Detection rules › Kusto

Malware Link Clicked

This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.

Status: available
Severity: medium
Time window: 1h
Group by: Recipient, Sender, SenderIPAddress, TimeClicked, TimeGenerated, URLClicked
Source: github.com/Azure/Azure-Sentinel

'This query identifies a user clicking on an email link whose threat category is classified as a malware'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1566.002` Phishing: Spearphishing Link

Rule body

id: 8675dd7a-795e-4d56-a79c-fc848c5ee61c
name: Malware Link Clicked
description: |
  'This query identifies a user clicking on an email link whose threat category is classified as a malware'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: ProofpointTAPv2
    dataTypes:
      - ProofPointTAPClicksPermittedV2_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1566.002
query: |
  ProofPointTAPClicksPermittedV2_CL
  | where classification =~ "malware"
  | where threatStatus != "cleared"
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by TimeGenerated, Sender = sender, SenderIPAddress = senderIP, Recipient = recipient, TimeClicked = clickTime, URLClicked = url
  | extend RecipientName = tostring(split(Recipient, "@")[0]), RecipientUPNSuffix = tostring(split(Recipient, "@")[1])
  | extend SenderName = tostring(split(Sender, "@")[0]), SenderUPNSuffix = tostring(split(Sender, "@")[1])
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: Recipient
      - identifier: Name
        columnName: RecipientName
      - identifier: UPNSuffix
        columnName: RecipientUPNSuffix
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: Sender
      - identifier: Name
        columnName: SenderName
      - identifier: UPNSuffix
        columnName: SenderUPNSuffix
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SenderIPAddress
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: URLClicked
version: 1.0.7
kind: Scheduled

Stages and Predicates

Stage 1: `source`

ProofPointTAPClicksPermittedV2_CL

Stage 2: `where`

| where classification =~ "malware"

Stage 3: `where`

| where threatStatus != "cleared"

Stage 4: `summarize`

| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by TimeGenerated, Sender = sender, SenderIPAddress = senderIP, Recipient = recipient, TimeClicked = clickTime, URLClicked = url

Stage 5: `extend`

| extend RecipientName = tostring(split(Recipient, "@")[0]), RecipientUPNSuffix = tostring(split(Recipient, "@")[1])

Stage 6: `extend`

| extend SenderName = tostring(split(Sender, "@")[0]), SenderUPNSuffix = tostring(split(Sender, "@")[1])

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`classification`	eq	`malware`	`field:"classification" kind:eq value:"malware"`
`threatStatus`	ne	`cleared`	`field:"threatStatus" kind:ne value:"cleared"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`EndTime`	`summarize`
`Recipient`	`summarize`
`Sender`	`summarize`
`SenderIPAddress`	`summarize`
`StartTime`	`summarize`
`TimeClicked`	`summarize`
`TimeGenerated`	`summarize`
`URLClicked`	`summarize`
`RecipientName`	`extend`
`RecipientUPNSuffix`	`extend`
`SenderName`	`extend`
`SenderUPNSuffix`	`extend`

Malware Link Clicked

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: summarize

Stage 5: extend

Stage 6: extend