Valimail Enforce - Email Authentication Key Deleted

Status: available
Severity: medium
Time window: 1h
Group by: EventCategory, User
Source: github.com/Azure/Azure-Sentinel

This query searches for deletion of SPF delegations or DKIM keys, which are medium-severity events that could degrade email authentication posture for a domain.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685` Disable or Modify Tools

Rule body

id: 483078c6-d029-40f3-931a-30af0032008b
name: Valimail Enforce - Email Authentication Key Deleted
description: |
  This query searches for deletion of SPF delegations or DKIM keys, which are medium-severity events
  that could degrade email authentication posture for a domain.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: ValimailEnforce
    dataTypes:
      - ValimailEnforceEvents_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1562
query: |
  ValimailEnforceEvents_CL
  | where EventSeverity == "Medium"
  | where EventCategory in ("SPFConfiguration", "DKIMConfiguration")
  | where IsHighValueEvent == true
  | summarize
      EventCount = count(),
      FirstSeen = min(PerformedAt),
      LastSeen = max(PerformedAt),
      AffectedDomains = make_set(Subject),
      Actions = make_set(EventType)
    by User, EventCategory
  | extend
      AccountName = tostring(split(User, "@")[0]),
      AccountDomain = tostring(split(User, "@")[1]),
      DomainName = tostring(AffectedDomains[0])
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountDomain
  - entityType: DNS
    fieldMappings:
      - identifier: DomainName
        columnName: DomainName
alertDetailsOverride:
  alertDisplayNameFormat: "{{EventCategory}} key deleted on {{EventCount}} domain(s) by {{User}}"
  alertDescriptionFormat: |
    User '{{User}}' deleted one or more {{EventCategory}} records affecting
    domains: {{AffectedDomains}}. This may weaken email authentication posture.
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1d
    matchingMethod: Selected
    groupByEntities:
      - Account
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

ValimailEnforceEvents_CL

Stage 2: `where`

| where EventSeverity == "Medium"

Stage 3: `where`

| where EventCategory in ("SPFConfiguration", "DKIMConfiguration")

Stage 4: `where`

| where IsHighValueEvent == true

Stage 5: `summarize`

| summarize
    EventCount = count(),
    FirstSeen = min(PerformedAt),
    LastSeen = max(PerformedAt),
    AffectedDomains = make_set(Subject),
    Actions = make_set(EventType)
  by User, EventCategory

Stage 6: `extend`

| extend
    AccountName = tostring(split(User, "@")[0]),
    AccountDomain = tostring(split(User, "@")[1]),
    DomainName = tostring(AffectedDomains[0])

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCategory`	in	`DKIMConfiguration` `SPFConfiguration`	`field:"EventCategory" kind:in`
`EventSeverity`	eq	`Medium`	`field:"EventSeverity" kind:eq value:"Medium"`
`IsHighValueEvent`	eq	`true`	`field:"IsHighValueEvent" kind:eq value:"true"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Actions`	`summarize`
`AffectedDomains`	`summarize`
`EventCategory`	`summarize`
`EventCount`	`summarize`
`FirstSeen`	`summarize`
`LastSeen`	`summarize`
`User`	`summarize`
`AccountDomain`	`extend`
`AccountName`	`extend`
`DomainName`	`extend`

Valimail Enforce - Email Authentication Key Deleted

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: summarize

Stage 6: extend