CybleVision Alerts Darkweb Marketplace Alerts

Back


Id	e80eedb4-cbae-45cc-b1be-a2a8dc31af3b
Rulename	CybleVision Alerts Darkweb Marketplace Alerts
Description	Detects stolen credentials, financial information, stealer logs, and related payloads listed on Darkweb marketplaces such as RussianMarket. Extracts card data, victim info, metadata, and marketplace context via Alerts_DarkwebMarketplaces.
Severity	Low
Tactics	CredentialAccess Collection Exfiltration Reconnaissance
Techniques	T1555 T1005 T1041 T1589 T1646
Required data connectors	CybleVisionAlerts
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble Vision/Analytic Rules/Alerts_Darkweb_Marketplace.yaml
Version	1.0.0
Arm template	e80eedb4-cbae-45cc-b1be-a2a8dc31af3b.json

KQL

Alerts_darkweb_marketplaces 
| where Service == "darkweb_marketplaces" 
| extend MappedSeverity = Severity

YAML

eventGroupingSettings:
  aggregationKind: AlertPerResult
triggerThreshold: 0
entityMappings:
- entityType: DNS
  fieldMappings:
  - identifier: DomainName
    columnName: DW_Links
- entityType: File
  fieldMappings:
  - identifier: Name
    columnName: DW_Bank_BIN
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: DW_IP
requiredDataConnectors:
- dataTypes:
  - CybleVisionAlerts_CL
  connectorId: CybleVisionAlerts
subTechniques: []
enabled: true
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    matchingMethod: AllEntities
    lookbackDuration: PT5H
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble Vision/Analytic Rules/Alerts_Darkweb_Marketplace.yaml
name: CybleVision Alerts Darkweb Marketplace Alerts
alertDetailsOverride:
  alertDisplayNameFormat: CybleVision Darkweb Listing Found ({{DW_Marketplace}})
  alertDynamicProperties: []
  alertDescriptionFormat: |
        A darkweb marketplace listing referencing your monitored assets was discovered. Vendor {{DW_Vendor}} Region {{DW_Region}} Links {{DW_Links}}\n
relevantTechniques:
- T1555
- T1005
- T1041
- T1589
- T1646
status: Available
version: 1.0.0
queryPeriod: 30m
customDetails:
  Stealer: DW_StealerName
  Marketplace: DW_Marketplace
  RawData: DW_RawData
  Region: DW_Region
  Links: DW_Links
  RealName: DW_Bank_RealName
  BankExpiry: DW_Bank_Expiry
  Status: Status
  Info: DW_Info
  AlertID: AlertID
  MappedSeverity: Severity
  Price: DW_Price
  Country: DW_Country
  BankBrand: DW_Bank_Brand
  Vendor: DW_Vendor
  Service: Service
  Tags: DW_Tags
  BankCard: DW_Bank_CardNo
  Date: DW_Date
  UpdatedDate: DW_UpdatedDate
kind: Scheduled
id: e80eedb4-cbae-45cc-b1be-a2a8dc31af3b
query: |
  Alerts_darkweb_marketplaces 
  | where Service == "darkweb_marketplaces" 
  | extend MappedSeverity = Severity  
description: |
    'Detects stolen credentials, financial information, stealer logs, and related payloads listed on Darkweb marketplaces such as RussianMarket. Extracts card data, victim info, metadata, and marketplace context via Alerts_DarkwebMarketplaces.'
queryFrequency: 30m
suppressionDuration: PT5H
triggerOperator: GreaterThan
tactics:
- CredentialAccess
- Collection
- Exfiltration
- Reconnaissance
severity: Low

ARM