Detection rules › Kusto
Mimecast Secure Email Gateway - Attachment Protect
'Detect threat for mail attachment under the targeted threat protection.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | |
| Collection | |
| Initial Access |
Rule body
id: 72bd7b0c-493c-4fa5-8a95-7f6376b6cfb2
name: Mimecast Secure Email Gateway - Attachment Protect
description: |
'Detect threat for mail attachment under the targeted threat protection.'
severity: High
status: Available
requiredDataConnectors:
- connectorId: MimecastSEGAPI
dataTypes:
- MimecastCG
enabled: true
queryFrequency: 15m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
tactics:
- Collection
- Exfiltration
- Discovery
- InitialAccess
- Execution
relevantTechniques:
- T1114
- T1566
- T0865
query: |
MimecastCG
| where Type == "email_ttp_ap"
| extend SenderEnvelope = ['Sender Envelope'] , SenderIp = ['Sender IP']
suppressionDuration: 5h
suppressionEnabled: false
incidentConfiguration:
createIncident: true
groupingConfiguration:
enabled: true
reopenClosedIncident: false
lookbackDuration: P7D
matchingMethod: AllEntities
eventGroupingSettings:
aggregationKind: AlertPerResult
entityMappings:
- entityType: MailMessage
fieldMappings:
- identifier: Sender
columnName: SenderEnvelope
- identifier: Recipient
columnName: Recipients
- identifier: Subject
columnName: Subject
- entityType: IP
fieldMappings:
- identifier: Address
columnName: SenderIp
version: 1.0.0
kind: Scheduled
Stages and Predicates
Stage 1: source
MimecastCG
Stage 2: where
| where Type == "email_ttp_ap"
Stage 3: extend
| extend SenderEnvelope = ['Sender Envelope'] , SenderIp = ['Sender IP']
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Type | eq |
| field:"Type" kind:eq value:"email_ttp_ap" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
SenderEnvelope | extend |
SenderIp | extend |