CTE - Blocked URL Attempted

Severity: low
Time window: 5m
Source: github.com/Azure/Azure-Sentinel

Cybereinforce blocked a URL/domain access attempt on an enrolled device based on a configured policy pattern (non-threat-intel match).

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1189` Drive-by Compromise

Rule body

id: 1747715b-1a94-411a-a2b5-d8c40422767c
name: CTE - Blocked URL Attempted
description: |
  Cybereinforce blocked a URL/domain access attempt on an enrolled device based on a configured policy pattern (non-threat-intel match).
severity: Low
requiredDataConnectors:
  - connectorId: cybereinforce_cte
    dataTypes:
      - CybereinforceCTE_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1189
query: |
  CybereinforceCTE_CL
  | where EventType == "block.url"
  | extend d = parse_json(Details)
  | extend
      DeviceId = tostring(d.deviceId),
      HostName = iff(isnotempty(tostring(d.hostname)), tostring(d.hostname), strcat("cte-device-", substring(EntityId, 0, 8))),
      DeviceUser = tostring(d.deviceUser),
      DeviceOs = tostring(d.deviceOs),
      DeviceVersion = tostring(d.deviceVersion),
      RuleId = tostring(d.ruleId),
      RuleName = iff(isnotempty(tostring(d.ruleName)), tostring(d.ruleName), "Pattern Match"),
      Pattern = tostring(d.pattern),
      Url = tostring(d.url),
      Action = tostring(d.action),
      IsIoc = tobool(d.ioc),
      ClientIp = tostring(split(tostring(d.clientIp), ":")[0]),
      ClientPort = tostring(split(tostring(d.clientIp), ":")[1]),
      UserAgent = tostring(d.userAgent)
  | where RuleName != "Cybereinforce Threat Intelligence"
  | project TimeGenerated, TenantId, DeviceId, HostName, DeviceUser, DeviceOs, DeviceVersion, RuleId, RuleName, Pattern, Url, Action, IsIoc, ClientIp, ClientPort, UserAgent, Severity, Category, Source
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: HostName
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: Url
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: ClientIp
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

CybereinforceCTE_CL

Stage 2: `where`

| where EventType == "block.url"

Stage 3: `extend`

| extend d = parse_json(Details)

Stage 4: `extend`

| extend
    DeviceId = tostring(d.deviceId),
    HostName = iff(isnotempty(tostring(d.hostname)), tostring(d.hostname), strcat("cte-device-", substring(EntityId, 0, 8))),
    DeviceUser = tostring(d.deviceUser),
    DeviceOs = tostring(d.deviceOs),
    DeviceVersion = tostring(d.deviceVersion),
    RuleId = tostring(d.ruleId),
    RuleName = iff(isnotempty(tostring(d.ruleName)), tostring(d.ruleName), "Pattern Match"),
    Pattern = tostring(d.pattern),
    Url = tostring(d.url),
    Action = tostring(d.action),
    IsIoc = tobool(d.ioc),
    ClientIp = tostring(split(tostring(d.clientIp), ":")[0]),
    ClientPort = tostring(split(tostring(d.clientIp), ":")[1]),
    UserAgent = tostring(d.userAgent)

HostName =

if/* macro: isnotempty(tostring(d.hostname)) */tostring(d.hostname)

elsestrcat("cte-device-", substring(EntityId, 0, 8))

RuleName =

if/* macro: isnotempty(tostring(d.ruleName)) */tostring(d.ruleName)

else"Pattern Match"

Stage 5: `where`

| where RuleName != "Cybereinforce Threat Intelligence"

Stage 6: `project`

| project TimeGenerated, TenantId, DeviceId, HostName, DeviceUser, DeviceOs, DeviceVersion, RuleId, RuleName, Pattern, Url, Action, IsIoc, ClientIp, ClientPort, UserAgent, Severity, Category, Source

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventType`	eq	`block.url`	`field:"EventType" kind:eq value:"block.url"`
`RuleName`	ne	`Cybereinforce Threat Intelligence`	`field:"RuleName" kind:ne value:"Cybereinforce Threat Intelligence"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Action`	`project`
`Category`	`project`
`ClientIp`	`project`
`ClientPort`	`project`
`DeviceId`	`project`
`DeviceOs`	`project`
`DeviceUser`	`project`
`DeviceVersion`	`project`
`HostName`	`project`
`IsIoc`	`project`
`Pattern`	`project`
`RuleId`	`project`
`RuleName`	`project`
`Severity`	`project`
`Source`	`project`
`TenantId`	`project`
`TimeGenerated`	`project`
`Url`	`project`
`UserAgent`	`project`

CTE - Blocked URL Attempted

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: extend

Stage 4: extend

Stage 5: where

Stage 6: project