138 строки
5.0 KiB
YAML
138 строки
5.0 KiB
YAML
id: 779731f7-8ba0-4198-8524-5701b7defddc
|
|
name: M365D Alerts Correlation to non-Microsoft Network device network activity involved in successful sign-in Activity
|
|
description: |
|
|
'This content is employed to correlate with Microsoft Defender XDR phishing-related alerts. It focuses on instances where a user successfully connects to a phishing URL from a non-Microsoft network device and subsequently makes successful sign-in attempts from the phishing IP address.'
|
|
severity: Medium
|
|
requiredDataConnectors:
|
|
- connectorId: OfficeATP
|
|
dataTypes:
|
|
- SecurityAlert
|
|
- connectorId: PaloAltoNetworks
|
|
dataTypes:
|
|
- CommonSecurityLog (PaloAlto)
|
|
- connectorId: Fortinet
|
|
dataTypes:
|
|
- CommonSecurityLog (Fortinet)
|
|
- connectorId: CheckPoint
|
|
dataTypes:
|
|
- CommonSecurityLog (CheckPoint)
|
|
- connectorId: Zscaler
|
|
dataTypes:
|
|
- CommonSecurityLog (Zscaler)
|
|
queryFrequency: 1d
|
|
queryPeriod: 1d
|
|
triggerOperator: gt
|
|
triggerThreshold: 0
|
|
tactics:
|
|
- PrivilegeEscalation
|
|
relevantTechniques:
|
|
- T1078
|
|
query: |
|
|
let Alert_List= dynamic([
|
|
"Phishing link click observed in Network Traffic",
|
|
"Phish delivered due to an IP allow policy",
|
|
"A potentially malicious URL click was detected",
|
|
"High Risk Sign-in Observed in Network Traffic",
|
|
"A user clicked through to a potentially malicious URL",
|
|
"Suspicious network connection to AitM phishing site",
|
|
"Messages containing malicious entity not removed after delivery",
|
|
"Email messages containing malicious URL removed after delivery",
|
|
"Email reported by user as malware or phish",
|
|
"Phish delivered due to an ETR override",
|
|
"Phish not zapped because ZAP is disabled"]);
|
|
SecurityAlert
|
|
| where AlertName in~ (Alert_List)
|
|
//Findling Alerts which has the URL
|
|
| where Entities has "url"
|
|
//extracting Entities
|
|
| extend Entities = parse_json(Entities)
|
|
| mv-apply Entity = Entities on
|
|
(
|
|
where Entity.Type == 'url'
|
|
| extend EntityUrl = tostring(Entity.Url)
|
|
)
|
|
| summarize
|
|
Url=tostring(tolower(take_any(EntityUrl))),
|
|
AlertTime= min(TimeGenerated),
|
|
make_set(SystemAlertId, 100)
|
|
by ProductName, AlertName
|
|
// matching with 3rd party network logs and 3p Alerts
|
|
| join kind= inner (CommonSecurityLog
|
|
| where DeviceVendor has_any ("Palo Alto Networks", "Fortinet", "Check Point", "Zscaler")
|
|
| where DeviceProduct startswith "FortiGate" or DeviceProduct startswith "PAN" or DeviceProduct startswith "VPN" or DeviceProduct startswith "FireWall" or DeviceProduct startswith "NSSWeblog" or DeviceProduct startswith "URL"
|
|
| where DeviceAction != "Block"
|
|
| where isnotempty(RequestURL)
|
|
| project
|
|
3plogTime=TimeGenerated,
|
|
DeviceVendor,
|
|
DeviceProduct,
|
|
Activity,
|
|
DestinationHostName,
|
|
DestinationIP,
|
|
RequestURL=tostring(tolower(RequestURL)),
|
|
MaliciousIP,
|
|
SourceUserName=tostring(tolower(SourceUserName)),
|
|
IndicatorThreatType,
|
|
ThreatSeverity,
|
|
ThreatConfidence,
|
|
SourceUserID,
|
|
SourceHostName)
|
|
on $left.Url == $right.RequestURL
|
|
// matching successful Login from suspicious IP
|
|
| join kind=inner (SigninLogs
|
|
//filtering the Successful Login
|
|
| where ResultType == 0
|
|
| project
|
|
IPAddress,
|
|
SourceSystem,
|
|
SigniningTime= TimeGenerated,
|
|
OperationName,
|
|
ResultType,
|
|
ResultDescription,
|
|
AlternateSignInName,
|
|
AppDisplayName,
|
|
AuthenticationRequirement,
|
|
ClientAppUsed,
|
|
RiskState,
|
|
RiskLevelDuringSignIn,
|
|
UserPrincipalName=tostring(tolower(UserPrincipalName)),
|
|
Name = tostring(split(UserPrincipalName, "@")[0]),
|
|
UPNSuffix =tostring(split(UserPrincipalName, "@")[1]))
|
|
on $left.DestinationIP == $right.IPAddress and $left.SourceUserName == $right.UserPrincipalName
|
|
| where SigniningTime between ((AlertTime - 6h) .. (AlertTime + 6h)) and 3plogTime between ((AlertTime - 6h) .. (AlertTime + 6h))
|
|
entityMappings:
|
|
- entityType: Account
|
|
fieldMappings:
|
|
- identifier: FullName
|
|
columnName: UserPrincipalName
|
|
- identifier: Name
|
|
columnName: Name
|
|
- identifier: UPNSuffix
|
|
columnName: UPNSuffix
|
|
- entityType: IP
|
|
fieldMappings:
|
|
- identifier: Address
|
|
columnName: DestinationIP
|
|
- entityType: DNS
|
|
fieldMappings:
|
|
- identifier: DomainName
|
|
columnName: DestinationHostName
|
|
- entityType: Host
|
|
fieldMappings:
|
|
- identifier: FullName
|
|
columnName: SourceSystem
|
|
- entityType: URL
|
|
fieldMappings:
|
|
- identifier: Url
|
|
columnName: RequestURL
|
|
kind: Scheduled
|
|
version: 1.0.5
|
|
metadata:
|
|
source:
|
|
kind: Community
|
|
author:
|
|
name: Arjun Trivedi
|
|
support:
|
|
tier: Community
|
|
categories:
|
|
domains: [ "Security - Threat Protection" ] |