Votiro - File Blocked in Email

Severity: low
Time window: 10m
Group by: FileWithEmailDetails, LogSeverity, SrcFileSHA256, fileName, policyName, sanitizationResult
Source: github.com/Azure/Azure-Sentinel

'The analytic rule is designed to identify when an email is blocked by Votiro Sanitization Engine policy. The rule generates an alert when an email is blocked after Sanitization process which is not password protected and has a from field meaning its a valid email. More information in terms of details about the blocked attachment, such as the file name and hash, and information about the email, such as the sender and recipient(s). The alert also includes information about the Votiro policy that blocked the attachment and provides a link to additional details about the incident.'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1566` Phishing
Stealth	`T1027` Obfuscated Files or Information `T1036` Masquerading
Impact	`T1486` Data Encrypted for Impact
Command and Control	`T0885` Commonly Used Port

Rule body

id: 0b8b91de-c63e-4bc2-b5f4-b15d3b379ec9
name: Votiro - File Blocked in Email
description: |
 'The analytic rule is designed to identify when an email is blocked by Votiro Sanitization Engine policy. The rule generates an alert when an email is blocked after Sanitization process which is not password protected and has a from field meaning its a valid email. More information in terms of details about the blocked attachment, such as the file name and hash, and information about the email, such as the sender and recipient(s). The alert also includes information about the Votiro policy that blocked the attachment and provides a link to additional details about the incident.'
severity: Low
requiredDataConnectors:
  - connectorId: Votiro
    dataTypes:
      - CommonSecurityLog 
  - connectorId: CefAma
    dataTypes:
      - CommonSecurityLog
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CommandAndControl
  - DefenseEvasion
  - Impact
  - InitialAccess
relevantTechniques:
  - T0885
  - T1036
  - T1027
  - T1486
  - T1566
query: let Votiro_view  = view () {
  VotiroEvents
   | where sanitizationResult has "Blocked" and passwordProtected == "false" and from =~ "null"
   | extend FileWithEmailDetails = strcat_delim(' ', fileName, 'with the hash', SrcFileSHA256, 'was blocked in an email that was sent from user', from, 'to the following recipients', recipients)
   | summarize count() by fileName, SrcFileSHA256, FileWithEmailDetails, policyName, tostring(incidentURL), sanitizationResult, LogSeverity
   | extend FileHashAlgo = "SHA256", FileHashValue = SrcFileSHA256};Votiro_view
entityMappings:
- entityType: FileHash
  fieldMappings:
    - identifier: Algorithm
      columnName: FileHashAlgo
    - identifier: Value
      columnName: FileHashValue
incidentConfiguration:
  createIncident: true
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride: 
   alertDisplayNameFormat: File with hash {{SrcFileSHA256}} was blocked
   alertDescriptionFormat: Attachment {{FileWithEmailDetails}} by Votiro due to Policy rules, see more detail in the following link {{incidentURL}}
   alertTacticsColumnName: sanitizationResult
   alertSeverityColumnName: LogSeverity
version: 1.0.1
kind: Scheduled

Stages and Predicates

Let binding: `Votiro_view`

let Votiro_view = view () { VotiroEvents | where sanitizationResult has "Blocked" and passwordProtected == "false" and from =~ "null" | extend FileWithEmailDetails = strcat_delim(' ', fileName, 'with the hash', SrcFileSHA256, 'was blocked in an email that was sent from user', from, 'to the following recipients', recipients) | summarize count() by fileName, SrcFileSHA256, FileWithEmailDetails, policyName, tostring(incidentURL), sanitizationResult, LogSeverity | extend FileHashAlgo = "SHA256", FileHashValue = SrcFileSHA256};

Stage 1: `source`

VotiroEvents

Stage 2: `where`

where from =~ "null" and passwordProtected =~ false and sanitizationResult contains "Blocked"

Stage 3: `extend`

extend FileWithEmailDetails

Stage 4: `summarize`

summarize by fileName, SrcFileSHA256, FileWithEmailDetails, policyName, sanitizationResult, LogSeverity

Stage 5: `extend`

extend FileHashAlgo, FileHashValue

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`from`	eq	`null`	`field:"from" kind:eq value:"null"`
`passwordProtected`	eq	`false`	`field:"passwordProtected" kind:eq value:"false"`
`sanitizationResult`	match	`Blocked` transforms: `term`	`field:"sanitizationResult" kind:match value:"Blocked"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`FileWithEmailDetails`	`summarize`
`LogSeverity`	`summarize`
`SrcFileSHA256`	`summarize`
`fileName`	`summarize`
`policyName`	`summarize`
`sanitizationResult`	`summarize`
`FileHashAlgo`	`extend`
`FileHashValue`	`extend`

Votiro - File Blocked in Email

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Let binding: Votiro_view

Stage 1: source

Stage 2: where

Stage 3: extend

Stage 4: summarize

Stage 5: extend