Detection rules › Kusto
Preview - TI map Email entity to Cloud App Events
Identifies compromises and attacks and detect malicious activities in one's email entity from TI
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access |
Telemetry coverage
| Platform | Record / event type |
|---|---|
| Microsoft Defender for Endpoint | CloudAppEvents action any: Cloud app activity |
Rule body
id: 47b9bb10-d216-4359-8cef-08ca2c67e5be
name: Preview - TI map Email entity to Cloud App Events
description: |
'Identifies compromises and attacks and detect malicious activities in one's email entity from TI'
severity: Medium
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
dataTypes:
- CloudAppEvents
- connectorId: MicrosoftDefenderThreatIntelligence
dataTypes:
- ThreatIntelligenceIndicator
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
relevantTechniques:
- T1566
query: |
let dt_lookBack = 10d;
let ioc_lookBack = 30d;
let emailregex = @'^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+$';
ThreatIntelligenceIndicator
| where TimeGenerated >= ago(ioc_lookBack)
| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
| where Active == true and ExpirationDateTime > now()
| where isnotempty(EmailSenderAddress)
| join kind=innerunique (CloudAppEvents
| extend User_Id = tostring(RawEventData.UserId)
| where isnotempty(User_Id)
| where TimeGenerated >= ago(dt_lookBack) and isnotempty(Application)
| extend CloudAppEvents_TimeGenerated = TimeGenerated
| where User_Id matches regex emailregex) on $left.EmailSenderAddress == $right.User_Id
| where CloudAppEvents_TimeGenerated < ExpirationDateTime
| summarize CloudAppEvents_TimeGenerated = argmax(CloudAppEvents_TimeGenerated, *) by IndicatorId, User_Id
| extend Name = tostring(split(User_Id, '@', 0)[0]), UPNSuffix = tostring(split(User_Id, '@', 1)[0])
| extend timestamp = CloudAppEvents_TimeGenerated
entityMappings:
- entityType: Account
fieldMappings:
- identifier: DisplayName
columnName: Name
- identifier: FullName
columnName: User_Id
- identifier: UPNSuffix
columnName: UPNSuffix
version: 1.0.3
kind: Scheduled
Stages and Predicates
Parameters
let dt_lookBack = 10d;
let ioc_lookBack = 30d;
let emailregex = @'^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+$';
Stage 1: source
ThreatIntelligenceIndicator
Stage 2: where
| where TimeGenerated >= ago(ioc_lookBack)
Stage 3: summarize
| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
Stage 4: where
| where Active == true and ExpirationDateTime > now()
Stage 5: where
| where isnotempty(EmailSenderAddress)
Stage 6: join
| join kind=innerunique (CloudAppEvents
| extend User_Id = tostring(RawEventData.UserId)
| where isnotempty(User_Id)
| where TimeGenerated >= ago(dt_lookBack) and isnotempty(Application)
| extend CloudAppEvents_TimeGenerated = TimeGenerated
| where User_Id matches regex emailregex) on $left.EmailSenderAddress == $right.User_Id
Stage 7: where
| where CloudAppEvents_TimeGenerated < ExpirationDateTime
Stage 8: summarize
| summarize CloudAppEvents_TimeGenerated = argmax(CloudAppEvents_TimeGenerated, *) by IndicatorId, User_Id
Stage 9: extend
| extend Name = tostring(split(User_Id, '@', 0)[0]), UPNSuffix = tostring(split(User_Id, '@', 1)[0])
Stage 10: extend
| extend timestamp = CloudAppEvents_TimeGenerated
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Active | eq |
| field:"Active" kind:eq value:"true" |
Application | is_not_null | field:"Image" kind:is_not_null | |
CloudAppEvents_TimeGenerated | cross_field_compare |
| field:"CloudAppEvents_TimeGenerated" kind:cross_field_compare value:"ExpirationDateTime" |
EmailSenderAddress | is_not_null | field:"EmailSenderAddress" kind:is_not_null | |
User_Id | is_not_null | field:"User_Id" kind:is_not_null | |
User_Id | regex_match |
| field:"User_Id" kind:regex_match value:"^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+.[a-zA-Z0-9-.]+$" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
CloudAppEvents_TimeGenerated | summarize |
IndicatorId | summarize |
User_Id | summarize |
Name | extend |
UPNSuffix | extend |
timestamp | extend |