Detection rules › Kusto
Mimecast Targeted Threat Protection - Impersonation Protect
'Detects a maliciously tagged impersonation.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Collection |
Rule body
id: c048fa06-0d50-4626-ae82-a6cea812d9c4
name: Mimecast Targeted Threat Protection - Impersonation Protect
description: |
'Detects a maliciously tagged impersonation.'
severity: High
status: Available
requiredDataConnectors:
- connectorId: MimecastTTPAPI
dataTypes:
- MimecastTTPImpersonation
queryFrequency: 30m
queryPeriod: 30m
triggerOperator: gt
triggerThreshold: 0
tactics:
- Exfiltration
- Collection
- Discovery
relevantTechniques:
- T1114
query: |
MimecastTTPImpersonation
| where ['Tagged Malicious'] == true
| extend SenderAddress = ['Sender Address'],
SenderIPAddress = ['Sender IP Address'],
RecipientAddress = ['Recipient Address']
suppressionDuration: 5h
suppressionEnabled: false
incidentConfiguration:
createIncident: true
groupingConfiguration:
enabled: true
reopenClosedIncident: false
lookbackDuration: P7D
matchingMethod: AllEntities
eventGroupingSettings:
aggregationKind: AlertPerResult
entityMappings:
- entityType: MailMessage
fieldMappings:
- identifier: Sender
columnName: SenderAddress
- identifier: SenderIP
columnName: SenderIPAddress
- identifier: Recipient
columnName: RecipientAddress
version: 1.0.0
kind: Scheduled
Stages and Predicates
Stage 1: source
MimecastTTPImpersonation
Stage 2: where
| where ['Tagged Malicious'] == true
Stage 3: extend
| extend SenderAddress = ['Sender Address'],
SenderIPAddress = ['Sender IP Address'],
RecipientAddress = ['Recipient Address']
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Tagged Malicious | eq |
| field:"Tagged Malicious" kind:eq value:"true" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
RecipientAddress | extend |
SenderAddress | extend |
SenderIPAddress | extend |