ProofpointPOD - Binary file in attachment

Back


Id	eb68b129-5f17-4f56-bf6d-dde48d5e615a
Rulename	ProofpointPOD - Binary file in attachment
Description	Detects when email received with binary file as attachment.
Severity	Medium
Tactics	InitialAccess
Techniques	T1078
Required data connectors	ProofpointPOD
Kind	Scheduled
Query frequency	10m
Query period	10m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODBinaryInAttachment.yaml
Version	1.0.3
Arm template	eb68b129-5f17-4f56-bf6d-dde48d5e615a.json

KQL

let lbtime = 10m;
let binaryTypes = dynamic(['zip', 'octet-stream', 'java-archive', 'rar', 'tar', 'x-7z-compressed', 'x-msdownload', 'portable-executable']);
ProofpointPOD
| where TimeGenerated > ago(lbtime)
| where EventType == 'message'
| where NetworkDirection == 'inbound'
| where FilterDisposition !in ('reject', 'discard')
| extend attachedMimeType = tostring(todynamic(MsgParts)[0]['detectedMime'])
| where attachedMimeType has_any (binaryTypes)
| project SrcUserUpn, AccountCustomEntity = tostring(parse_json(DstUserUpn)[0]), attachedMimeType, MsgHeaderSubject
| extend Name = tostring(split(AccountCustomEntity, "@")[0]), UPNSuffix = tostring(split(AccountCustomEntity, "@")[1])

YAML

relevantTechniques:
- T1078
name: ProofpointPOD - Binary file in attachment
requiredDataConnectors:
- dataTypes:
  - ProofpointPOD_message_CL
  connectorId: ProofpointPOD
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: Name
  - identifier: UPNSuffix
    columnName: UPNSuffix
  entityType: Account
triggerThreshold: 0
id: eb68b129-5f17-4f56-bf6d-dde48d5e615a
tactics:
- InitialAccess
version: 1.0.3
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODBinaryInAttachment.yaml
queryPeriod: 10m
kind: Scheduled
queryFrequency: 10m
severity: Medium
status: Available
description: |
    'Detects when email received with binary file as attachment.'
query: |
  let lbtime = 10m;
  let binaryTypes = dynamic(['zip', 'octet-stream', 'java-archive', 'rar', 'tar', 'x-7z-compressed', 'x-msdownload', 'portable-executable']);
  ProofpointPOD
  | where TimeGenerated > ago(lbtime)
  | where EventType == 'message'
  | where NetworkDirection == 'inbound'
  | where FilterDisposition !in ('reject', 'discard')
  | extend attachedMimeType = tostring(todynamic(MsgParts)[0]['detectedMime'])
  | where attachedMimeType has_any (binaryTypes)
  | project SrcUserUpn, AccountCustomEntity = tostring(parse_json(DstUserUpn)[0]), attachedMimeType, MsgHeaderSubject
  | extend Name = tostring(split(AccountCustomEntity, "@")[0]), UPNSuffix = tostring(split(AccountCustomEntity, "@")[1])  
triggerOperator: gt

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/eb68b129-5f17-4f56-bf6d-dde48d5e615a')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/eb68b129-5f17-4f56-bf6d-dde48d5e615a')]",
      "properties": {
        "alertRuleTemplateName": "eb68b129-5f17-4f56-bf6d-dde48d5e615a",
        "customDetails": null,
        "description": "'Detects when email received with binary file as attachment.'\n",
        "displayName": "ProofpointPOD - Binary file in attachment",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "Name",
                "identifier": "Name"
              },
              {
                "columnName": "UPNSuffix",
                "identifier": "UPNSuffix"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODBinaryInAttachment.yaml",
        "query": "let lbtime = 10m;\nlet binaryTypes = dynamic(['zip', 'octet-stream', 'java-archive', 'rar', 'tar', 'x-7z-compressed', 'x-msdownload', 'portable-executable']);\nProofpointPOD\n| where TimeGenerated > ago(lbtime)\n| where EventType == 'message'\n| where NetworkDirection == 'inbound'\n| where FilterDisposition !in ('reject', 'discard')\n| extend attachedMimeType = tostring(todynamic(MsgParts)[0]['detectedMime'])\n| where attachedMimeType has_any (binaryTypes)\n| project SrcUserUpn, AccountCustomEntity = tostring(parse_json(DstUserUpn)[0]), attachedMimeType, MsgHeaderSubject\n| extend Name = tostring(split(AccountCustomEntity, \"@\")[0]), UPNSuffix = tostring(split(AccountCustomEntity, \"@\")[1])\n",
        "queryFrequency": "PT10M",
        "queryPeriod": "PT10M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1078"
        ],
        "templateVersion": "1.0.3",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}