Acronis - Multiple Endpoints Accessing Malicious URLs

Severity: medium
Time window: 1d
Group by: DeviceName
Source: github.com/Azure/Azure-Sentinel

Multiple endpoints accessing malicious URLs could indicate an ongoing phishing attack, with several employees interacting with those URLs.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1204.001` User Execution: Malicious Link

Rule body

id: 1385f0ce-69d9-4abf-8039-52080c8c7017
name: Acronis - Multiple Endpoints Accessing Malicious URLs
description: 'Multiple endpoints accessing malicious URLs could indicate an ongoing phishing attack, with several employees interacting with those URLs.'
severity: Medium
query: |
    CommonSecurityLog
    | where DeviceVendor == "Acronis"
    | where DeviceEventClassID == "MaliciousUrlDetected"
    | summarize MaliciousUrlDetected = count() by DeviceName
queryFrequency: 1h
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 2
tactics:
    - Execution
relevantTechniques:
    - T1204.001
incidentConfiguration:
    createIncident: true
    groupingConfiguration:
        enabled: true
        reopenClosedIncident: true
        lookbackDuration: P1D
        matchingMethod: AnyAlert
eventGroupingSettings:
    aggregationKind: SingleAlert
customDetails:
  DeviceName: DeviceName
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: DeviceName
version: 1.0.0
kind: Scheduled
requiredDataConnectors: []

Stages and Predicates

Stage 1: `source`

CommonSecurityLog

Stage 2: `where`

| where DeviceVendor == "Acronis"

Stage 3: `where`

| where DeviceEventClassID == "MaliciousUrlDetected"

Stage 4: `summarize`

| summarize MaliciousUrlDetected = count() by DeviceName

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`DeviceEventClassID`	eq	`MaliciousUrlDetected`	`field:"DeviceEventClassID" kind:eq value:"MaliciousUrlDetected"`
`DeviceVendor`	eq	`Acronis`	`field:"DeviceVendor" kind:eq value:"Acronis"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`DeviceName`	`summarize`
`MaliciousUrlDetected`	`summarize`