Detection rules › Kusto
Mimecast Secure Email Gateway - Impersonation Protect
'Detects threats from impersonation mail under targeted threat protection.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Collection |
Rule body
id: 2ef77cef-439f-4d94-848f-3eca67510d2f
name: Mimecast Secure Email Gateway - Impersonation Protect
description: |
'Detects threats from impersonation mail under targeted threat protection.'
severity: High
status: Available
requiredDataConnectors:
- connectorId: MimecastSEGAPI
dataTypes:
- MimecastCG
enabled: true
queryFrequency: 15m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
tactics:
- Discovery
- LateralMovement
- Collection
relevantTechniques:
- T1114
query: |
MimecastCG
| where Type == "email_ttp_impersonation"
| extend SenderEnvelope = ['Sender Envelope'] , SenderIp = ['Sender IP']
suppressionDuration: 5h
suppressionEnabled: false
incidentConfiguration:
createIncident: true
groupingConfiguration:
enabled: true
reopenClosedIncident: false
lookbackDuration: P7D
matchingMethod: AllEntities
eventGroupingSettings:
aggregationKind: AlertPerResult
entityMappings:
- entityType: MailMessage
fieldMappings:
- identifier: Sender
columnName: SenderEnvelope
- identifier: SenderIP
columnName: SenderIp
- identifier: Recipient
columnName: Recipients
version: 1.0.0
kind: Scheduled
Stages and Predicates
Stage 1: source
MimecastCG
Stage 2: where
| where Type == "email_ttp_impersonation"
Stage 3: extend
| extend SenderEnvelope = ['Sender Envelope'] , SenderIp = ['Sender IP']
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Type | eq |
| field:"Type" kind:eq value:"email_ttp_impersonation" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
SenderEnvelope | extend |
SenderIp | extend |