Detection rules › Kusto

ProofpointPOD - High risk message not discarded

Status
available
Severity
low
Time window
10m
Source
github.com/Azure/Azure-Sentinel

'Detects when email with high risk score was not rejected or discarded by filters.'

MITRE ATT&CK coverage

TacticTechniques
Initial Access

Rule body

id: c7cd6073-6d2c-4284-a5c8-da27605bdfde
name: ProofpointPOD - High risk message not discarded
description: |
  'Detects when email with high risk score was not rejected or discarded by filters.'
severity: Low
status: Available 
requiredDataConnectors:
  - connectorId: ProofpointPOD
    dataTypes:
      - ProofpointPOD_message_CL
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let lbtime = 10m;
  ProofpointPOD
  | where TimeGenerated > ago(lbtime)
  | where EventType == 'message'
  | where NetworkDirection == 'inbound'
  | where FilterDisposition !in ('reject', 'discard')
  | where FilterModulesSpamScoresOverall == '100'
  | project SrcUserUpn, DstUserUpn
  | extend AccountCustomEntity = SrcUserUpn
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
version: 1.0.1
kind: Scheduled

Stages and Predicates

Parameters

let lbtime = 10m;

Stage 1: source

ProofpointPOD

Stage 2: where

| where TimeGenerated > ago(lbtime)

Stage 3: where

| where EventType == 'message'

Stage 4: where

| where NetworkDirection == 'inbound'

Stage 5: where

| where FilterDisposition !in ('reject', 'discard')

Stage 6: where

| where FilterModulesSpamScoresOverall == '100'

Stage 7: project

| project SrcUserUpn, DstUserUpn

Stage 8: extend

| extend AccountCustomEntity = SrcUserUpn

Exclusions

The rule actively suppresses these predicates.

Indicators

These rows show field, operator, and value matches.

Output fields

These fields are emitted when the rule matches.

FieldSource
DstUserUpnproject
SrcUserUpnproject
AccountCustomEntityextend