Detection rules › Kusto
PRODAFT USTA - Non-expired payment card exposed
'Identifies a new PRODAFT USTA Payment Card Fraud Intelligence ticket that exposes a payment card whose expiration date is still in the future. A non-expired card is immediately usable for fraudulent transactions and is therefore higher risk than an already-expired card. The full card number is never stored - only the BIN, last 4 digits, brand, and length are retained. Prioritize reissue of the affected card with the issuing bank and monitor for fraudulent activity.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Impact |
Rule body
id: 674429c9-a858-436c-95b8-5808024ebd01
name: PRODAFT USTA - Non-expired payment card exposed
description: |
'Identifies a new PRODAFT USTA Payment Card Fraud Intelligence ticket that exposes a
payment card whose expiration date is still in the future. A non-expired card is
immediately usable for fraudulent transactions and is therefore higher risk than an
already-expired card. The full card number is never stored - only the BIN, last 4 digits,
brand, and length are retained. Prioritize reissue of the affected card with the issuing
bank and monitor for fraudulent activity.'
severity: High
status: Available
tactics:
- Impact
relevantTechniques:
- T1657
requiredDataConnectors:
- connectorId: PRODAFTUstaPCFICCPDefinition
dataTypes:
- PRODAFTUstaCompromisedCards_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
query: |
PRODAFTUstaCompromisedCards
| where Created > ago(1h)
| where ExpirationDate > now()
| project
TimeGenerated,
Created,
TicketId,
CompanyName,
CardBrand,
CardBin,
CardLast4,
CardMasked,
CardLength,
ExpirationDate,
Status
customDetails:
Ticket: TicketId
Company: CompanyName
Brand: CardBrand
Card: CardMasked
Expiration: ExpirationDate
Status: Status
incidentConfiguration:
createIncident: true
groupingConfiguration:
enabled: true
reopenClosedIncident: false
lookbackDuration: 1h
matchingMethod: AnyAlert
version: 1.0.0
kind: Scheduled
Stages and Predicates
Stage 1: source
PRODAFTUstaCompromisedCards
Stage 2: where
| where Created > ago(1h)
Stage 3: where
| where ExpirationDate > now()
Stage 4: project
| project
TimeGenerated,
Created,
TicketId,
CompanyName,
CardBrand,
CardBin,
CardLast4,
CardMasked,
CardLength,
ExpirationDate,
Status
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
CardBin | project |
CardBrand | project |
CardLast4 | project |
CardLength | project |
CardMasked | project |
CompanyName | project |
Created | project |
ExpirationDate | project |
Status | project |
TicketId | project |
TimeGenerated | project |