Detection rules › Kusto
Mimecast Targeted Threat Protection - Attachment Protect
'Detects a threat for an unsafe attachment in an email.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access |
Rule body
id: 617a55be-a8d8-49c1-8687-d19a0231056f
name: Mimecast Targeted Threat Protection - Attachment Protect
description: |
'Detects a threat for an unsafe attachment in an email.'
severity: High
status: Available
requiredDataConnectors:
- connectorId: MimecastTTPAPI
dataTypes:
- MimecastTTPAttachment
queryFrequency: 30m
queryPeriod: 30m
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
- Discovery
relevantTechniques:
- T0865
query: |
MimecastTTPAttachment
| where Result != "safe"
| extend SenderAddress = ['Sender Address'] ,RecipientAddress = ['Recipient Address']
suppressionDuration: 5h
suppressionEnabled: false
incidentConfiguration:
createIncident: true
groupingConfiguration:
enabled: true
reopenClosedIncident: false
lookbackDuration: P7D
matchingMethod: AllEntities
eventGroupingSettings:
aggregationKind: AlertPerResult
entityMappings:
- entityType: MailMessage
fieldMappings:
- identifier: Sender
columnName: SenderAddress
- identifier: Recipient
columnName: RecipientAddress
- identifier: Subject
columnName: Subject
version: 1.0.0
kind: Scheduled
Stages and Predicates
Stage 1: source
MimecastTTPAttachment
Stage 2: where
| where Result != "safe"
Stage 3: extend
| extend SenderAddress = ['Sender Address'] ,RecipientAddress = ['Recipient Address']
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Result | ne |
| field:"Result" kind:ne value:"safe" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
RecipientAddress | extend |
SenderAddress | extend |