User Accessed Suspicious URL Categories

Status: available
Severity: medium
Time window: 1h
Group by: Computer, c_ip, cs_host, cs_userdn, sc_filter_result
Source: github.com/Azure/Azure-Sentinel

'Creates an incident in the event the requested URL accessed by the user has been identified as Suspicious, Phishing, or Hacking.'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1566` Phishing
Command & Control	`T1071` Application Layer Protocol

Rule body

id: fb0f4a93-d8ad-4b54-9931-85bdb7550f90
name: User Accessed Suspicious URL Categories
description: |
  'Creates an incident in the event the requested URL accessed by the user has been identified as Suspicious, Phishing, or Hacking.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: SyslogAma
    datatypes:
      - Syslog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - CommandAndControl
relevantTechniques:
  - T1566
  - T1071
query: |
  SymantecProxySG
  | mv-expand cs_categories
  | where cs_categories has_any ("Suspicious","phishing", "hacking")
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by sc_filter_result, cs_userdn, c_ip, cs_host, Computer,  tostring(cs_categories)
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: cs_userdn
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: Computer
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: c_ip
version: 1.0.5
kind: Scheduled

Stages and Predicates

Stage 1: `source`

SymantecProxySG

Stage 2: `mv-expand`

| mv-expand cs_categories

Stage 3: `where`

| where cs_categories has_any ("Suspicious","phishing", "hacking")

Stage 4: `summarize`

| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by sc_filter_result, cs_userdn, c_ip, cs_host, Computer,  tostring(cs_categories)

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`cs_categories`	match	`Suspicious` transforms: `term` `hacking` transforms: `term` `phishing` transforms: `term`	`field:"cs_categories" kind:match`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Computer`	`summarize`
`EndTime`	`summarize`
`StartTime`	`summarize`
`c_ip`	`summarize`
`cs_host`	`summarize`
`cs_userdn`	`summarize`
`sc_filter_result`	`summarize`