PRODAFT USTA - Payment card exposed

Status: available
Severity: medium
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

'Identifies a new PRODAFT USTA Payment Card Fraud Intelligence ticket that exposes a compromised payment card belonging to the monitored company. These typically originate from card breaches, skimmers, or infostealer infections and indicate that a payment card may be available to fraudsters. The full card number is never stored - only the BIN, last 4 digits, brand, and length are retained. Investigate the exposure and, where the card is your own, coordinate reissue with the issuing bank.'

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1657` Financial Theft

Rule body

id: bd550c7f-5455-48de-b23d-30fced82d02b
name: PRODAFT USTA - Payment card exposed
description: |
  'Identifies a new PRODAFT USTA Payment Card Fraud Intelligence ticket that exposes a
  compromised payment card belonging to the monitored company. These typically originate
  from card breaches, skimmers, or infostealer infections and indicate that a payment card
  may be available to fraudsters. The full card number is never stored - only the BIN,
  last 4 digits, brand, and length are retained. Investigate the exposure and, where the
  card is your own, coordinate reissue with the issuing bank.'
severity: Medium
status: Available
tactics:
- Impact
relevantTechniques:
- T1657
requiredDataConnectors:
  - connectorId: PRODAFTUstaPCFICCPDefinition
    dataTypes:
      - PRODAFTUstaCompromisedCards_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
query: |
  PRODAFTUstaCompromisedCards
  | where Created > ago(1h)
  | project
      TimeGenerated,
      Created,
      TicketId,
      CompanyName,
      CardBrand,
      CardBin,
      CardLast4,
      CardMasked,
      CardLength,
      ExpirationDate,
      Status
customDetails:
  Ticket: TicketId
  Company: CompanyName
  Brand: CardBrand
  Card: CardMasked
  Expiration: ExpirationDate
  Status: Status
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1h
    matchingMethod: AnyAlert
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

PRODAFTUstaCompromisedCards

Stage 2: `where`

| where Created > ago(1h)

Stage 3: `project`

| project
    TimeGenerated,
    Created,
    TicketId,
    CompanyName,
    CardBrand,
    CardBin,
    CardLast4,
    CardMasked,
    CardLength,
    ExpirationDate,
    Status

Output fields

These fields are emitted when the rule matches.

Field	Source
`CardBin`	`project`
`CardBrand`	`project`
`CardLast4`	`project`
`CardLength`	`project`
`CardMasked`	`project`
`CompanyName`	`project`
`Created`	`project`
`ExpirationDate`	`project`
`Status`	`project`
`TicketId`	`project`
`TimeGenerated`	`project`