NordPass - Domain data detected in breach

Severity: high
Time window: 5m
Source: github.com/Azure/Azure-Sentinel

This will alert you when Data Breach Scanner discovers data related to your organization's domains on the dark web. !This rule should be enabled only by the organizations that have set up Data Breach Scanner in NordPass.

MITRE ATT&CK coverage

Tactic	Techniques
Exfiltration	`T1020` Automated Exfiltration

Rule body

id: e3f2b6c9-df0c-4b36-a376-bb2762e4dbdc
name: NordPass - Domain data detected in breach
kind: Scheduled
version: 1.0.0
displayName: Domain data detected in breach
description: |
  This will alert you when Data Breach Scanner discovers data related to your organization's domains on the dark web.
  
  !This rule should be enabled only by the organizations that have set up Data Breach Scanner in NordPass.
severity: High
query: |
  NordPassEventLogs_CL
  | where event_type == "breach"
  | where action == "domain_breached"
  | extend TargetEmail = user_email
requiredDataConnectors:
  - connectorId: NordPass
    dataTypes:
      - NordPassEventLogs_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Exfiltration
relevantTechniques:
  - T1020
incidentConfiguration:
  createIncident: false
entityMappings:
- entityType: Mailbox
  fieldMappings:
  - identifier: MailboxPrimaryAddress
    columnName: TargetEmail

Stages and Predicates

Stage 1: `source`

NordPassEventLogs_CL

Stage 2: `where`

| where event_type == "breach"

Stage 3: `where`

| where action == "domain_breached"

Stage 4: `extend`

| extend TargetEmail = user_email

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`action`	eq	`domain_breached`	`field:"action" kind:eq value:"domain_breached"`
`event_type`	eq	`breach`	`field:"event_type" kind:eq value:"breach"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`TargetEmail`	`extend`