Acronis - Multiple Inboxes with Malicious Content Detected

Severity: medium
Time window: 1d
Group by: DeviceName
Source: github.com/Azure/Azure-Sentinel

Many inboxes containing malicious content could indicate a potential ongoing phishing attack.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1566.001` Phishing: Spearphishing Attachment `T1566.002` Phishing: Spearphishing Link

Rule body

id: 5090ad7b-4b47-4cab-9015-bffb43aecde8
name: Acronis - Multiple Inboxes with Malicious Content Detected
description: Many inboxes containing malicious content could indicate a potential ongoing phishing attack.
severity: Medium
query: |
    CommonSecurityLog
    | where DeviceVendor == "Acronis"
    | where DeviceEventClassID in
    ("MaliciousURLDetectedInM365MailboxBackup",
    "MalwareDetectedInM365MailboxBackup",
    "MaliciousEmailDetectedPerceptionPointWarning")
    | summarize MaliciousContent = count() by DeviceName
queryFrequency: 1h
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 2
tactics:
    - InitialAccess
relevantTechniques:
    - T1566.002
    - T1566.001
incidentConfiguration:
    createIncident: true
    groupingConfiguration:
        enabled: true
        reopenClosedIncident: true
        lookbackDuration: P1D
        matchingMethod: AnyAlert
eventGroupingSettings:
    aggregationKind: SingleAlert
customDetails:
  DeviceName: DeviceName
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: DeviceName
version: 1.0.0
kind: Scheduled
requiredDataConnectors: []

Stages and Predicates

Stage 1: `source`

CommonSecurityLog

Stage 2: `where`

| where DeviceVendor == "Acronis"

Stage 3: `where`

| where DeviceEventClassID in
("MaliciousURLDetectedInM365MailboxBackup",
"MalwareDetectedInM365MailboxBackup",
"MaliciousEmailDetectedPerceptionPointWarning")

Stage 4: `summarize`

| summarize MaliciousContent = count() by DeviceName

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`DeviceEventClassID`	in	`MaliciousEmailDetectedPerceptionPointWarning` `MaliciousURLDetectedInM365MailboxBackup` `MalwareDetectedInM365MailboxBackup`	`field:"DeviceEventClassID" kind:in`
`DeviceVendor`	eq	`Acronis`	`field:"DeviceVendor" kind:eq value:"Acronis"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`DeviceName`	`summarize`
`MaliciousContent`	`summarize`

Acronis - Multiple Inboxes with Malicious Content Detected

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: summarize

Indicators

Output fields

Stage 1: `source`

Stage 2: `where`

Stage 3: `where`

Stage 4: `summarize`