Detection rules › Kusto
Corelight - SMTP Email containing NON Ascii Characters within the Subject
'Detects where an emails contain non ascii characters within the Subject.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access |
Rule body
id: 50c61708-9824-46f3-87cf-22490796fae2
name: Corelight - SMTP Email containing NON Ascii Characters within the Subject
description: |
'Detects where an emails contain non ascii characters within the Subject.'
severity: Low
status: Available
requiredDataConnectors:
- connectorId: Corelight
dataTypes:
- Corelight_v2_smtp
- corelight_smtp
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
relevantTechniques:
- T1566
query: |
corelight_smtp
| where subject hasprefix @'\=?utf-16'
| summarize recipients = dcount(_to)
| extend k = 1
| join (corelight_smtp
| where subject hasprefix @'\=?utf-16'
| summarize by _to
| extend k = 1) on k
| where recipients > 1
entityMappings:
- entityType: MailMessage
fieldMappings:
- identifier: Recipient
columnName: _to
version: 2.1.0
kind: Scheduled
Stages and Predicates
Stage 1: source
corelight_smtp
Stage 2: where
| where subject hasprefix @'\=?utf-16'
Stage 3: summarize
| summarize recipients = dcount(_to)
Stage 4: extend
| extend k = 1
Stage 5: join
| join (corelight_smtp
| where subject hasprefix @'\=?utf-16'
| summarize by _to
| extend k = 1) on k
Stage 6: where
| where recipients > 1
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
recipients | gt |
| field:"recipients" kind:gt value:"1" |
subject | starts_with |
| field:"subject" kind:starts_with value:"\=?utf-16" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
recipients | summarize |
k | extend |