Microsoft Sentinel high experimental kql

Abnormal Security - High-risk email attack detected

'Identifies email attacks detected by Abnormal Security whose attack type maps to a high-risk category (credential phishing, Business Email Compromise, invoice/payment fraud, malware, extortion, sensitive-data phishing, internal account-takeover attacks, or scams). Lower-risk categories such as Spam, Graymail, and Reconnaissance are intentionally excluded. Use this to triage targeted email threats that reached a mailbox.'

View Source

Detection Logic

ABNORMAL_SECURITY_THREAT_LOG_CL
| where abx_body_abx_body_attack_type_s in~ (
    "Phishing: Credential",
    "Social Engineering (BEC)",
    "Invoice/Payment Fraud (BEC)",
    "Malware",
    "Extortion",
    "Phishing: Sensitive Data",
    "Internal-to-Internal Attacks (Email Account Takeover)",
    "Scam")
| extend
    RecipientEmail = abx_body_abx_body_recipient_address_s,
    SenderEmail = abx_body_abx_body_from_address_s,
    SenderName = abx_body_abx_body_from_name_s,
    SenderIP = abx_body_abx_body_sender_ip_address_s,
    Subject = abx_body_abx_body_subject_s,
    MessageId = abx_body_abx_body_internet_message_id_s,
    AttackType = abx_body_abx_body_attack_type_s,
    AttackScore = abx_body_abx_body_attack_score_d,
    RemediationStatus = abx_body_abx_body_remediation_status_s,
    PortalUrl = abx_body_abx_body_abx_portal_url_s
| project TimeGenerated, RecipientEmail, SenderEmail, SenderName, SenderIP, Subject, MessageId, AttackType, AttackScore, RemediationStatus, PortalUrl

Field Validations

Loading…

Comments (0)

Loading comments...