CybleVision Alerts Darkweb Marketplace Alerts | Microsoft Sentinel Analytic Rules

Back


Id	e80eedb4-cbae-45cc-b1be-a2a8dc31af3b
Rulename	CybleVision Alerts Darkweb Marketplace Alerts
Description	Detects stolen credentials, financial information, stealer logs, and related payloads listed on Darkweb marketplaces such as RussianMarket. Extracts card data, victim info, metadata, and marketplace context via Alerts_DarkwebMarketplaces.
Severity	Low
Tactics	CredentialAccess Collection Exfiltration Reconnaissance
Techniques	T1555 T1005 T1041 T1589 T1646
Required data connectors	CybleVisionAlerts
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble%20Vision/Analytic%20Rules/Alerts_Darkweb_Marketplace.yaml
Version	1.0.0
Arm template	e80eedb4-cbae-45cc-b1be-a2a8dc31af3b.json

KQL

Alerts_darkweb_marketplaces 
| where Service == "darkweb_marketplaces" 
| extend MappedSeverity = Severity

YAML

entityMappings:
- fieldMappings:
  - columnName: DW_Links
    identifier: DomainName
  entityType: DNS
- fieldMappings:
  - columnName: DW_Bank_BIN
    identifier: Name
  entityType: File
- fieldMappings:
  - columnName: DW_IP
    identifier: Address
  entityType: IP
requiredDataConnectors:
- dataTypes:
  - CybleVisionAlerts_CL
  connectorId: CybleVisionAlerts
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble%20Vision/Analytic%20Rules/Alerts_Darkweb_Marketplace.yaml
version: 1.0.0
status: Available
alertDetailsOverride:
  alertDescriptionFormat: |
    A darkweb marketplace listing referencing your monitored assets was discovered. Vendor {{DW_Vendor}} Region {{DW_Region}} Links {{DW_Links}}\n
  alertDynamicProperties: []
  alertDisplayNameFormat: CybleVision Darkweb Listing Found ({{DW_Marketplace}})
relevantTechniques:
- T1555
- T1005
- T1041
- T1589
- T1646
incidentConfiguration:
  groupingConfiguration:
    reopenClosedIncident: false
    matchingMethod: AllEntities
    enabled: false
    lookbackDuration: PT5H
  createIncident: true
queryFrequency: 30m
query: |
  Alerts_darkweb_marketplaces 
  | where Service == "darkweb_marketplaces" 
  | extend MappedSeverity = Severity
tactics:
- CredentialAccess
- Collection
- Exfiltration
- Reconnaissance
suppressionDuration: PT5H
id: e80eedb4-cbae-45cc-b1be-a2a8dc31af3b
triggerThreshold: 0
triggerOperator: GreaterThan
name: CybleVision Alerts Darkweb Marketplace Alerts
queryPeriod: 30m
severity: Low
enabled: true
customDetails:
  Tags: DW_Tags
  Links: DW_Links
  Status: Status
  Vendor: DW_Vendor
  Info: DW_Info
  RawData: DW_RawData
  Stealer: DW_StealerName
  RealName: DW_Bank_RealName
  BankBrand: DW_Bank_Brand
  BankCard: DW_Bank_CardNo
  Price: DW_Price
  MappedSeverity: Severity
  Country: DW_Country
  BankExpiry: DW_Bank_Expiry
  Date: DW_Date
  AlertID: AlertID
  Marketplace: DW_Marketplace
  UpdatedDate: DW_UpdatedDate
  Service: Service
  Region: DW_Region
kind: Scheduled
eventGroupingSettings:
  aggregationKind: AlertPerResult
subTechniques: []
description: |
  'Detects stolen credentials, financial information, stealer logs, and related payloads listed on Darkweb marketplaces such as RussianMarket. Extracts card data, victim info, metadata, and marketplace context via Alerts_DarkwebMarketplaces.'

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/e80eedb4-cbae-45cc-b1be-a2a8dc31af3b')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/e80eedb4-cbae-45cc-b1be-a2a8dc31af3b')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "A darkweb marketplace listing referencing your monitored assets was discovered. Vendor {{DW_Vendor}} Region {{DW_Region}} Links {{DW_Links}}\\n\n",
          "alertDisplayNameFormat": "CybleVision Darkweb Listing Found ({{DW_Marketplace}})",
          "alertDynamicProperties": []
        },
        "alertRuleTemplateName": "e80eedb4-cbae-45cc-b1be-a2a8dc31af3b",
        "customDetails": {
          "AlertID": "AlertID",
          "BankBrand": "DW_Bank_Brand",
          "BankCard": "DW_Bank_CardNo",
          "BankExpiry": "DW_Bank_Expiry",
          "Country": "DW_Country",
          "Date": "DW_Date",
          "Info": "DW_Info",
          "Links": "DW_Links",
          "MappedSeverity": "Severity",
          "Marketplace": "DW_Marketplace",
          "Price": "DW_Price",
          "RawData": "DW_RawData",
          "RealName": "DW_Bank_RealName",
          "Region": "DW_Region",
          "Service": "Service",
          "Status": "Status",
          "Stealer": "DW_StealerName",
          "Tags": "DW_Tags",
          "UpdatedDate": "DW_UpdatedDate",
          "Vendor": "DW_Vendor"
        },
        "description": "'Detects stolen credentials, financial information, stealer logs, and related payloads listed on Darkweb marketplaces such as RussianMarket. Extracts card data, victim info, metadata, and marketplace context via Alerts_DarkwebMarketplaces.'\n",
        "displayName": "CybleVision Alerts Darkweb Marketplace Alerts",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "DNS",
            "fieldMappings": [
              {
                "columnName": "DW_Links",
                "identifier": "DomainName"
              }
            ]
          },
          {
            "entityType": "File",
            "fieldMappings": [
              {
                "columnName": "DW_Bank_BIN",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "DW_IP",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble%20Vision/Analytic%20Rules/Alerts_Darkweb_Marketplace.yaml",
        "query": "Alerts_darkweb_marketplaces \n| where Service == \"darkweb_marketplaces\" \n| extend MappedSeverity = Severity\n",
        "queryFrequency": "PT30M",
        "queryPeriod": "PT30M",
        "severity": "Low",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "Collection",
          "CredentialAccess",
          "Exfiltration",
          "Reconnaissance"
        ],
        "techniques": [
          "T1005",
          "T1041",
          "T1555",
          "T1589"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}