detection.wiki

Detection rules › Kusto

Checkpoint - Pending Phishing emails

Severity
high
Time window
15m
Source
github.com/Azure/Azure-Sentinel

This query searches for phishing emails that are pending action

MITRE ATT&CK coverage

TacticTechniques
Initial Access

Rule body

id: a97e2333-b7de-4c14-9700-e652a1dbef26
name: Checkpoint - Pending Phishing emails
apiVersion: 2021-09-01-preview
description: This query searches for phishing emails that are pending action
displayName: Checkpoint - Pending Phishing emails
severity: High
enabled: true
query: CheckpointHEC_CL | where EventCurrentState == "new" and EventCategory == "phishing"
queryFrequency: 5m
queryPeriod: 15m
requiredDataConnectors:
  - connectorId: CheckpointHECConnection
    dataTypes:
      - CheckpointHEC_CL
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
suppressionDuration: 5h
suppressionEnabled: false
alertRuleTemplateName:
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1d
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: SingleAlert
alertDetailsOverride:
customDetails:
  EmailID: EmailEmailId
entityMappings:
  - entityType: MailMessage
    fieldMappings:
      - identifier: Sender
        columnName: EmailFromEmail
      - identifier: NetworkMessageId
        columnName: EmailMessageId
      - identifier: Subject
        columnName: EmailSubject
  - entityType: Mailbox
    fieldMappings:
      - identifier: MailboxPrimaryAddress
        columnName: EmailTo
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: source

CheckpointHEC_CL

Stage 2: where

| where EventCurrentState == "new" and EventCategory == "phishing"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
EventCategoryeq
  • phishing
field:"EventCategory" kind:eq value:"phishing"
EventCurrentStateeq
  • new
field:"EventCurrentState" kind:eq value:"new"