Detection rules › Kusto
VTI - High Severity Domain Collision Detection
This will alert when a collision is detected for EmailUrlInfo events with VTI high severity domain IoCs
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access |
Telemetry coverage
| Platform | Record / event type |
|---|---|
| Microsoft Defender for Endpoint | EmailUrlInfo action any: Email URL observed |
Rule body
id: 7be47078-657a-43cf-9c93-b4705a9f6134
name: VTI - High Severity Domain Collision Detection
version: 1.0.0
kind: Scheduled
description: |-
This will alert when a collision is detected for EmailUrlInfo events with VTI high severity domain IoCs
severity: High
requiredDataConnectors:
- connectorId: VisaThreatIntelligence
dataTypes:
- VisaThreatIntelligenceIOC_CL
- EmailUrlInfo
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
relevantTechniques:
- T1566
query: |-
EmailUrlInfo
| join kind=inner (VisaThreatIntelligenceIOC_CL | where IOCType == "domain" and SourceSeverity == "High")
on $left.UrlDomain == $right.Value
suppressionEnabled: false
incidentConfiguration:
createIncident: true
groupingConfiguration:
enabled: true
reopenClosedIncident: false
lookbackDuration: 1h
matchingMethod: AllEntities
suppressionDuration: 1h
eventGroupingSettings:
aggregationKind: SingleAlert
entityMappings:
- entityType: URL
fieldMappings:
- identifier: Url
columnName: Url
- entityType: DNS
fieldMappings:
- identifier: DomainName
columnName: UrlDomain
Stages and Predicates
Stage 1: source
EmailUrlInfo
Stage 2: join
| join kind=inner (VisaThreatIntelligenceIOC_CL | where IOCType == "domain" and SourceSeverity == "High")
on $left.UrlDomain == $right.Value
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
IOCType | eq |
| field:"IOCType" kind:eq value:"domain" |
SourceSeverity | eq |
| field:"SourceSeverity" kind:eq value:"High" |