detection.wiki

Detection rules › Kusto

Mimecast Secure Email Gateway - URL Protect

Status
available
Severity
high
Time window
15m
Source
github.com/Azure/Azure-Sentinel

'Detect threat when potentially malicious url found.'

MITRE ATT&CK coverage

TacticTechniques
Initial Access

Rule body

id: 80f244cd-b0d6-404e-9aed-37f7a66eda9f
name: Mimecast Secure Email Gateway - URL Protect
description: |
  'Detect threat when potentially malicious url found.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: MimecastSEGAPI
    dataTypes:
      - MimecastCG
enabled: true
queryFrequency: 15m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
- Discovery
- Execution
relevantTechniques:
- T1566
query: |
  MimecastCG
  | where Type == "email_ttp_url"
  | extend  SenderEnvelope = ['Sender Envelope']
suppressionDuration: 5h
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: P7D
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: AlertPerResult
entityMappings:
- entityType: MailMessage
  fieldMappings:
  - identifier: Sender
    columnName: SenderEnvelope
  - identifier: Recipient
    columnName: Recipients
  - identifier: Subject
    columnName: Subject
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: source

MimecastCG

Stage 2: where

| where Type == "email_ttp_url"

Stage 3: extend

| extend  SenderEnvelope = ['Sender Envelope']

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
Typeeq
  • email_ttp_url
field:"Type" kind:eq value:"email_ttp_url"

Output fields

These fields are emitted when the rule matches.

FieldSource
SenderEnvelopeextend