Abnormal Security - Vendor compromise case detected

Status: available
Severity: medium
Time window: 1h
Group by: CaseId
Source: github.com/Azure/Azure-Sentinel

'Creates an incident when Abnormal Security opens a vendor case indicating a compromised or impersonated vendor domain (vendor email compromise). Surfaces the vendor domain and Abnormal insights so analysts can review related correspondence.'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1566` Phishing

Rule body

id: b15ea4c9-58da-44d8-90e4-6591d947e7e3
name: Abnormal Security - Vendor compromise case detected
description: |
  'Creates an incident when Abnormal Security opens a vendor case indicating a
  compromised or impersonated vendor domain (vendor email compromise). Surfaces the
  vendor domain and Abnormal insights so analysts can review related correspondence.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: AbnormalSecurityPush
    dataTypes:
      - ABNORMAL_SECURITY_VENDOR_CASE_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  ABNORMAL_SECURITY_VENDOR_CASE_CL
  | where isnotempty(abx_body_abx_body_vendorCaseId_g)
  // Collapse to one row per vendor case (earliest event in the window) so repeated
  // events for the same case do not raise duplicate alerts.
  | summarize arg_min(TimeGenerated, *) by CaseId = abx_body_abx_body_vendorCaseId_g
  | extend
      VendorDomain = abx_body_abx_body_vendorDomain_s,
      Insights = abx_body_abx_body_insights_s,
      FirstObserved = abx_body_abx_body_firstObservedTime_t
  | project TimeGenerated, VendorDomain, CaseId, Insights, FirstObserved
entityMappings:
  - entityType: DNS
    fieldMappings:
      - identifier: DomainName
        columnName: VendorDomain
customDetails:
  VendorCaseId: CaseId
  VendorDomain: VendorDomain
alertDetailsOverride:
  alertDisplayNameFormat: "Abnormal Security: vendor compromise case for {{VendorDomain}}"
  alertDescriptionFormat: "Abnormal Security opened vendor case {{CaseId}} for the domain {{VendorDomain}}. Review related correspondence for vendor email compromise."
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: AlertPerResult
suppressionDuration: PT5H
suppressionEnabled: false
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

ABNORMAL_SECURITY_VENDOR_CASE_CL

Stage 2: `where`

| where isnotempty(abx_body_abx_body_vendorCaseId_g)

Stage 3: `summarize`

| summarize arg_min(TimeGenerated, *) by CaseId = abx_body_abx_body_vendorCaseId_g

Stage 4: `extend`

| extend
    VendorDomain = abx_body_abx_body_vendorDomain_s,
    Insights = abx_body_abx_body_insights_s,
    FirstObserved = abx_body_abx_body_firstObservedTime_t

Stage 5: `project`

| project TimeGenerated, VendorDomain, CaseId, Insights, FirstObserved

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`abx_body_abx_body_vendorCaseId_g`	is_not_null	(no value, null check)	`field:"abx_body_abx_body_vendorCaseId_g" kind:is_not_null`

Output fields

These fields are emitted when the rule matches.

Field	Source
`CaseId`	`project`
`FirstObserved`	`project`
`Insights`	`project`
`TimeGenerated`	`project`
`VendorDomain`	`project`

Abnormal Security - Vendor compromise case detected

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: summarize

Stage 4: extend