Cisco SEG - Suspicious sender domain

Back


Id	ef0a253c-95b5-48e1-8ebc-dbeb073b9338
Rulename	Cisco SEG - Suspicious sender domain
Description	Detects suspicious sender domain age.
Severity	Medium
Tactics	InitialAccess
Techniques	T1566
Required data connectors	CefAma CiscoSEG CiscoSEGAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoSEG/Analytic Rules/CiscoSEGSuspiciousSenderDomain.yaml
Version	1.0.2
Arm template	ef0a253c-95b5-48e1-8ebc-dbeb073b9338.json

KQL

CiscoSEGEvent
| where NetworkDirection =~ 'Incoming'
| extend rec_domain = extract(@'@(.*)', 1, DstUserName)
| extend s_domain = extract(@'@(.*)', 1, SrcUserName)
| where s_domain != rec_domain
| where tostring(AdditionalFields) has 'ESASDRDomainAge'
| extend domain_age = extract(@'ESASDRDomainAge":"(.*days)"', 1, tostring(AdditionalFields))
| extend yy = toint(extract(@'(\d+)\syears', 1, domain_age))
| extend mm = toint(extract(@'(\d+)\smonths', 1, domain_age))
| extend dd = toint(extract(@'(\d+)\sdays', 1, domain_age))
| where isempty(yy)
| where isempty(mm) or mm <= 2
| extend AccountCustomEntity = SrcUserName

YAML

kind: Scheduled
relevantTechniques:
- T1566
description: |
    'Detects suspicious sender domain age.'
queryPeriod: 1h
queryFrequency: 1h
tactics:
- InitialAccess
name: Cisco SEG - Suspicious sender domain
requiredDataConnectors:
- connectorId: CiscoSEG
  dataTypes:
  - CiscoSEGEvent
- connectorId: CiscoSEGAma
  dataTypes:
  - CiscoSEGEvent
- connectorId: CefAma
  dataTypes:
  - CommonSecurityLog
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
triggerThreshold: 0
version: 1.0.2
id: ef0a253c-95b5-48e1-8ebc-dbeb073b9338
query: |
  CiscoSEGEvent
  | where NetworkDirection =~ 'Incoming'
  | extend rec_domain = extract(@'@(.*)', 1, DstUserName)
  | extend s_domain = extract(@'@(.*)', 1, SrcUserName)
  | where s_domain != rec_domain
  | where tostring(AdditionalFields) has 'ESASDRDomainAge'
  | extend domain_age = extract(@'ESASDRDomainAge":"(.*days)"', 1, tostring(AdditionalFields))
  | extend yy = toint(extract(@'(\d+)\syears', 1, domain_age))
  | extend mm = toint(extract(@'(\d+)\smonths', 1, domain_age))
  | extend dd = toint(extract(@'(\d+)\sdays', 1, domain_age))
  | where isempty(yy)
  | where isempty(mm) or mm <= 2
  | extend AccountCustomEntity = SrcUserName  
status: Available
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoSEG/Analytic Rules/CiscoSEGSuspiciousSenderDomain.yaml
severity: Medium

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/ef0a253c-95b5-48e1-8ebc-dbeb073b9338')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/ef0a253c-95b5-48e1-8ebc-dbeb073b9338')]",
      "properties": {
        "alertRuleTemplateName": "ef0a253c-95b5-48e1-8ebc-dbeb073b9338",
        "customDetails": null,
        "description": "'Detects suspicious sender domain age.'\n",
        "displayName": "Cisco SEG - Suspicious sender domain",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "Name"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoSEG/Analytic Rules/CiscoSEGSuspiciousSenderDomain.yaml",
        "query": "CiscoSEGEvent\n| where NetworkDirection =~ 'Incoming'\n| extend rec_domain = extract(@'@(.*)', 1, DstUserName)\n| extend s_domain = extract(@'@(.*)', 1, SrcUserName)\n| where s_domain != rec_domain\n| where tostring(AdditionalFields) has 'ESASDRDomainAge'\n| extend domain_age = extract(@'ESASDRDomainAge\":\"(.*days)\"', 1, tostring(AdditionalFields))\n| extend yy = toint(extract(@'(\\d+)\\syears', 1, domain_age))\n| extend mm = toint(extract(@'(\\d+)\\smonths', 1, domain_age))\n| extend dd = toint(extract(@'(\\d+)\\sdays', 1, domain_age))\n| where isempty(yy)\n| where isempty(mm) or mm <= 2\n| extend AccountCustomEntity = SrcUserName\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1566"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}