Detection rules › Kusto

Mimecast Secure Email Gateway - Impersonation Protect

Status
available
Severity
high
Time window
15m
Source
github.com/Azure/Azure-Sentinel

'Detects threats from impersonation mail under targeted threat protection.'

MITRE ATT&CK coverage

TacticTechniques
Collection

Rule body

id: 2ef77cef-439f-4d94-848f-3eca67510d2f
name: Mimecast Secure Email Gateway - Impersonation Protect
description: |
  'Detects threats from impersonation mail under targeted threat protection.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: MimecastSEGAPI
    dataTypes:
      - MimecastCG
enabled: true
queryFrequency: 15m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
tactics:
- Discovery
- LateralMovement
- Collection
relevantTechniques:
- T1114
query: |
  MimecastCG
  | where Type == "email_ttp_impersonation"
  | extend  SenderEnvelope = ['Sender Envelope'] , SenderIp = ['Sender IP']
suppressionDuration: 5h
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: P7D
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: AlertPerResult
entityMappings:
- entityType: MailMessage
  fieldMappings:
  - identifier: Sender
    columnName: SenderEnvelope
  - identifier: SenderIP
    columnName: SenderIp
  - identifier: Recipient
    columnName: Recipients
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: source

MimecastCG

Stage 2: where

| where Type == "email_ttp_impersonation"

Stage 3: extend

| extend  SenderEnvelope = ['Sender Envelope'] , SenderIp = ['Sender IP']

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
Typeeq
  • email_ttp_impersonation
field:"Type" kind:eq value:"email_ttp_impersonation"

Output fields

These fields are emitted when the rule matches.

FieldSource
SenderEnvelopeextend
SenderIpextend