detection.wiki

Detection rules › Kusto

VIP Mailbox manipulation

Status
available
Severity
medium
Time window
1h
Source
github.com/Azure/Azure-Sentinel

'Alert if a cmdlet that can be translated to data exfiltration or mailbox access is executed on a VIP Mailbox.'

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1098 Account Manipulation
CollectionT1114 Email Collection
ExfiltrationT1020 Automated Exfiltration

Rule body kusto

id: 5170c3c4-b8c9-485c-910d-a21d965ee181
name: VIP Mailbox manipulation
description: |
  'Alert if a cmdlet that can be translated to data exfiltration or mailbox access is executed on a VIP Mailbox.'
requiredDataConnectors:
  - connectorId: ESI-ExchangeAdminAuditLogEvents
    dataTypes:
      - Event
severity: Medium
queryFrequency: 30m
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
status: Available
tactics:
  - Exfiltration
  - Persistence
  - Collection
relevantTechniques:
  - T1020
  - T1098
  - T1114
query: |
  let VIPRestriction = "on";
  ExchangeAdminAuditLogs
  | where IsVIP or VIPRestriction =~ "off"
  | where UserOriented =~ 'Yes' and IsSensitive and ((IsRestrictedCmdLet and IsSenstiveCmdletParameters) or IsRestrictedCmdLet == false)
  | extend Level = iif (Status == "Failure", "Medium", "High")
entityMappings:
- entityType: Mailbox
  fieldMappings:
    - identifier: MailboxPrimaryAddress
      columnName: TargetObject
- entityType: Host
  fieldMappings:
    - identifier: FullName
      columnName: Computer
- entityType: Account
  fieldMappings:
    - identifier: Sid
      columnName: TargetObject
    - identifier: ObjectGuid
      columnName: TargetObject
    - identifier: FullName
      columnName: TargetObject
- entityType: Account
  fieldMappings:
    - identifier: Name
      columnName: Caller
alertDetailsOverride:
  alertDisplayNameFormat: "{{CmdletName}} executed on {{TargetObject}}"
  alertDescriptionFormat: "Alert from Microsoft Exchange Security as {{CmdletName}} with parameters {{CmdletParameters}} was executed on {{TargetObject}}"
  alertSeverityColumnName: Level 
version: 1.2.0
kind: Scheduled

Stages and Predicates

Parameters

let VIPRestriction = "on";

Stage 1: source

ExchangeAdminAuditLogs

Stage 2: where

| where IsVIP or VIPRestriction =~ "off"

Stage 3: where

| where UserOriented =~ 'Yes' and IsSensitive and ((IsRestrictedCmdLet and IsSenstiveCmdletParameters) or IsRestrictedCmdLet == false)

Stage 4: extend

| extend Level = iif (Status == "Failure", "Medium", "High")

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
IsRestrictedCmdLeteq
  • false transforms: cased
UserOrientedeq
  • Yes

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
Levelextend