Skip to content

Commit 3eb5790

Browse files
p-osmanp-osman
authored
Merge branch 'Azure:master' into prodaft-usta-atp
2 parents c76c2a4 + 14b47e1 commit 3eb5790

18 files changed

Lines changed: 458 additions & 508 deletions

File tree

‎Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Spoof and Impersonation/Helpdesk theme impersonation attack detection.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
id: edd48210-532e-4560-a8fe-065240cd2f20
2+
name: Display Name - Helpdesk theme impersonation attack detection
3+
description: |
4+
This query check the external Teams UPN against known Teams impersonation domain
5+
description-detailed: |
6+
This query check the external Teams UPN against known Teams impersonation domain
7+
requiredDataConnectors:
8+
- connectorId: MicrosoftThreatProtection
9+
dataTypes:
10+
- CloudAppEvents
11+
tactics:
12+
- InitialAccess
13+
relevantTechniques:
14+
- T1566
15+
query: |
16+
let HelpdeskDomain = dynamic(["helpdesk-quick.com","helpdesk-call.com","helpdesk-service.com"]);
17+
CloudAppEvents
18+
| where Timestamp > ago(30d)
19+
| where ActionType == "TeamsImpersonationDetected"
20+
| extend ImpersonationDisplayName = tostring(parse_json(tostring(RawEventData.Sender)).DisplayName)
21+
| extend ImpersonationUPN = tostring(parse_json(tostring(RawEventData.Sender)).UPN)
22+
| extend ImpactedUserUPN = tostring(RawEventData.UserId)
23+
| where ImpersonationUPN has_any(HelpdeskDomain)
24+
| project Timestamp, AccountType, ImpactedUserUPN, ImpersonationDisplayName, ImpersonationUPN
25+
version: 1.0.0

‎Sample Data/ASIM/Fortinet_FortiGate_WebSession_IngestedLogs.csv‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
TenantId,TimeGenerated [UTC],DeviceVendor,DeviceProduct,DeviceVersion,DeviceEventClassID,Activity,LogSeverity,AdditionalExtensions,DeviceAction,Protocol,ApplicationProtocol,DeviceExternalID,DeviceInboundInterface,DeviceOutboundInterface,DestinationHostName,DestinationPort,DestinationIP,DeviceName,Message,SourceIP,Computer,RequestURL,Type
1+
TenantId,TimeGenerated [UTC],DeviceVendor,DeviceProduct,DeviceVersion,DeviceEventClassID,Activity,LogSeverity,AdditionalExtensions,DeviceAction,Protocol,ApplicationProtocol,DeviceExternalID,DeviceInboundInterface,DeviceOutboundInterface,DestinationHostName,DestinationPort,DestinationIP,DeviceName,Message,SourceIP,Computer,RequestURL,Type
22
test-tenant-id,"12/2/2024, 5:35:25.263 PM",Fortinet,FortiGate-101E,"7.0.14,build0601 (GA)",0316013056,webfilter utm passthrough,5,"start=Dec 02 2024 18:35:21;logver=700140601;vd=root;eventtime=1733160922753130687;tz=""+0100"";logid=0315012545;subtype=webfilter;eventtype=urlfilter;deviceSeverity=information;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test1;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;rawdata=Method=CONNECT|User-Agent=Mozilla/5.0 (Linux Android 10 K)",passthrough,6,HTTPS,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost,443,146.59.231.198,test-host,URL was exempted because it is in the URL filter list,192.168.1.2,test-host,https://accounts.google.com/,CommonSecurityLog
33
test-tenant-id,"12/9/2024, 9:54:59.935 AM",Fortinet,FortiGate-101E,"7.0.14,build0601 (GA)",0317013312,webfilter utm passthrough,5,"start=Dec 09 2024 10:54:58;logver=700140601;vd=root;eventtime=1733738099387945126;tz=""+0100"";logid=0317013312;subtype=webfilter;eventtype=ftgd_allow;deviceSeverity=notice;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test2;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;rawdata=Method=GET|User-Agent=Mozilla/5.0 (X11 Linux x86_64)",passthrough,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost1,80,142.250.200.3,test-host,URL belongs to an allowed category in policy,192.168.1.5,test-host,http://www.google.eu/,CommonSecurityLog
44
test-tenant-id,"12/9/2024, 10:02:57.662 AM",Fortinet,FortiGate-101E,"7.0.14,build0601 (GA)",0317013312,webfilter utm passthrough,5,"start=Dec 09 2024 11:02:56;logver=700140601;vd=root;eventtime=1733738576673815547;tz=""+0100"";logid=0317013312;subtype=webfilter;eventtype=ftgd_allow;deviceSeverity=notice;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test22;ad.agent=test1;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;rawdata=Method=GET|User-Agent=Mozilla/5.0 (X11 Linux x86_64)",passthrough,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost2,80,142.250.65.227,test-host,URL belongs to an allowed category in policy,192.168.1.2,test-host,http://connectivitycheck.gstatic.com/generate_204,CommonSecurityLog
@@ -27,4 +27,4 @@ test-tenant-id,"1/17/2025, 12:41:00.517 PM",Fortinet,FortiGate-101F,"7.0.14,buil
2727
test-tenant-id,"1/17/2025, 12:44:45.476 PM",Fortinet,FortiGate-101F,"7.0.14,build0601 (GA)",0315012544,webfilter utm blocked,6,"start=Jan 17 2025 13:44:42;logver=700140601;vd=root;eventtime=1737117883815016430;tz=""+0100"";logid=0315012544;subtype=webfilter;eventtype=urlfilter;deviceSeverity=warning;urlfilteridx=1;urlfilterlist=filterlist;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test91;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;urlsource=Local URLfilter Block;crscore=30;craction=8;crlevel=high;rawdata=Method=GET",blocked,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost25,80,35.186.224.24,test-host,URL was blocked because it is in the URL filter list,192.168.1.125,test-host,http://spotify.com/,CommonSecurityLog
2828
test-tenant-id,"1/17/2025, 12:44:03.717 PM",Fortinet,FortiGate-101F,"7.0.14,build0601 (GA)",0315012544,webfilter utm blocked,6,"start=Jan 17 2025 13:44:01;logver=700140601;vd=root;eventtime=1737117842461868550;tz=""+0100"";logid=0315012544;subtype=webfilter;eventtype=urlfilter;deviceSeverity=warning;urlfilteridx=1;urlfilterlist=filterlist;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test88;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;urlsource=Local URLfilter Block;crscore=30;craction=8;crlevel=high;rawdata=Method=GET",blocked,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost26,80,35.186.224.24,test-host,URL was blocked because it is in the URL filter list,192.168.2.126,test-host,http://apresolve.spotify.com/,CommonSecurityLog
2929
test-tenant-id,"1/17/2025, 12:45:34.181 PM",Fortinet,FortiGate-101E,"7.0.15,build0632 (GA)",0315012544,webfilter utm blocked,6,"start=Jan 17 2025 13:45:32;logver=700150632;vd=root;eventtime=1737117933643454960;tz=""+0100"";logid=0315012544;subtype=webfilter;eventtype=urlfilter;deviceSeverity=warning;urlfilteridx=1;urlfilterlist=filterlist;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test78;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=Germany;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;urlsource=Local URLfilter Block;crscore=30;craction=8;crlevel=high;rawdata=Method=POST|Request-Content-Type=application/x-www-form-urlencoded|User-Agent=Mozilla/5.0 (X11 Linux x86_64)",blocked,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost27,80,3.79.215.191,test-host-2,URL was blocked because it is in the URL filter list,192.168.70.123,test-host-2,http://global.quickconnect.to/Serv.php,CommonSecurityLog
30-
test-tenant-id,"1/17/2025, 12:45:34.181 PM",Fortinet,FortiGate-101E,"7.0.15,build0632 (GA)",0315012544,webfilter utm blocked,6,"start=Jan 17 2025 13:45:32;logver=700150632;vd=root;eventtime=1737117933643454960;tz=""+0100"";logid=0315012544;subtype=webfilter;eventtype=urlfilter;deviceSeverity=warning;urlfilteridx=1;urlfilterlist=filterlist;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test766;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=Germany;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;urlsource=Local URLfilter Block;crscore=30;craction=8;crlevel=high;rawdata=Method=POST|Request-Content-Type=application/x-www-form-urlencoded|User-Agent=Mozilla/5.0 (X11 Linux x86_64)",blocked,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost28,80,3.79.215.191,test-host-2,URL was blocked because it is in the URL filter list,192.168.70.123,test-host-2,http://global.quickconnect.to/Serv.php,CommonSecurityLog
30+
test-tenant-id,"1/17/2025, 12:45:34.181 PM",Fortinet,FortiGate-101E,"7.0.15,build0632 (GA)",0315012544,webfilter utm blocked,6,"start=Jan 17 2025 13:45:32;logver=700150632;vd=root;eventtime=1737117933643454960;tz=""+0100"";logid=0315012544;subtype=webfilter;eventtype=urlfilter;deviceSeverity=warning;urlfilteridx=1;urlfilterlist=filterlist;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test766;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=Germany;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;urlsource=Local URLfilter Block;crscore=30;craction=8;crlevel=high;rawdata=Method=POST|Request-Content-Type=application/x-www-form-urlencoded|User-Agent=Mozilla/5.0 (X11 Linux x86_64)",blocked,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost28,80,3.79.215.191,test-host-2,URL was blocked because it is in the URL filter list,192.168.70.123,test-host-2,http://global.quickconnect.to/Serv.php,CommonSecurityLog

0 commit comments

Comments
 (0)