Detection rules › Kusto
Mimecast Secure Email Gateway - URL Protect
Detect threat when potentially malicious url found
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access |
Rule body
id: ea19dae6-bbb3-4444-a1b8-8e9ae6064aab
name: Mimecast Secure Email Gateway - URL Protect
description: Detect threat when potentially malicious url found
severity: High
requiredDataConnectors:
- connectorId: MimecastSIEMAPI
dataTypes:
- MimecastSIEM_CL
enabled: true
query: MimecastSIEM_CL| where mimecastEventId_s=="mail_ttp_url" and reason_s != "clean"
queryFrequency: 5m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
suppressionDuration: 5h
suppressionEnabled: false
tactics:
- InitialAccess
- Discovery
- Execution
relevantTechniques:
- T1566
incidentConfiguration:
createIncident: true
groupingConfiguration:
enabled: true
reopenClosedIncident: false
lookbackDuration: 1d
matchingMethod: AllEntities
eventGroupingSettings:
aggregationKind: SingleAlert
customDetails:
senderDomain: senderDomain_s
credentialTheft: credentialTheft_s
urlCategory: urlCategory_s
action: action_s
url: url_s
MsgId_s: msgid_s
route: route_s
SourceIP: SourceIP
reason: reason_s
entityMappings:
- entityType: MailMessage
fieldMappings:
- identifier: Sender
columnName: sender_s
- identifier: Recipient
columnName: recipient_s
- identifier: Subject
columnName: subject_s
version: 1.0.1
kind: Scheduled
Stages and Predicates
Stage 1: source
MimecastSIEM_CL
Stage 2: where
| where mimecastEventId_s=="mail_ttp_url" and reason_s != "clean"
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
mimecastEventId_s | eq |
| field:"mimecastEventId_s" kind:eq value:"mail_ttp_url" |
reason_s | ne |
| field:"reason_s" kind:ne value:"clean" |