SpyCloud infostealer malware credential exposure

id: ead4deed-9d48-4646-aee0-6b46c2dd1ae6
name: SpyCloud infostealer malware credential exposure
description: |
  'Identifies credentials harvested by infostealer malware on a compromised device. This
  exposure may indicate an actively compromised endpoint with associated command-and-control
  risk.'
severity: High
requiredDataConnectors:
  - connectorId: SpyCloudEnterpriseProtectionCCF
    dataTypes:
      - SpyCloudBreachWatchlistV2_CL
queryFrequency: 1h
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CredentialAccess
  - CommandAndControl
relevantTechniques:
  - T1555
  - T1071
query: |
  // Human-readable constant for the severity threshold used below
  let severityThreshold = 25;
  SpyCloudBreachWatchlistV2_CL
  | where Severity == severityThreshold
  | mv-expand IPAddress = IPAddresses to typeof(string)
  | extend AccountName = Username, AccountEmail = Email, HostName = UserHostName
  | project TimeGenerated, DocumentId, SourceId, SpyCloudPublishDate, AccountEmail,
      AccountName, HostName, InfectedMachineId, InfectedTime, UserOS, IPAddress
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountName
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: HostName
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPAddress
version: 1.0.0
kind: scheduled