MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access |
Rule body
id: ef0a253c-95b5-48e1-8ebc-dbeb073b9338
name: Cisco SEG - Suspicious sender domain
description: |
'Detects suspicious sender domain age.'
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: CefAma
dataTypes:
- CommonSecurityLog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
relevantTechniques:
- T1566
query: |
CiscoSEGEvent
| where NetworkDirection =~ 'Incoming'
| extend rec_domain = extract(@'@(.*)', 1, DstUserName)
| extend s_domain = extract(@'@(.*)', 1, SrcUserName)
| where s_domain != rec_domain
| where tostring(AdditionalFields) has 'ESASDRDomainAge'
| extend domain_age = extract(@'ESASDRDomainAge":"(.*days)"', 1, tostring(AdditionalFields))
| extend yy = toint(extract(@'(\d+)\syears', 1, domain_age))
| extend mm = toint(extract(@'(\d+)\smonths', 1, domain_age))
| extend dd = toint(extract(@'(\d+)\sdays', 1, domain_age))
| where isempty(yy)
| where isempty(mm) or mm <= 2
| extend AccountCustomEntity = SrcUserName
entityMappings:
- entityType: Account
fieldMappings:
- identifier: Name
columnName: AccountCustomEntity
version: 1.0.3
kind: Scheduled
Stages and Predicates
Stage 1: source
CiscoSEGEvent
Stage 2: where
| where NetworkDirection =~ 'Incoming'
Stage 3: extend
| extend rec_domain = extract(@'@(.*)', 1, DstUserName)
Stage 4: extend
| extend s_domain = extract(@'@(.*)', 1, SrcUserName)
Stage 5: where
| where s_domain != rec_domain
Stage 6: where
| where tostring(AdditionalFields) has 'ESASDRDomainAge'
Stage 7: extend (4 consecutive steps)
| extend domain_age = extract(@'ESASDRDomainAge":"(.*days)"', 1, tostring(AdditionalFields))
| extend yy = toint(extract(@'(\d+)\syears', 1, domain_age))
| extend mm = toint(extract(@'(\d+)\smonths', 1, domain_age))
| extend dd = toint(extract(@'(\d+)\sdays', 1, domain_age))
Stage 8: where
| where isempty(yy)
Stage 9: where
| where isempty(mm) or mm <= 2
Stage 10: extend
| extend AccountCustomEntity = SrcUserName
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
AdditionalFields | match |
| field:"AdditionalFields" kind:match value:"ESASDRDomainAge" |
NetworkDirection | eq |
| field:"NetworkDirection" kind:eq value:"Incoming" |
mm | is_null | field:"mm" kind:is_null | |
mm | le |
| field:"mm" kind:le value:"2" |
s_domain | cross_field_compare |
| field:"s_domain" kind:cross_field_compare value:"rec_domain" |
yy | is_null | field:"yy" kind:is_null |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
rec_domain | extend |
s_domain | extend |
domain_age | extend |
yy | extend |
mm | extend |
dd | extend |
AccountCustomEntity | extend |