Valimail Enforce - DMARC Policy Weakened to None

Status: available
Severity: high
Time window: 1h
Group by: EventCategory, Subject, User
Source: github.com/Azure/Azure-Sentinel

This query searches for DMARC policies changed to 'none', which disables enforcement and leaves the domain vulnerable to spoofing and phishing attacks.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1566` Phishing
Defense Impairment	`T1685` Disable or Modify Tools

Rule body

id: 44ec1fa4-a502-41ae-879a-3aad3557edce
name: Valimail Enforce - DMARC Policy Weakened to None
description: |
  This query searches for DMARC policies changed to 'none', which disables enforcement
  and leaves the domain vulnerable to spoofing and phishing attacks.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: ValimailEnforce
    dataTypes:
      - ValimailEnforceEvents_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - DefenseEvasion
  - InitialAccess
relevantTechniques:
  - T1566
  - T1562
query: |
  ValimailEnforceEvents_CL
  | where EventSeverity == "High"
  | where EventType == "dmarc_policy_set_to_none"
  | summarize
      EventCount = count(),
      FirstSeen = min(PerformedAt),
      LastSeen = max(PerformedAt),
      Changes = make_set(EventChange)
    by Subject, User, EventCategory
  | extend
      AccountName = tostring(split(User, "@")[0]),
      AccountDomain = tostring(split(User, "@")[1]),
      DomainName = Subject
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountDomain
  - entityType: DNS
    fieldMappings:
      - identifier: DomainName
        columnName: DomainName
alertDetailsOverride:
  alertDisplayNameFormat: "DMARC policy set to NONE on domain {{Subject}} by {{User}}"
  alertDescriptionFormat: |
    The DMARC policy for domain '{{Subject}}' was set to 'none' by '{{User}}',
    disabling email authentication enforcement. This may expose the domain to spoofing.
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1d
    matchingMethod: Selected
    groupByEntities:
      - DNS
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

ValimailEnforceEvents_CL

Stage 2: `where`

| where EventSeverity == "High"

Stage 3: `where`

| where EventType == "dmarc_policy_set_to_none"

Stage 4: `summarize`

| summarize
    EventCount = count(),
    FirstSeen = min(PerformedAt),
    LastSeen = max(PerformedAt),
    Changes = make_set(EventChange)
  by Subject, User, EventCategory

Stage 5: `extend`

| extend
    AccountName = tostring(split(User, "@")[0]),
    AccountDomain = tostring(split(User, "@")[1]),
    DomainName = Subject

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventSeverity`	eq	`High`	`field:"EventSeverity" kind:eq value:"High"`
`EventType`	eq	`dmarc_policy_set_to_none`	`field:"EventType" kind:eq value:"dmarc_policy_set_to_none"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Changes`	`summarize`
`EventCategory`	`summarize`
`EventCount`	`summarize`
`FirstSeen`	`summarize`
`LastSeen`	`summarize`
`Subject`	`summarize`
`User`	`summarize`
`AccountDomain`	`extend`
`AccountName`	`extend`
`DomainName`	`extend`

Valimail Enforce - DMARC Policy Weakened to None

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: summarize