Detection rules › Kusto
Egress Defend - Dangerous Link Click
'Defend has detected a user has clicked a dangerous link in their mailbox.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | |
| Execution |
Rule body
id: a896123e-03a5-4a4d-a7e3-fd814846dfb2
name: Egress Defend - Dangerous Link Click
description: |
'Defend has detected a user has clicked a dangerous link in their mailbox.'
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: EgressDefend
dataTypes:
- EgressDefend_CL
queryFrequency: 30m
queryPeriod: 30m
triggerOperator: gt
triggerThreshold: 0
tactics:
- Execution
relevantTechniques:
- T1204
- T0853
tags:
- Defend
query: |
DefendAuditData
| where LinksClicked > 0
| where ThreatLevel == "dangerous" or ThreatLevel == "suspicious"
| extend Account_0_FullName = trim(@"[^@.\w]+",Recipients)
entityMappings:
- entityType: Account
fieldMappings:
- identifier: FullName
columnName: Account_0_FullName
- entityType: IP
fieldMappings:
- identifier: Address
columnName: SenderIP
- entityType: URL
fieldMappings:
- identifier: Url
columnName: Url
- entityType: Mailbox
fieldMappings:
- identifier: MailboxPrimaryAddress
columnName: Account_0_FullName
customDetails:
DefendSenderIP: SenderIP
DefendSender: From
timesClicked: LinksClicked
alertDetailsOverride:
alertDisplayNameFormat: Alert - {{Account_0_FullName}} as clicked a suspicious link.
version: 1.0.0
kind: Scheduled
Stages and Predicates
Stage 1: source
DefendAuditData
Stage 2: where
| where LinksClicked > 0
Stage 3: where
| where ThreatLevel == "dangerous" or ThreatLevel == "suspicious"
Stage 4: extend
| extend Account_0_FullName = trim(@"[^@.\w]+",Recipients)
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
LinksClicked | gt |
| field:"LinksClicked" kind:gt value:"0" |
ThreatLevel | eq |
| field:"ThreatLevel" kind:eq |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
Account_0_FullName | extend |