c9-df0c-4b36-a376-bb2762e4dbdc.json

KQL

NordPassEventLogs_CL
| where event_type == "breach"
| where action == "domain_breached"
| extend TargetEmail = user_email

YAML

queryFrequency: 5m
queryPeriod: 5m
kind: Scheduled
version: 1.0.0
triggerThreshold: 0
relevantTechniques:
- T1020
description: |
  This will alert you when Data Breach Scanner discovers data related to your organization's domains on the dark web.

  !This rule should be enabled only by the organizations that have set up Data Breach Scanner in NordPass.  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_domain_data_detected_in_breach.yaml
requiredDataConnectors:
- connectorId: NordPass
  dataTypes:
  - NordPassEventLogs_CL
id: e3f2b6c9-df0c-4b36-a376-bb2762e4dbdc
displayName: Domain data detected in breach
name: NordPass - Domain data detected in breach
triggerOperator: gt
tactics:
- Exfiltration
query: |
  NordPassEventLogs_CL
  | where event_type == "breach"
  | where action == "domain_breached"
  | extend TargetEmail = user_email  
entityMappings:
- fieldMappings:
  - identifier: MailboxPrimaryAddress
    columnName: TargetEmail
  entityType: Mailbox
incidentConfiguration:
  createIncident: false
severity: High

ARM