iboss - Malware Detected

id: cad35734-b97a-4209-9269-b98c916379eb
name: iboss - Malware Detected
description: |
  Identifies web traffic where the iboss platform flagged malware. A populated MalwareDetected flag indicates the gateway detected a malicious file or payload associated with the request. Surfaces the destination, user, and other details to support triage.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: ibossAma
    dataTypes:
      - CommonSecurityLog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Execution
relevantTechniques:
  - T1204
query: |
  ibossUrlEvent
  | where MalwareDetected == 1
  | extend FileHashAlgorithm = "SHA256"
  | project EventTime, SrcUsername, Url, Domain, SrcIpAddr, DstIpAddr, FileSHA256, FileHashAlgorithm,DvcAction, UrlCategory, HttpUserAgent
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: SrcUsername
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SrcIpAddr
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: Url
  - entityType: FileHash
    fieldMappings:
      - identifier: Algorithm
        columnName: FileHashAlgorithm
      - identifier: Value
        columnName: FileSHA256
version: 1.0.0
kind: Scheduled