Detection rules › Kusto
Suspicious link sharing pattern
'Alerts in links that have been shared across multiple Zoom chat channels by the same user in a short space if time. Adjust the threshold figure to change the number of channels a message needs to be posted in before an alert is raised.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Reconnaissance | T1598 Phishing for Information |
Rule body kusto
id: 1218175f-c534-421c-8070-5dcaabf28067
name: Suspicious link sharing pattern
description: |
'Alerts in links that have been shared across multiple Zoom chat channels by the same user in a short space if time.
Adjust the threshold figure to change the number of channels a message needs to be posted in before an alert is raised.'
severity: Low
requiredDataConnectors: []
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
- Reconnaissance
relevantTechniques:
- T1598
query: |
let threshold = 3;
ZoomLogs
| where Event =~ "chat_message.sent"
| extend Channel = tostring(parse_json(ChatEvents).Channel)
| extend Message = tostring(parse_json(ChatEvents).Message)
| where Message matches regex "http(s?):\\/\\/"
| summarize Channels = makeset(Channel), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by Message, User, UserId
| extend ChannelCount = arraylength(Channels)
| where ChannelCount > threshold
| extend AccountName = tostring(split(User, "@")[0]), AccountUPNSuffix = tostring(split(User, "@")[1])
entityMappings:
- entityType: Account
fieldMappings:
- identifier: FullName
columnName: User
- identifier: Name
columnName: AccountName
- identifier: UPNSuffix
columnName: AccountUPNSuffix
version: 1.0.4
kind: Scheduled
metadata:
source:
kind: Community
author:
name: Microsoft Security Research
support:
tier: Community
categories:
domains: [ "Security - Others" ]
Stages and Predicates
Parameters
let threshold = 3;
Stage 1: source
ZoomLogs
Stage 2: where
| where Event =~ "chat_message.sent"
Stage 3: extend
| extend Channel = tostring(parse_json(ChatEvents).Channel)
Stage 4: extend
| extend Message = tostring(parse_json(ChatEvents).Message)
Stage 5: where
| where Message matches regex "http(s?):\\/\\/"
Stage 6: summarize
| summarize Channels = makeset(Channel), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by Message, User, UserId
Stage 7: extend
| extend ChannelCount = arraylength(Channels)
Stage 8: where
| where ChannelCount > threshold
Stage 9: extend
| extend AccountName = tostring(split(User, "@")[0]), AccountUPNSuffix = tostring(split(User, "@")[1])
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
ChannelCount | gt |
|
Event | eq |
|
Message | regex_match |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
Channels | summarize |
EndTime | summarize |
Message | summarize |
StartTime | summarize |
User | summarize |
UserId | summarize |
ChannelCount | extend |
AccountName | extend |
AccountUPNSuffix | extend |