detection.wiki

Detection rules › Kusto

Recorded Future Identity - Credential Exposure Detected

This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.

Status
available
Severity
high
Time window
15m
Source
github.com/Azure/Azure-Sentinel

'Creates incidents when Recorded Future Identity detects compromised credentials for users in your organization'

MITRE ATT&CK coverage

TacticTechniques
Credential AccessNo specific technique

Rule body kusto

id: b1c2d3e4-5678-90ab-cdef-444444444444
name: Recorded Future Identity - Credential Exposure Detected
description: |
  'Creates incidents when Recorded Future Identity detects compromised credentials for users in your organization'
severity: High
status: Available
queryFrequency: 15m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CredentialAccess
relevantTechniques: []
query: |
  RecordedFutureIdentity_PlaybookAlertResults_CL
  | where TimeGenerated >= now(-15m)
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: 'Identity Exposure: {{panel_status_entity_name_s}} with priority: {{panel_status_priority_s}}'
  alertDescriptionFormat: |
    _Recorded Future Identity Alert_

    **Rule Name:** {{panel_status_alert_rule_name_s}}

    **Alert ID:** {{playbook_alert_id_s}}

    **Evidence Summary:** {{alert_description_s}}

    Investigate this identity by searching in log analytics workspace for the Alert ID.
  alertDynamicProperties: []
customDetails:
  RFLabel: Type
  AlertId: playbook_alert_id_s
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: panel_status_entity_name_s
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 15m
    matchingMethod: AllEntities
    groupByEntities:
      - Account
    groupByAlertDetails: []
    groupByCustomDetails: []
version: 1.0.0
kind: NRT

Stages and Predicates

Stage 1: source

RecordedFutureIdentity_PlaybookAlertResults_CL

Stage 2: where

| where TimeGenerated >= now(-15m)