Detection rules › Kusto
Malware attachment delivered
This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.
'This query identifies a message containing a malware attachment that was delivered.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access |
Rule body
id: 0558155e-4556-447e-9a22-828f2a7de06b
name: Malware attachment delivered
description: |
'This query identifies a message containing a malware attachment that was delivered.'
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: ProofpointTAPv2
dataTypes:
- ProofPointTAPMessagesDeliveredV2_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
relevantTechniques:
- T1566.001
query: |
ProofPointTAPMessagesDeliveredV2_CL
| mv-expand todynamic(threatsInfoMap)
| mv-expand todynamic(messageParts)
| extend threatType = tostring(threatsInfoMap.threatType), classification = tostring(threatsInfoMap.classification)
| extend filename = tostring(messageParts.filename)
| where threatType =~ "attachment" and classification =~ "malware"
| summarize filenames = make_set(filename), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by TimeGenerated, Sender = sender, SenderIPAddress = senderIP, Recipient = tostring(recipient), threatType, classification, Subject = subject
| mv-expand todynamic(Recipient)
| extend RecipientName = tostring(split(Recipient, "@")[0]), RecipientUPNSuffix = tostring(split(Recipient, "@")[1])
| extend SenderName = tostring(split(Sender, "@")[0]), SenderUPNSuffix = tostring(split(Sender, "@")[1])
entityMappings:
- entityType: Account
fieldMappings:
- identifier: FullName
columnName: Recipient
- identifier: Name
columnName: RecipientName
- identifier: UPNSuffix
columnName: RecipientUPNSuffix
- entityType: Account
fieldMappings:
- identifier: FullName
columnName: Sender
- identifier: Name
columnName: SenderName
- identifier: UPNSuffix
columnName: SenderUPNSuffix
- entityType: IP
fieldMappings:
- identifier: Address
columnName: SenderIPAddress
version: 1.0.6
kind: Scheduled
Stages and Predicates
Stage 1: source
ProofPointTAPMessagesDeliveredV2_CL
Stage 2: mv-expand
| mv-expand todynamic(threatsInfoMap)
Stage 3: mv-expand
| mv-expand todynamic(messageParts)
Stage 4: extend
| extend threatType = tostring(threatsInfoMap.threatType), classification = tostring(threatsInfoMap.classification)
Stage 5: extend
| extend filename = tostring(messageParts.filename)
Stage 6: where
| where threatType =~ "attachment" and classification =~ "malware"
Stage 7: summarize
| summarize filenames = make_set(filename), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by TimeGenerated, Sender = sender, SenderIPAddress = senderIP, Recipient = tostring(recipient), threatType, classification, Subject = subject
Stage 8: mv-expand
| mv-expand todynamic(Recipient)
Stage 9: extend
| extend RecipientName = tostring(split(Recipient, "@")[0]), RecipientUPNSuffix = tostring(split(Recipient, "@")[1])
Stage 10: extend
| extend SenderName = tostring(split(Sender, "@")[0]), SenderUPNSuffix = tostring(split(Sender, "@")[1])
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
classification | eq |
| field:"classification" kind:eq value:"malware" |
threatType | eq |
| field:"threatType" kind:eq value:"attachment" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
EndTime | summarize |
Recipient | summarize |
Sender | summarize |
SenderIPAddress | summarize |
StartTime | summarize |
Subject | summarize |
TimeGenerated | summarize |
classification | summarize |
filenames | summarize |
threatType | summarize |
RecipientName | extend |
RecipientUPNSuffix | extend |
SenderName | extend |
SenderUPNSuffix | extend |