Detection rules › Kusto
SlackAudit - Suspicious file downloaded.
'Detects potentialy suspicious downloads.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1189 Drive-by Compromise |
Rule body kusto
id: 132b98a5-07e9-401a-9b6f-453e52a53979
name: SlackAudit - Suspicious file downloaded.
description: |
'Detects potentialy suspicious downloads.'
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: SlackAuditAPI
dataTypes:
- SlackAudit_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
relevantTechniques:
- T1189
query: |
SlackAudit
| where DvcAction =~ 'file_downloaded'
| extend FileName = tostring(EntityFileName)
| extend fe = split(FileName, '.')
| extend FileExtension = iff(array_length(fe) > 1, tostring(fe[-1]), '')
| where FileName contains '.'
| where FileExtension matches regex @"^[A-Za-z]{1,4}$"
| project EntityFileName = FileName, SrcUserName
| extend AccountCustomEntity = SrcUserName
| extend FileCustomEntity = EntityFileName
entityMappings:
- entityType: Account
fieldMappings:
- identifier: FullName
columnName: AccountCustomEntity
- entityType: File
fieldMappings:
- identifier: Name
columnName: FileCustomEntity
alertDetailsOverride:
alertDisplayNameFormat: 'Suspicious Slack file downloaded by {{SrcUserName}}: {{EntityFileName}}'
alertDescriptionFormat: A Slack audit file_downloaded event matched the suspicious extension heuristic for {{EntityFileName}}
by {{SrcUserName}}.
customDetails:
FileName: EntityFileName
UserName: SrcUserName
version: 1.0.1
kind: Scheduled
Stages and Predicates
Stage 1: source
SlackAudit
Stage 2: where
| where DvcAction =~ 'file_downloaded'
Stage 3: extend (3 consecutive steps)
| extend FileName = tostring(EntityFileName)
| extend fe = split(FileName, '.')
| extend FileExtension = iff(array_length(fe) > 1, tostring(fe[-1]), '')
Stage 4: where
| where FileName contains '.'
Stage 5: where
| where FileExtension matches regex @"^[A-Za-z]{1,4}$"
Stage 6: project
| project EntityFileName = FileName, SrcUserName
Stage 7: extend
| extend AccountCustomEntity = SrcUserName
Stage 8: extend
| extend FileCustomEntity = EntityFileName
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
DvcAction | eq |
|
FileExtension | regex_match |
|
FileName | contains |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
EntityFileName | project |
SrcUserName | project |
AccountCustomEntity | extend |
FileCustomEntity | extend |