Abnormal Security - Account Takeover case opened

Status: available
Severity: high
Time window: 1h
Group by: CaseId
Source: github.com/Azure/Azure-Sentinel

'Creates an incident when Abnormal Security opens an Account Takeover (ATO) case, indicating a mailbox or user account is suspected to be compromised. The ATO case severity, status, and observed indicators are surfaced for triage.'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts
Credential Access	`T1110` Brute Force

Rule body

id: da243bf4-382b-46b9-9b4d-ce6ffe9e7beb
name: Abnormal Security - Account Takeover case opened
description: |
  'Creates an incident when Abnormal Security opens an Account Takeover (ATO) case,
  indicating a mailbox or user account is suspected to be compromised. The ATO case
  severity, status, and observed indicators are surfaced for triage.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: AbnormalSecurityPush
    dataTypes:
      - ABNORMAL_SECURITY_ATO_CASE_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - CredentialAccess
relevantTechniques:
  - T1078
  - T1110
query: |
  ABNORMAL_SECURITY_ATO_CASE_CL
  | where isnotempty(abx_body_abx_body_ato_case_id_s)
  // Collapse to one row per ATO case (earliest event in the window) so repeated
  // events for the same case do not raise duplicate alerts.
  | summarize arg_min(TimeGenerated, *) by CaseId = abx_body_abx_body_ato_case_id_s
  | extend
      CompromisedAccount = abx_body_abx_body_compromised_account_s,
      CaseSeverity = abx_body_abx_body_severity_s,
      CaseStatus = abx_body_abx_body_status_s,
      Indicators = abx_body_abx_body_indicators_s,
      FirstDetected = abx_body_abx_body_first_detected_t
  | project TimeGenerated, CompromisedAccount, CaseId, CaseSeverity, CaseStatus, Indicators, FirstDetected
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: CompromisedAccount
customDetails:
  AtoCaseId: CaseId
  CaseSeverity: CaseSeverity
  CaseStatus: CaseStatus
alertDetailsOverride:
  alertDisplayNameFormat: "Abnormal Security: Account Takeover case for {{CompromisedAccount}}"
  alertDescriptionFormat: "Abnormal Security opened ATO case {{CaseId}} (severity {{CaseSeverity}}) for the compromised account {{CompromisedAccount}}."
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: AlertPerResult
suppressionDuration: PT5H
suppressionEnabled: false
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

ABNORMAL_SECURITY_ATO_CASE_CL

Stage 2: `where`

| where isnotempty(abx_body_abx_body_ato_case_id_s)

Stage 3: `summarize`

| summarize arg_min(TimeGenerated, *) by CaseId = abx_body_abx_body_ato_case_id_s

Stage 4: `extend`

| extend
    CompromisedAccount = abx_body_abx_body_compromised_account_s,
    CaseSeverity = abx_body_abx_body_severity_s,
    CaseStatus = abx_body_abx_body_status_s,
    Indicators = abx_body_abx_body_indicators_s,
    FirstDetected = abx_body_abx_body_first_detected_t

Stage 5: `project`

| project TimeGenerated, CompromisedAccount, CaseId, CaseSeverity, CaseStatus, Indicators, FirstDetected

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`abx_body_abx_body_ato_case_id_s`	is_not_null	(no value, null check)	`field:"abx_body_abx_body_ato_case_id_s" kind:is_not_null`

Output fields

These fields are emitted when the rule matches.

Field	Source
`CaseId`	`project`
`CaseSeverity`	`project`
`CaseStatus`	`project`
`CompromisedAccount`	`project`
`FirstDetected`	`project`
`Indicators`	`project`
`TimeGenerated`	`project`

Abnormal Security - Account Takeover case opened

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: summarize

Stage 4: extend