detection.wiki

Detection rules › Kusto

Mimecast Secure Email Gateway - AV

Status
available
Severity
informational
Time window
15m
Source
github.com/Azure/Azure-Sentinel

'Detects threats from email anti virus scan.'

MITRE ATT&CK coverage

TacticTechniques
Execution

Rule body

id: 33bf0cc9-e568-42bf-9571-c22adf7be66d
name: Mimecast Secure Email Gateway - AV
description: |
  'Detects threats from email anti virus scan.'
severity: Informational
status: Available
requiredDataConnectors:
  - connectorId: MimecastSEGAPI
    dataTypes:
      - MimecastCG
enabled: true
queryFrequency: 15m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
tactics:
- Execution
relevantTechniques:
- T1053
query: |
  MimecastCG
  | where Type == "email_antivirus"
  | extend  SenderEnvelope = ['Sender Envelope'] 
suppressionDuration: 5h
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: P7D
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: AlertPerResult
entityMappings:
- entityType: MailMessage
  fieldMappings:
  - identifier: Sender
    columnName: SenderEnvelope
  - identifier: Recipient
    columnName: Recipients
  - identifier: Subject
    columnName: Subject
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: source

MimecastCG

Stage 2: where

| where Type == "email_antivirus"

Stage 3: extend

| extend  SenderEnvelope = ['Sender Envelope']

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
Typeeq
  • email_antivirus
field:"Type" kind:eq value:"email_antivirus"

Output fields

These fields are emitted when the rule matches.

FieldSource
SenderEnvelopeextend