detection.wiki

Detection rules › Kusto

Mimecast Secure Email Gateway - Virus

Status
available
Severity
informational
Time window
15m
Source
github.com/Azure/Azure-Sentinel

'Detect threat for virus from mail receipt virus event.'

MITRE ATT&CK coverage

TacticTechniques
Execution

Rule body

id: d78d7352-fa5a-47d4-b48f-cb2c3252c0eb
name: Mimecast Secure Email Gateway - Virus
description: |
  'Detect threat for virus from mail receipt virus event.'
severity: Informational
status: Available
requiredDataConnectors:
  - connectorId: MimecastSEGAPI
    dataTypes:
      - MimecastCG
enabled: true
queryFrequency: 15m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
tactics:
- Execution
relevantTechniques:
- T1053
query: |
  MimecastCG
  | where Type == "email_receipt" and isnotempty(['Virus Found'])
  | extend  SenderEnvelope = ['Sender Envelope']
suppressionDuration: 5h
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: P7D
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: AlertPerResult
entityMappings:
- entityType: MailMessage
  fieldMappings:
  - identifier: Sender
    columnName: SenderEnvelope
  - identifier: Recipient
    columnName: Recipients
  - identifier: Subject
    columnName: Subject
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: source

MimecastCG

Stage 2: where

| where Type == "email_receipt" and isnotempty(['Virus Found'])

Stage 3: extend

| extend  SenderEnvelope = ['Sender Envelope']

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
Typeeq
  • email_receipt
field:"Type" kind:eq value:"email_receipt"
Virus Foundis_not_null
  • (no value, null check)
field:"Virus Found" kind:is_not_null

Output fields

These fields are emitted when the rule matches.

FieldSource
SenderEnvelopeextend