HoneyLabs TI Map URL Entity to CommonSecurityLog

Severity: high
Time window: 14d
Group by: Id, RequestURL, TI_urlEntity
Source: github.com/Azure/Azure-Sentinel

'Identifies requests in CommonSecurityLog to malware loader or command-and-control URLs that HoneyLabs pulled out of payloads captured by its honeypot sensors. A hit usually means a host inside your estate reached out to attacker-controlled infrastructure, so treat it as post-compromise until proven otherwise. Indicator Confidence reflects how much evidence HoneyLabs holds (90 = 100+ observed attacks, 60 = a single sighting); raise the threshold in the query to trade coverage for precision.'

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1071` Application Layer Protocol `T1105` Ingress Tool Transfer

Rule body

id: afe2a5ff-f4fe-4dee-8b6b-fd28d29d6738
name: HoneyLabs TI Map URL Entity to CommonSecurityLog
version: 1.0.0
kind: Scheduled
description: |
  'Identifies requests in CommonSecurityLog to malware loader or command-and-control URLs that HoneyLabs pulled out of payloads captured by its honeypot sensors. A hit usually means a host inside your estate reached out to attacker-controlled infrastructure, so treat it as post-compromise until proven otherwise. Indicator Confidence reflects how much evidence HoneyLabs holds (90 = 100+ observed attacks, 60 = a single sighting); raise the threshold in the query to trade coverage for precision.'
severity: High
requiredDataConnectors:
  - connectorId: ThreatIntelligenceTaxii
    dataTypes:
      - ThreatIntelligenceIndicator
  - connectorId: CEF
    dataTypes:
      - CommonSecurityLog
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CommandAndControl
  - Execution
relevantTechniques:
  - T1071
  - T1105
query: |
  let dt_lookBack = 1h;
  let ioc_lookBack = 14d;
  let HoneyLabs_URLs = ThreatIntelIndicators
    | where TimeGenerated >= ago(ioc_lookBack)
    | where IsActive == true and ValidUntil > now()
    | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
    | where SourceSystem startswith 'HoneyLabs'
    | where ObservableKey == 'url:value'
    | extend TI_urlEntity = tostring(ObservableValue),
             HoneyLabsConfidence = Confidence,
             IndicatorDescription = tostring(Data.description);
  HoneyLabs_URLs
  | join kind=innerunique (
      CommonSecurityLog
      | where TimeGenerated >= ago(dt_lookBack)
      | where isnotempty(RequestURL)
      | extend CommonSecurityLog_TimeGenerated = TimeGenerated
  ) on $left.TI_urlEntity == $right.RequestURL
  | where CommonSecurityLog_TimeGenerated < ValidUntil
  | summarize CommonSecurityLog_TimeGenerated = arg_max(CommonSecurityLog_TimeGenerated, *) by Id, TI_urlEntity
  | project CommonSecurityLog_TimeGenerated, IndicatorDescription, Id, ValidUntil,
    HoneyLabsConfidence, TI_urlEntity, SourceIP, DestinationIP, DeviceName, DeviceAction,
    SourceUserName, RequestClientApplication
  | extend timestamp = CommonSecurityLog_TimeGenerated
entityMappings:
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: TI_urlEntity
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIP

Stages and Predicates

Parameters

let dt_lookBack = 1h;
let ioc_lookBack = 14d;

let HoneyLabs_URLs is inlined into the numbered stages below.

Stages 1 to 7 define let HoneyLabs_URLs (the rule's main pipeline source); stages 8 to 12 run on it.

Stage 1: `source`

ThreatIntelIndicators

Stage 2: `where`

| where TimeGenerated >= ago(ioc_lookBack)

Stage 3: `where`

| where IsActive == true and ValidUntil > now()

Stage 4: `summarize`

| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id

Stage 5: `where`

| where SourceSystem startswith 'HoneyLabs'

Stage 6: `where`

| where ObservableKey == 'url:value'

Stage 7: `extend`

| extend TI_urlEntity = tostring(ObservableValue),
           HoneyLabsConfidence = Confidence,
           IndicatorDescription = tostring(Data.description)

Stage 8: `join`

HoneyLabs_URLs
| join kind=innerunique (
    CommonSecurityLog
    | where TimeGenerated >= ago(dt_lookBack)
    | where isnotempty(RequestURL)
    | extend CommonSecurityLog_TimeGenerated = TimeGenerated
) on $left.TI_urlEntity == $right.RequestURL

Stage 9: `where`

| where CommonSecurityLog_TimeGenerated < ValidUntil

Stage 10: `summarize`

| summarize CommonSecurityLog_TimeGenerated = arg_max(CommonSecurityLog_TimeGenerated, *) by Id, TI_urlEntity

Stage 11: `project`

| project CommonSecurityLog_TimeGenerated, IndicatorDescription, Id, ValidUntil,
  HoneyLabsConfidence, TI_urlEntity, SourceIP, DestinationIP, DeviceName, DeviceAction,
  SourceUserName, RequestClientApplication

Stage 12: `extend`

| extend timestamp = CommonSecurityLog_TimeGenerated

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommonSecurityLog_TimeGenerated`	cross_field_compare	`ValidUntil` transforms: `op:lt`	`field:"CommonSecurityLog_TimeGenerated" kind:cross_field_compare value:"ValidUntil"`
`IsActive`	eq	`true`	`field:"IsActive" kind:eq value:"true"`
`ObservableKey`	eq	`url:value`	`field:"ObservableKey" kind:eq value:"url:value"`
`RequestURL`	is_not_null	(no value, null check)	`field:"RequestURL" kind:is_not_null`
`SourceSystem`	starts_with	`HoneyLabs`	`field:"SourceSystem" kind:starts_with value:"HoneyLabs"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`CommonSecurityLog_TimeGenerated`	`project`
`DestinationIP`	`project`
`DeviceAction`	`project`
`DeviceName`	`project`
`HoneyLabsConfidence`	`project`
`Id`	`project`
`IndicatorDescription`	`project`
`RequestClientApplication`	`project`
`SourceIP`	`project`
`SourceUserName`	`project`
`TI_urlEntity`	`project`
`ValidUntil`	`project`
`timestamp`	`extend`

HoneyLabs TI Map URL Entity to CommonSecurityLog

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: summarize

Stage 5: where

Stage 6: where

Stage 7: extend

Stage 8: join

Stage 9: where

Stage 10: summarize

Stage 11: project

Stage 12: extend