Microsoft Sentinel medium experimental kql

Abnormal Security - User-reported email judged malicious

'Creates an incident when an email a user reported to the Abnormal Security Abuse Mailbox is judged malicious. Surfaces the reporter, the original recipient, and the campaign so analysts can scope and remediate look-alike messages. Spam- and safe-judged reports are intentionally excluded.'

View Source

Detection Logic

ABNORMAL_SECURITY_ABUSE_MAILBOX_CL
| where abx_body_abx_body_reported_b == true
| where tolower(abx_body_abx_body_judgement_s) == "malicious"
| extend
    ReporterEmail = abx_body_abx_body_reporter_address_s,
    RecipientEmail = abx_body_abx_body_recipient_address_s,
    Subject = abx_body_abx_body_subject_s,
    Judgement = abx_body_abx_body_judgement_s,
    MessageId = abx_body_abx_body_internet_message_id_s,
    CampaignId = abx_body_abx_body_campaign_id_g
| project TimeGenerated, ReporterEmail, RecipientEmail, Subject, Judgement, MessageId, CampaignId

Field Validations

Loading…

Comments (0)

Loading comments...