Kusto rules: 2q

id: 15f5a956-3af9-11ec-8d3d-0242ac130003
name: Apache - Multiple client errors from single IP
description: |
  'Detects multiple client errors from one source in short timeframe'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: CustomLogsAma
    datatypes:
      - ApacheHTTPServer_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1190
  - T1133
query: |
  let threshold = 100;
  ApacheHTTPServer
  | where HttpStatusCode >= 400 and HttpStatusCode <= 499
  | summarize MultipleClientErrors = count() by SrcIpAddr, bin(TimeGenerated, 5m)
  | where MultipleClientErrors > threshold
  | extend IPCustomEntity = SrcIpAddr
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity
version: 1.0.3
kind: Scheduled

id: 89e6adbd-612c-4fbe-bc3d-32f81baf3b6c
name: Azure DevOps Administrator Group Monitoring
description: |
  'This detection monitors for additions to projects or project collection administration groups in an Azure DevOps Organization.'
severity: Medium
status: Available
requiredDataConnectors: []
queryFrequency: 4h
queryPeriod: 4h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Persistence
relevantTechniques:
  - T1098
query: |
  // Change to true to monitor for Project Administrator adds to *any* project
  let MonitorAllProjects = false;
  // If MonitorAllProjects is false, trigger only on Project Administrator add for the following projects
  let ProjectsToMonitor = dynamic(['<project_X>','<project_Y>']);
  ADOAuditLogs
  | where Area == "Group" and OperationName == "Group.UpdateGroupMembership.Add"
  | where Details has 'Administrators'
  | where Details has "was added as a member of group" and (Details endswith '\\Project Administrators' or Details endswith '\\Project Collection Administrators')
  | parse Details with AddedIdentity ' was added as a member of group [' EntityName ']\\' GroupName
  | extend Level = iif(GroupName == 'Project Collection Administrators', 'Organization', 'Project'), AddedIdentityId = Data.MemberId
  | extend Severity = iif(Level == 'Organization', 'High', 'Medium'), AlertDetails = strcat('At ', TimeGenerated, ' UTC ', ActorUPN, '/', ActorDisplayName, ' added ', AddedIdentity, ' to the ', EntityName, ' ', Level)
  | where MonitorAllProjects == true or EntityName in (ProjectsToMonitor) or Level == 'Organization'
  | project TimeGenerated, Severity, Adder = ActorUPN, AddedIdentity, AddedIdentityId, AlertDetails, Level, EntityName, GroupName, ActorAuthType = AuthenticationMechanism,
    ActorIpAddress = IpAddress, ActorUserAgent = UserAgent, RawDetails = Details
  | extend timestamp = TimeGenerated
  | extend AccountName = tostring(split(Adder, "@")[0]), AccountUPNSuffix = tostring(split(Adder, "@")[1])
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: Adder
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountUPNSuffix
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: ActorIpAddress
version: 1.0.5
kind: Scheduled

id: f1334bfc-7cdd-4655-b8de-e1398158f4b5
name: BloodHound Attack Path Finding - VM Admin Login Role on Tier Zero System
description: BloodHound Attack Path Finding - VM Admin Login Role on Tier Zero System
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: BloodHoundEnterprise
    dataTypes:
      - BHEAttackPathsData_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics: []
relevantTechniques: []
query: BHEAttackPathsData_CL | where Finding == "AzureT0VMAdminLogin"
entityMappings:
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: domain_name
customDetails:
  Description: ShortDescription
  Remediation: ShortRemediation
version: 1.0.0
kind: Scheduled

id: 16c91a2c-17ad-4985-a9ad-4a4f1cb11830
name: Cisco Duo - Unexpected authentication factor
description: |
  'Detects when unexpected authentication factor used.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: CiscoDuoAuthConnectorDefinition
    dataTypes:
      - DuoAuthentication_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1078
query: |
  let allowed_auth_f = dynamic(['duo_push', 'duo_mobile_passcode']);
  DuoAuthentication_CL
  | where Result =~ 'success'
  | where Factor !in~ (allowed_auth_f)
  | extend IPCustomEntity = AccessDeviceIp, AccountCustomEntity = UserName
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountCustomEntity
version: 1.0.1
kind: Scheduled

id: 0101e08d-99cd-4a97-a9e0-27649c4369ad
name: Cross-tenant Access Settings Organization Outbound Direct Settings Changed
description: |
  'Organizations are added in the Cross-tenant Access Settings to control communication inbound or outbound for users and applications. This detection notifies when Organization Outbound Direct Settings are changed for "Users & Groups" and for "Applications".'
severity: Medium
requiredDataConnectors:
  - connectorId: AzureActiveDirectory
    dataTypes:
      - AuditLogs
queryFrequency: 2d
queryPeriod: 2d
triggerOperator: gt
triggerThreshold: 0
status: Available
tactics:
  - InitialAccess
  - Persistence
  - Discovery
relevantTechniques:
  - T1078.004
  - T1136.003
  - T1087.004
query: |
  // In User & Groups and in Applications, the following "AccessType" values in columns PremodifiedOutboundSettings and ModifiedOutboundSettings are interpreted accordingly
  // When Access Type in premodified outbound settings value was 1 that means that the initial access was allowed. When Access Type in premodified outbound settings value was 2 that means that the initial access was blocked.
  // When Access Type in modified outbound settings value is 1 that means that now access is allowed. When Access Type in modified outbound settings value is 2 that means that now access is blocked.
  AuditLogs
  | where OperationName has "Update a partner cross-tenant access setting"
  | mv-apply TargetResource = TargetResources on
    (
        where TargetResource.type =~ "Policy"
        | extend Properties = TargetResource.modifiedProperties
    )
  | mv-apply Property = Properties on
    (
        where Property.displayName =~ "b2bDirectConnectOutbound"
        | extend PremodifiedOutboundSettings = trim('"',tostring(Property.oldValue)),
                 ModifiedOutboundSettings = trim(@'"',tostring(Property.newValue))
    )
  | where PremodifiedOutboundSettings != ModifiedOutboundSettings
  | extend InitiatingAppName = tostring(InitiatedBy.app.displayName)
  | extend InitiatingAppServicePrincipalId = tostring(InitiatedBy.app.servicePrincipalId)
  | extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)
  | extend InitiatingAadUserId = tostring(InitiatedBy.user.id)
  | extend InitiatingIpAddress = tostring(iff(isnotempty(InitiatedBy.user.ipAddress), InitiatedBy.user.ipAddress, InitiatedBy.app.ipAddress))
  | extend InitiatingAccountName = tostring(split(InitiatingUserPrincipalName, "@")[0]), InitiatingAccountUPNSuffix = tostring(split(InitiatingUserPrincipalName, "@")[1])
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: InitiatingAppName
      - identifier: AadUserId
        columnName: InitiatingAppServicePrincipalId
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: InitiatingUserPrincipalName
      - identifier: Name
        columnName: InitiatingAccountName
      - identifier: UPNSuffix
        columnName: InitiatingAccountUPNSuffix
  - entityType: Account
    fieldMappings:
      - identifier: AadUserId
        columnName: InitiatingAadUserId
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: InitiatingIpAddress
version: 1.1.1
kind: Scheduled

id: 0012714c-c595-4dcd-8949-4a5c1d49aaa8
name: Cyble Vision Alerts Assets
description: |
  'Scheduled rule that creates incidents for asset alerts using saved parser Alerts_assets. Mandatory custom details: MappedSeverity, Status, AlertID, Service.'
severity: Low
status: Available
requiredDataConnectors:
- connectorId: CybleVisionAlerts
  dataTypes:
  - CybleVisionAlerts_CL
enabled: true
queryfrequency: 30m
queryPeriod: 30m
triggerOperator: GreaterThan
triggerThreshold: 0
eventGroupingSettings:
  aggregationKind: AlertPerResult
tactics:
- Reconnaissance
relevantTechniques:
- T1592
query: |
  Alerts_assets
  | where Service == "assets"
  | extend MappedSeverity = Severity
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
customDetails:
  MappedSeverity: Severity
  Status: Status
  AlertID: AlertID
  Service: Service
  AA_KeywordID: AA_KeywordID
  AA_LastDetected: AA_LastDetected
  AA_Value: AA_Value
entityMappings:
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: AA_Value
- entityType: Url
  fieldMappings:
  - identifier: Url
    columnName: AA_Value
version: 1.0.0
kind: Scheduled

id: b8149f2f-54da-4f7b-98e1-c01ca47e1e55
name: CYFIRMA - Social and Public Exposure -  Social Media Threats  Activity Detected Rule
description: |
  "This rule detects medium-severity social threat alerts from CYFIRMA related to impersonation, fake profiles, or malicious activities on social platforms that may target executives, brands, or employees. 
  These threats can result in reputational damage, phishing, or social engineering attacks. 
  Immediate investigation and takedown are recommended to minimize risk."
version: 1.0.1
kind: Scheduled
severity: Medium
requiredDataConnectors:
  - connectorId: CyfirmaDigitalRiskAlertsConnector
    dataTypes:
      - CyfirmaSPESocialThreatAlerts_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
status: Available
tactics:
  - ResourceDevelopment
  - Reconnaissance
  - InitialAccess
  - Impact
relevantTechniques:
  - T1585.001
  - T1593
  - T1566
  - T1582
  - T1491
query: |
  // Medium severity - Social and Public Exposure - Social Media Threats Activity Detected
  let timeFrame = 5m;
  CyfirmaSPESocialThreatAlerts_CL
  | where severity == 'High' and TimeGenerated between (ago(timeFrame) .. now())
  | extend
      Description=description,
      FirstSeen=first_seen,
      LastSeen=last_seen,
      RiskScore=risk_score,
      AlertUID=alert_uid,
      UID=uid,
      AssetType=asset_type,
      AssetValue=signature,
      Source=source,
      Impact=impact,
      Recommendation=recommendation,
      ProviderName='CYFIRMA',
      ProductName='DeCYFIR/DeTCT',
      AlertTitle=Alert_title
  | project
      TimeGenerated,
      Description,
      RiskScore,
      FirstSeen,
      LastSeen,
      AlertUID,
      UID,
      AssetType,
      AssetValue,
      Source,
      Impact,
      Recommendation,
      ProductName,
      ProviderName,
      AlertTitle
customDetails:
  AssetType: AssetType
  AssetValue: AssetValue
  RiskScore: RiskScore
  Source: Source
  Impact: Impact
  Description: Description
  Recommendation: Recommendation
  FirstSeen: FirstSeen
  LastSeen: LastSeen
  AlertUID: AlertUID
  UID: UID
  TimeGenerated: TimeGenerated
alertDetailsOverride:
  alertDisplayNameFormat: "CYFIRMA - Medium Severity Alert: Social Media Threat Activity Detected - {{AlertTitle}} "
  alertDescriptionFormat: "{{Description}} "
  alertDynamicProperties:
    - alertProperty: ProductName
      value: ProductName
    - alertProperty: ProviderName
      value: ProviderName
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: AlertPerResult

id: 54e22fed-0ec6-4fb2-8312-2a3809a93f63
name: full_access_as_app Granted To Application
description: |
  'This detection looks for the full_access_as_app permission being granted to an OAuth application with Admin Consent.
  This permission provide access to all Exchange mailboxes via the EWS API can could be exploited to access sensitive data by being added to a compromised application. The application granted this permission should be reviewed to ensure that it is absolutely necessary for the applications function.
  Ref: https://learn.microsoft.com/graph/auth-limit-mailbox-access'
severity: Medium
requiredDataConnectors:
  - connectorId: AzureActiveDirectory
    dataTypes:
      - AuditLogs
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
status: Available
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1550.001
query: |
  AuditLogs
  | where LoggedByService =~ "Core Directory"
  | where Category =~ "ApplicationManagement"
  | where OperationName =~ "Consent to application"
  | where TargetResources has "full_access_as_app"
  | mv-expand TargetResources
  | extend OAuthAppName = TargetResources.displayName
  | extend ModifiedProperties = TargetResources.modifiedProperties 
  | mv-apply Property = ModifiedProperties on 
    (
        where Property.displayName =~ "ConsentContext.isAdminConsent"
        | extend AdminConsent = tostring(Property.newValue)
    )
  | mv-apply Property = ModifiedProperties on 
    (
        where Property.displayName =~ "ConsentAction.Permissions"
        | extend Permissions = tostring(Property.newValue)
    )
  | mv-apply Property = ModifiedProperties on 
    (
        where Property.displayName =~ "TargetId.ServicePrincipalNames"
        | extend AppId = tostring(Property.newValue)
    )
  | mv-apply Property = AdditionalDetails on 
    (
        where Property.key =~ "User-Agent"
        | extend InitiatingUserAgent = replace('"', '', tostring(Property.value))
    )
  | project-away Property
  | parse Permissions with * "ConsentType: " GrantConsentType ", Scope: " GrantScope1 "," *
  | where GrantScope1 =~ "full_access_as_app"
  | extend InitiatingAppName = tostring(InitiatedBy.app.displayName)
  | extend InitiatingAppServicePrincipalId = tostring(InitiatedBy.app.servicePrincipalId)
  | extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)
  | extend InitiatingAadUserId = tostring(InitiatedBy.user.id)
  | extend InitiatingIpAddress = tostring(iff(isnotempty(InitiatedBy.user.ipAddress), InitiatedBy.user.ipAddress, InitiatedBy.app.ipAddress))
  | project-reorder TimeGenerated, OAuthAppName, AppId, AdminConsent, Permissions, InitiatingUserPrincipalName, InitiatingAadUserId, InitiatingAppName, InitiatingAppServicePrincipalId, InitiatingIpAddress, InitiatingUserAgent, GrantScope1, GrantConsentType
  | extend GrantInitiatedBy = tostring(iff(isnotempty(InitiatingUserPrincipalName), InitiatingUserPrincipalName, InitiatingAppName))
  | extend Name = split(InitiatingUserPrincipalName, "@")[0], UPNSuffix = split(InitiatingUserPrincipalName, "@")[1]
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: InitiatingUserPrincipalName
      - identifier: Name
        columnName: Name
      - identifier: UPNSuffix
        columnName: UPNSuffix
  - entityType: Account
    fieldMappings:
      - identifier: AadUserId
        columnName: InitiatingAadUserId
  - entityType: Account
    fieldMappings:
      - identifier: AadUserId
        columnName: InitiatingAppServicePrincipalId
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: InitiatingIpAddress
customDetails:
  OAuthApplication: OAuthAppName
  OAuthAppId: AppId
  UserAgent: InitiatingUserAgent
alertDetailsOverride:
  alertDisplayNameFormat: User or App {{GrantInitiatedBy}} granted full_access_as_app to {{OAuthAppName}}
  alertDescriptionFormat: |
    This detection looks for the full_access_as_app permission being granted to an OAuth application with Admin Consent.
    This permission provide access to all Exchange mailboxes via the EWS API can could be exploited to access sensitive data 
    by being added to a compromised application. The application granted this permission should be reviewed to ensure that it 
    is absolutely necessary for the applications function.
    In this case {{GrantInitiatedBy}} granted full_access_as_app to {{OAuthAppName}} from {{InitiatingIpAddress}}
    Ref: https://learn.microsoft.com/graph/auth-limit-mailbox-access
version: 1.0.2
kind: Scheduled

id: d4e5f6a7-b8c9-0123-defa-234567890124
name: GTI - Data Leak Alert Detected
description: |
  Triggers an incident when a GTI Relevance System Alert of type data_leak is ingested.
  Data Leak alerts indicate that sensitive organisational data (credentials, PII, intellectual property,
  source code, databases, etc.) has been found exposed on the dark web, paste sites, or underground
  forums and matches your organisation profile.
  Each unique Alert ID is grouped into a single incident.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: GoogleThreatIntelligenceRelevanceSystemAlertsAPI
    dataTypes:
      - RelevanceSystemAlerts_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Exfiltration
  - Impact
  - CredentialAccess
  - Collection
relevantTechniques:
  - T1567
  - T1530
  - T1552
  - T1485
query: |
  GTIRelevanceSystemAlerts
  | where DetailType == "data_leak"
  | project
      TimeGenerated,
      AlertId,
      AlertName          = DisplayName,
      AlertState         = State,
      LeakSeverity       = DataLeakSeverity,
      DiscoveryDocuments = DataLeakDiscoveryDocumentIds,
      PriorityLevel,
      PriorityReasoning,
      SeverityLevel,
      SeverityConfidence,
      SeverityReasoning,
      RelevanceLevel,
      RelevanceConfidence,
      RelevanceReasoning,
      FindingCount,
      AiSummary,
      CommonThemes       = RelevanceEvidenceCommonThemes,
      DistinctThemes     = RelevanceEvidenceDistinctThemes,
      AuditCreateTime,
      AuditUpdateTime
alertDetailsOverride:
  alertDisplayNameFormat: 'GTI Data Leak: {{AlertName}}'
  alertDescriptionFormat: |
    Leak Severity: {{LeakSeverity}} | Priority: {{PriorityLevel}}

    Summary: {{AiSummary}}
customDetails:
  AlertId: AlertId
  AlertState: AlertState
  LeakSeverity: LeakSeverity
  PriorityLevel: PriorityLevel
  SeverityLevel: SeverityLevel
  RelevanceLevel: RelevanceLevel
  FindingCount: FindingCount
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: P5D
    matchingMethod: Selected
    groupByCustomDetails:
      - AlertId
eventGroupingSettings:
  aggregationKind: AlertPerResult
version: 1.0.0
kind: Scheduled

let historic_rdp_devices = toscalar(
    DeviceNetworkEvents
    | where Timestamp > ago (30d)
    | where ActionType == "ConnectionSuccess"
    | where RemotePort == 3389
    | summarize make_set(DeviceId)
);
DeviceNetworkEvents
| where Timestamp > ago(1h)
| where ActionType == "ConnectionSuccess"
| where RemotePort == 3389
| where DeviceId !in (historic_rdp_devices)

let historic_rdp_devices = toscalar(
    DeviceNetworkEvents
    | where TimeGenerated > ago (30d)
    | where ActionType == "ConnectionSuccess"
    | where RemotePort == 3389
    | summarize make_set(DeviceId)
);
DeviceNetworkEvents
| where TimeGenerated > ago(1h)
| where ActionType == "ConnectionSuccess"
| where RemotePort == 3389
| where DeviceId !in (historic_rdp_devices)

id: a7cd18cd-1503-47ec-8dca-65d750540637
name: Lumen TI IPAddress in IdentityLogonEvents
displayName: Lumen TI IPAddress in IdentityLogonEvents
description: |
  This query maps Lumen IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in Azure AD sign-in logs.
severity: Medium
requiredDataConnectors:
  - connectorId: LumenThreatFeedConnector
    dataTypes:
      - ThreatIntelligenceIndicator
  - connectorId: ThreatIntelligenceUploadIndicatorsAPI
    dataTypes:
      - ThreatIntelligenceIndicator
  - connectorId: AzureActiveDirectory
    dataTypes:
      - AADNonInteractiveUserSignInLogs
      - AADServicePrincipalSignInLogs
      - AADManagedIdentitySignInLogs
      - ADFSSignInLogs
queryFrequency: 4h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
suppressionDuration: 5h
suppressionEnabled: true
tactics:
  - CommandAndControl
relevantTechniques:
  - T1071
query: |
  let dt_lookBack = 1d;  // Data lookback for AAD sign-in logs
  let ioc_lookBack = 14d; // TI lookback
  let IP_Indicators =
      ThreatIntelIndicators
      | where TimeGenerated >= ago(ioc_lookBack)
      | where IsActive == true and ValidUntil > now()
      | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
      | where SourceSystem == 'Lumen'
      | where ObservableKey == 'ipv4-addr:value'
      | extend TI_ipEntity = ObservableValue
      | where ipv4_is_private(TI_ipEntity) == false and TI_ipEntity !startswith 'fe80' and TI_ipEntity !startswith '::' and TI_ipEntity !startswith '127.';
  let SignInUnion =
      union isfuzzy=true
      (
          AADNonInteractiveUserSignInLogs
          | where TimeGenerated >= ago(dt_lookBack)
          | extend
              ILE_ipEntity = IPAddress,
              AccountDisplayName = coalesce(UserDisplayName, UserPrincipalName),
              Application = coalesce(column_ifexists('AppDisplayName',''), column_ifexists('ResourceDisplayName','')),
              LogonType = column_ifexists('ClientAppUsed',''),
              IdentityLogonEvents_TimeGenerated = TimeGenerated
          | project IdentityLogonEvents_TimeGenerated, ILE_ipEntity, AccountDisplayName, Application, LogonType, IPAddress, Type
      ),
      (
          AADServicePrincipalSignInLogs
          | where TimeGenerated >= ago(dt_lookBack)
          | extend
              ILE_ipEntity = IPAddress,
              AccountDisplayName = coalesce(ServicePrincipalName, tostring(ServicePrincipalId)),
              Application = coalesce(column_ifexists('AppDisplayName',''), column_ifexists('ResourceDisplayName','')),
              LogonType = "ServicePrincipal",
              IdentityLogonEvents_TimeGenerated = TimeGenerated
          | project IdentityLogonEvents_TimeGenerated, ILE_ipEntity, AccountDisplayName, Application, LogonType, IPAddress, Type
      ),
      (
          AADManagedIdentitySignInLogs
          | where TimeGenerated >= ago(dt_lookBack)
          | extend
              ILE_ipEntity = IPAddress,
              AccountDisplayName = coalesce(ServicePrincipalName, tostring(ServicePrincipalId)),
              Application = ResourceDisplayName,
              LogonType = "ManagedIdentity",
              IdentityLogonEvents_TimeGenerated = TimeGenerated
          | project IdentityLogonEvents_TimeGenerated, ILE_ipEntity, AccountDisplayName, Application, LogonType, IPAddress, Type
      ),
      (
          ADFSSignInLogs
          | where TimeGenerated >= ago(dt_lookBack)
          | extend
              ILE_ipEntity = IPAddress,
              AccountDisplayName = coalesce(UserDisplayName, UserPrincipalName),
              Application = coalesce(AppDisplayName, ResourceDisplayName),
              LogonType = coalesce(Requirement, AuthenticationRequirement),
              IdentityLogonEvents_TimeGenerated = TimeGenerated
          | project IdentityLogonEvents_TimeGenerated, ILE_ipEntity, AccountDisplayName, Application, LogonType, IPAddress, Type
      );
  IP_Indicators
  | join kind=innerunique (SignInUnion) on $left.TI_ipEntity == $right.ILE_ipEntity
  | where IdentityLogonEvents_TimeGenerated < ValidUntil
  | summarize arg_max(IdentityLogonEvents_TimeGenerated, *), StartTime = min(IdentityLogonEvents_TimeGenerated), EndTime = max(IdentityLogonEvents_TimeGenerated) by Id, ILE_ipEntity
  | project timestamp = EndTime, StartTime, EndTime, AccountDisplayName, IPAddress, Application, LogonType, Id, Tags, ValidUntil, Confidence, TI_ipEntity, ILE_ipEntity, Type
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: ILE_ipEntity
version: 1.0.2
kind: Scheduled

id: 1e3bcd0f-10b2-4fbd-854f-1c6f33acc36a
name: McAfee ePO - Error sending alert
description: |
  'Detects when error sending alert occurs.'
severity: Medium
requiredDataConnectors:
  - connectorId: SyslogAma
    datatypes:
      - Syslog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
status: Available
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1562
  - T1070
query: |
  McAfeeEPOEvent
  | where EventId == '1062'
  | extend IPCustomEntity = DvcIpAddr
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity
version: 1.0.2
kind: Scheduled

id: d3bd7640-3600-49f9-8d10-6fe312e68b4f
name: Mimecast Secure Email Gateway - Internal Email Protect
description: |
  'Detects threats from internal email threat protection.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: MimecastSEGAPI
    dataTypes:
      - MimecastCG
enabled: true
queryFrequency: 15m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
tactics:
- LateralMovement
- Persistence
- Exfiltration
relevantTechniques:
- T1534
- T1546
query: |
  MimecastCG
  | where Type == "email_iep"
  | extend  SenderEnvelope = ['Sender Envelope']  , MessageId = ['Message ID']
suppressionDuration: 5h
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: P7D
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: AlertPerResult
entityMappings:
- entityType: MailMessage
  fieldMappings:
  - identifier: Sender
    columnName: SenderEnvelope
  - identifier: Recipient
    columnName: Recipients
  - identifier: InternetMessageId
    columnName: MessageId
version: 1.0.0
kind: Scheduled

id: 5b66d176-e344-4abf-b915-e5f09a6430ef
name: Mimecast Secure Email Gateway - Internal Email Protect
description: Detects threats from internal email threat protection
severity: High
requiredDataConnectors:
  - connectorId: MimecastSIEMAPI
    dataTypes:
      - MimecastSIEM_CL
enabled: true
query: MimecastSIEM_CL| where mimecastEventId_s=="mail_ttp_iep"
queryFrequency: 5m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
suppressionDuration: 5h
suppressionEnabled: false
tactics:
- LateralMovement
- Persistence
- Exfiltration
relevantTechniques:
- T1534
- T1546
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1d
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: SingleAlert
customDetails:
  Subject: Subject_s
  Route: Route_s
  UrlCategory: UrlCategory_s
  ScanResultInfo: ScanResultInfo_s
entityMappings:
- entityType: MailMessage
  fieldMappings:
  - identifier: Sender
    columnName: Sender_s
  - identifier: Recipient
    columnName: Recipient_s
  - identifier: InternetMessageId
    columnName: MsgId_s
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: URL_s
version: 1.0.0
kind: Scheduled

id: 1d858e12-777d-4156-b0af-b5ef410739e6
name: 'PROD (TM003.1) - OBJECT - Moved or Recovered a Tier Level Account'
description: |
  Moving or Recovering of a Tier Model object.
severity: Medium
requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
  - connectorId: WindowsSecurityEvents
    dataTypes:
      - SecurityEvent
queryFrequency: 30m
queryPeriod: 30m
triggerOperator: gt
triggerThreshold: 0
status: Available
tactics:
  - Persistence
relevantTechniques:
  - T1078.002
query: |
  SecurityEvent 
  | where (EventID == 5138
      or EventID == 5139)
      and (EventData matches regex @"(?i)OU=Domain Controllers"
          or EventData matches regex @"(?i)OU=Tier 0 Accounts" 
          or EventData matches regex @"(?i)OU=Tier 1 Accounts" 
          or EventData matches regex @"(?i)OU=Tier 2 Accounts"
          or EventData matches regex @"(?i)OU=Tier 0 Service Accounts" 
          or EventData matches regex @"(?i)OU=Tier 1 Service Accounts" 
          or EventData matches regex @"(?i)OU=Tier 2 Service Accounts"
          or EventData matches regex @"(?i)OU=Tier 0 Groups"
          or EventData matches regex @"(?i)OU=Tier 1 Groups"
          or EventData matches regex @"(?i)OU=Tier 2 Groups"
          or EventData matches regex @"(?i)OU=Tier 0 PAW"
          or EventData matches regex @"(?i)OU=Tier 1 PAW"
          or EventData matches regex @"(?i)OU=Tier 2 PAW"
          or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
          or EventData matches regex @"(?i)OU=Tier 1 Member Servers")
  | extend OldObject_e = extract("<Data Name=\"OldObjectDN\">([^<]+)</Data>", 1, EventData)
  | extend OldObject = extract("(?i)CN=([^,]+)", 1, OldObject_e)
  | extend OldObjectTier = extract("(?i)OU=(Tier [^ ]+)", 1, OldObject_e)
  | extend OldObjectTier = iff(isempty(OldObjectTier), "Outside Tier Model", OldObjectTier)
  | extend NewObject_e = extract("<Data Name=\"NewObjectDN\">([^<]+)</Data>", 1, EventData)
  | extend NewObject = extract("(?i)CN=([^,]+)", 1, NewObject_e)
  | extend NewObjectTier = extract("(?i)OU=(Tier [^ ]+)", 1, NewObject_e)
  | extend SubjectUserName = extract("<Data Name=\"SubjectUserName\">([^<]+)</Data>", 1, EventData)
  | extend SubjectDomainName = extract("<Data Name=\"SubjectDomainName\">([^<]+)</Data>", 1, EventData)
  | extend Account = strcat(SubjectDomainName, "\\", SubjectUserName)
  | extend NewObjectTier = iff(isempty(NewObjectTier), 
      iff(NewObject_e matches regex @"(?i)OU=Domain Controllers", "Tier 0", "Outside Tier Model"), 
      NewObjectTier)
  | extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
  | extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
  | extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
  | where OldObject != NewObjectTier
  | project TimeGenerated
      , ObjectName = OldObject
      , NewObjectTier
      , NewObjectOU = NewObject_e
      , ObjectClass
      , PreviousTier = OldObjectTier
      , PreviousOU = OldObject_e
      , ActivityType
      , Account
      , Domain
      , Computer
      , Channel
      , EventID
      , EventData
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: ObjectName
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: Computer
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: Account
customDetails:
  ObjectName: ObjectName
  NewObjectTier: NewObjectTier
  NewObjectOU: NewObjectOU
  ObjectClass: ObjectClass
  PreviousTier: PreviousTier
  PreviousOU: PreviousOU
  ActivityType: ActivityType
  Account: Account
  Domain: Domain
  Computer: Computer
  Channel: Channel
  EventID: EventID
  EventData: EventData
eventGroupingSettings:
  aggregationKind: AlertPerResult
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
alertDetailsOverride:
  alertDisplayNameFormat: '(TM003.1) A {{NewObjectTier}} {{ObjectClass}} was {{ActivityType}}'
  alertDescriptionFormat: '{{ObjectName}} was moved from {{PreviousOU}} to the following OU {{NewObjectOU}}.'
version: 1.0.0
kind: Scheduled