Cisco SEG - Malicious attachment not blocked

Status: available
Severity: high
Time window: 10m
Source: github.com/Azure/Azure-Sentinel

'Detects mails with malicious attachments which were not blocked.'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1566` Phishing

Rule body

id: 236e872c-31d1-4b45-ac2a-fda3af465c97
name: Cisco SEG - Malicious attachment not blocked
description: |
  'Detects mails with malicious attachments which were not blocked.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: CefAma
    dataTypes:
      - CommonSecurityLog
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CiscoSEGEvent
  | where NetworkDirection =~ 'Incoming'
  | where SimplifiedDeviceAction =~ 'DELIVERED'
  | where tostring(AdditionalFields) has 'ESAAMPVerdict'
  | extend amp_verdict = extract(@'ESAAMPVerdict":"(NOT_EVALUATED|CLEAN|FA_PENDING|UNKNOWN|SKIPPED|UNSCANNABLE|LOW_RISK|MALICIOUS)"', 1, tostring(AdditionalFields))
  | where amp_verdict =~ 'MALICIOUS'
  | extend AccountCustomEntity = DstUserName
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountCustomEntity
version: 1.0.3
kind: Scheduled

Stages and Predicates

Stage 1: `source`

CiscoSEGEvent

Stage 2: `where`

| where NetworkDirection =~ 'Incoming'

Stage 3: `where`

| where SimplifiedDeviceAction =~ 'DELIVERED'

Stage 4: `where`

| where tostring(AdditionalFields) has 'ESAAMPVerdict'

Stage 5: `extend`

| extend amp_verdict = extract(@'ESAAMPVerdict":"(NOT_EVALUATED|CLEAN|FA_PENDING|UNKNOWN|SKIPPED|UNSCANNABLE|LOW_RISK|MALICIOUS)"', 1, tostring(AdditionalFields))

Stage 6: `where`

| where amp_verdict =~ 'MALICIOUS'

Stage 7: `extend`

| extend AccountCustomEntity = DstUserName

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AdditionalFields`	match	`ESAAMPVerdict` transforms: `tostring`, `term`	`field:"AdditionalFields" kind:match value:"ESAAMPVerdict"`
`NetworkDirection`	eq	`Incoming`	`field:"NetworkDirection" kind:eq value:"Incoming"`
`SimplifiedDeviceAction`	eq	`DELIVERED`	`field:"SimplifiedDeviceAction" kind:eq value:"DELIVERED"`
`amp_verdict`	eq	`MALICIOUS`	`field:"amp_verdict" kind:eq value:"MALICIOUS"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`amp_verdict`	`extend`
`AccountCustomEntity`	`extend`

Cisco SEG - Malicious attachment not blocked

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: extend

Stage 6: where

Stage 7: extend

Indicators

Output fields

Stage 1: `source`

Stage 2: `where`

Stage 3: `where`

Stage 4: `where`

Stage 5: `extend`

Stage 6: `where`

Stage 7: `extend`