PRODAFT USTA - Corporate credential compromised

Status: available
Severity: high
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

'Identifies a new PRODAFT USTA Account Takeover Prevention ticket that exposes a corporate credential (IsCorporate = true). These typically originate from infostealer infections on a victim host and indicate that a valid corporate identity may be available to threat actors. Investigate the affected account, reset credentials, and review the victim host for malware.'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts
Credential Access	`T1555` Credentials from Password Stores

Rule body

id: 9ad6cf22-ffbb-4422-9933-9bbd0104f818
name: PRODAFT USTA - Corporate credential compromised
description: |
  'Identifies a new PRODAFT USTA Account Takeover Prevention ticket that exposes a
  corporate credential (IsCorporate = true). These typically originate from infostealer
  infections on a victim host and indicate that a valid corporate identity may be
  available to threat actors. Investigate the affected account, reset credentials, and
  review the victim host for malware.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: PRODAFTUstaATPCCPDefinition
    dataTypes:
      - PRODAFTUstaCompromisedCredentials_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CredentialAccess
  - InitialAccess
relevantTechniques:
  - T1555
  - T1078
query: |
  PRODAFTUstaCompromisedCredentials
  | where Created > ago(1h)
  | where IsCorporate == true
  | project
      TimeGenerated,
      Created,
      TicketId,
      CompanyName,
      Username,
      Url,
      Source,
      PasswordScore,
      VictimComputerName,
      VictimOs,
      VictimCountry,
      VictimIp,
      VictimMalware,
      InfectionDate,
      Status
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: Username
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: VictimComputerName
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: VictimIp
customDetails:
  Ticket: TicketId
  Company: CompanyName
  Malware: VictimMalware
  Source: Source
  PasswordScore: PasswordScore
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1h
    matchingMethod: Selected
    groupByEntities:
      - Account
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

PRODAFTUstaCompromisedCredentials

Stage 2: `where`

| where Created > ago(1h)

Stage 3: `where`

| where IsCorporate == true

Stage 4: `project`

| project
    TimeGenerated,
    Created,
    TicketId,
    CompanyName,
    Username,
    Url,
    Source,
    PasswordScore,
    VictimComputerName,
    VictimOs,
    VictimCountry,
    VictimIp,
    VictimMalware,
    InfectionDate,
    Status

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`IsCorporate`	eq	`true`	`field:"IsCorporate" kind:eq value:"true"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`CompanyName`	`project`
`Created`	`project`
`InfectionDate`	`project`
`PasswordScore`	`project`
`Source`	`project`
`Status`	`project`
`TicketId`	`project`
`TimeGenerated`	`project`
`Url`	`project`
`Username`	`project`
`VictimComputerName`	`project`
`VictimCountry`	`project`
`VictimIp`	`project`
`VictimMalware`	`project`
`VictimOs`	`project`