ProofpointPOD - Suspicious attachment

Status: available
Severity: medium
Time window: 10m
Source: github.com/Azure/Azure-Sentinel

'Detects when email contains suspicious attachment (file type).'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1566` Phishing

Rule body

id: f6a51e2c-2d6a-4f92-a090-cfb002ca611f
name: ProofpointPOD - Suspicious attachment
description: |
  'Detects when email contains suspicious attachment (file type).'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: ProofpointPOD
    dataTypes:
      - ProofpointPOD_message_CL
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let lbtime = 10m;
  let disallowed_ext = dynamic(['ps1', 'exe', 'vbs', 'js', 'scr']);
  ProofpointPOD
  | where TimeGenerated > ago(lbtime)
  | where EventType == 'message'
  | where NetworkDirection == 'inbound'
  | where FilterDisposition !in ('reject', 'discard')
  | extend attachedExt = todynamic(MsgParts)[0]['detectedExt']
  | where tolower(attachedExt) in (disallowed_ext)
  | project SrcUserUpn, AccountCustomEntity = parse_json(DstUserUpn)[0], attachedExt
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
version: 1.0.2
kind: Scheduled

Stages and Predicates

Parameters

let lbtime = 10m;
let disallowed_ext = dynamic(['ps1', 'exe', 'vbs', 'js', 'scr']);

Stage 1: `source`

ProofpointPOD

Stage 2: `where`

| where TimeGenerated > ago(lbtime)

Stage 3: `where`

| where EventType == 'message'

Stage 4: `where`

| where NetworkDirection == 'inbound'

Stage 5: `where`

| where FilterDisposition !in ('reject', 'discard')

Stage 6: `extend`

| extend attachedExt = todynamic(MsgParts)[0]['detectedExt']

Stage 7: `where`

| where tolower(attachedExt) in (disallowed_ext)

Stage 8: `project`

| project SrcUserUpn, AccountCustomEntity = parse_json(DstUserUpn)[0], attachedExt

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`FilterDisposition`	in	`discard`, `reject`	`excludes:FilterDisposition` `field:"FilterDisposition" value:"discard"` `field:"FilterDisposition" value:"reject"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventType`	eq	`message`	`field:"EventType" kind:eq value:"message"`
`NetworkDirection`	eq	`inbound`	`field:"NetworkDirection" kind:eq value:"inbound"`
`attachedExt`	in	`exe` transforms: `tolower` `js` transforms: `tolower` `ps1` transforms: `tolower` `scr` transforms: `tolower` `vbs` transforms: `tolower`	`field:"attachedExt" kind:in`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AccountCustomEntity`	`project`
`SrcUserUpn`	`project`
`attachedExt`	`project`

ProofpointPOD - Suspicious attachment

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: where

Stage 6: extend

Stage 7: where

Stage 8: project