Detection rules › Kusto
Detect external user sending suspicious link to multiple users
An external sender suddenly sending the same link to multiple internal users, can indicate that external user being compromised and used for BEC Attacks. In these kind of attacks compromised accounts are used to send phishing links or attachments to users in business relationships.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access |
References
Telemetry coverage
Rule body
// External user sending same link to multiple users via Teams
let threshold = 5;
MessageEvents
| where TimeGenerated > ago(1d)
// Focus on chat messsages
| where ThreadType == "chat"
// Only return external users sending messages
| join kind=leftanti (
IdentityInfo
| where TimeGenerated > ago(14d)
| distinct AccountObjectId
) on $left.SenderObjectId == $right.AccountObjectId
// Only flag messages with Teams Links
| join kind=inner MessageUrlInfo on TeamsMessageId
// Exclude teams file thumbnails
| where Url !~ "http://dummy.jpg/"
// Make a set of the chats a user sends a specific URL to
| summarize ChatSet = make_set(ThreadId) by SenderEmailAddress, Url
// Count the amount of chats
| extend ChatCount = array_length(ChatSet)
| where ChatCount > threshold
Stages and Predicates
Parameters
let threshold = 5;
Stage 1: source
MessageEvents
Stage 2: where
| where TimeGenerated > ago(1d)
Stage 3: where
| where ThreadType == "chat"
Stage 4: join (negated)
| join kind=leftanti (
IdentityInfo
| where TimeGenerated > ago(14d)
| distinct AccountObjectId
) on $left.SenderObjectId == $right.AccountObjectId
Stage 5: join
| join kind=inner MessageUrlInfo on TeamsMessageId
Stage 6: where
| where Url !~ "http://dummy.jpg/"
Stage 7: summarize
| summarize ChatSet = make_set(ThreadId) by SenderEmailAddress, Url
Stage 8: extend
| extend ChatCount = array_length(ChatSet)
Stage 9: where
| where ChatCount > threshold
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ChatCount | gt |
| field:"ChatCount" kind:gt value:"5" |
ThreadType | eq |
| field:"ThreadType" kind:eq value:"chat" |
Url | ne |
| field:"Url" kind:ne value:"http://dummy.jpg/" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
ChatSet | summarize |
SenderEmailAddress | summarize |
Url | summarize |
ChatCount | extend |