detection.wiki

Detection rules › Kusto

Google Threat Intelligence - Threat Hunting Url

Severity
medium
Time window
1d
Group by
Id
Source
github.com/Azure/Azure-Sentinel

'Google Threat Intelligence Url correlation.'

MITRE ATT&CK coverage

TacticTechniques
Initial AccessT1566 Phishing

Rule body kusto

id: "89290690-54c4-4196-91c5-d32b1df5d873"
name: Google Threat Intelligence - Threat Hunting Url
description: |
  'Google Threat Intelligence Url correlation.'
severity: Medium
requiredDataConnectors:
  - connectorId: ThreatIntelligence
    dataTypes:
      - ThreatIntelIndicators
queryFrequency: 30m
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1h
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: 'Google Threat Intelligence Match'
  alertDescriptionFormat: 'Correlation found from the {{Type}} table.'
query: |
  let ioc_lookBack = 1d;
  _Im_WebSession
  | where isnotempty(Url)
  | extend lowerUrl=tolower(Url)
  | join kind=inner (
  ThreatIntelIndicators
  | where ObservableKey == 'url:value'
  | where isnotempty(ObservableValue)
  | where SourceSystem == "Google Threat Intelligence"
  | where TimeGenerated >= ago(ioc_lookBack)
  | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
  | where IsActive == true and (isnull(ValidUntil) or ValidUntil > now())
  | extend lowerUrl=tolower(ObservableValue)
  ) on lowerUrl
  | project Url=ObservableValue, Description=Data.description, Type, TimeGenerated
entityMappings:
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: Url
version: 1.0.0
kind: Scheduled

Stages and Predicates

Parameters

let ioc_lookBack = 1d;

Stage 1: source

_Im_WebSession

Stage 2: where

| where isnotempty(Url)

Stage 3: extend

| extend lowerUrl=tolower(Url)

Stage 4: join

| join kind=inner (
ThreatIntelIndicators
| where ObservableKey == 'url:value'
| where isnotempty(ObservableValue)
| where SourceSystem == "Google Threat Intelligence"
| where TimeGenerated >= ago(ioc_lookBack)
| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
| where IsActive == true and (isnull(ValidUntil) or ValidUntil > now())
| extend lowerUrl=tolower(ObservableValue)
) on lowerUrl

Stage 5: project

| project Url=ObservableValue, Description=Data.description, Type, TimeGenerated

Stage 6: summarize

summarize by Id

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
IsActiveeq
  • true transforms: cased
ObservableKeyeq
  • url:value transforms: cased
ObservableValueis_not_null
  • (no value, null check)
SourceSystemeq
  • Google Threat Intelligence transforms: cased
Urlis_not_null
  • (no value, null check)
ValidUntilis_null
  • (no value, null check)

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
Idsummarize