Recorded Future Sandbox - Malicious Email Attachment

id: a1b2c3d4-5678-90ab-cdef-222222222222
name: Recorded Future Sandbox - Malicious Email Attachment
description: |
  'Creates incidents when Recorded Future Sandbox detects malicious files from Outlook email attachments'
severity: High
status: Available
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics: []
relevantTechniques: []
query: |
  RecordedFutureSandboxResults_CL
  | where TimeGenerated >= now(-1h)
  | where Source_s == "OutlookAttachment"
  | where toint(SandboxScore_s) >= 50
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: 'Malicious Email Attachment: {{FileName_s}} from {{EmailFrom_s}}'
  alertDescriptionFormat: |
    _Recorded Future Sandbox - Malicious Email Attachment Detected_

    **Sandbox Score:** {{SandboxScore_s}}/100

    **Verdict:** {{SandboxVerdict_s}}

    **Sample ID:** {{SampleId_s}}

    A malicious file was detected in an email attachment. Review the full sandbox report and investigate the sender.
customDetails:
  RFLabel: SourceSystem
  Source: Source_s
  SandboxScore: SandboxScore_s
  SandboxVerdict: SandboxVerdict_s
  FileName: FileName_s
  SampleId: SampleId_s
  EmailFrom: EmailFrom_s
  EmailTo: EmailTo_s
entityMappings:
  - entityType: File
    fieldMappings:
      - identifier: Name
        columnName: FileName_s
  - entityType: Mailbox
    fieldMappings:
      - identifier: MailboxPrimaryAddress
        columnName: EmailFrom_s
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1h
    matchingMethod: Selected
    groupByCustomDetails:
      - EmailFrom
version: 1.0.0
kind: NRT