CTE - CTI Blocked URL Attempted

Severity: medium
Time window: 5m
Source: github.com/Azure/Azure-Sentinel

Cybereinforce blocked a URL/domain access attempt that matched a Cybereinforce Threat Intelligence (CTI) indicator - a higher-confidence signal than a generic policy block.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1189` Drive-by Compromise
Command & Control	`T1071` Application Layer Protocol

Rule body

id: 49da5494-b6b9-42c0-9b9b-b7b219dc8173
name: CTE - CTI Blocked URL Attempted
description: |
  Cybereinforce blocked a URL/domain access attempt that matched a Cybereinforce Threat Intelligence (CTI) indicator - a higher-confidence signal than a generic policy block.
severity: Medium
requiredDataConnectors:
  - connectorId: cybereinforce_cte
    dataTypes:
      - CybereinforceCTE_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - CommandAndControl
relevantTechniques:
  - T1189
  - T1071
query: |
  CybereinforceCTE_CL
  | where EventType == "block.url"
  | extend d = parse_json(Details)
  | extend
      DeviceId = tostring(d.deviceId),
      HostName = iff(isnotempty(tostring(d.hostname)), tostring(d.hostname), strcat("cte-device-", substring(EntityId, 0, 8))),
      DeviceUser = tostring(d.deviceUser),
      DeviceOs = tostring(d.deviceOs),
      DeviceVersion = tostring(d.deviceVersion),
      RuleId = tostring(d.ruleId),
      RuleName = iff(isnotempty(tostring(d.ruleName)), tostring(d.ruleName), "Pattern Match"),
      Pattern = tostring(d.pattern),
      Url = tostring(d.url),
      Action = tostring(d.action),
      IsIoc = tobool(d.ioc),
      ClientIp = tostring(split(tostring(d.clientIp), ":")[0]),
      ClientPort = tostring(split(tostring(d.clientIp), ":")[1]),
      UserAgent = tostring(d.userAgent)
  | where RuleName == "Cybereinforce Threat Intelligence" or IsIoc == true
  | project TimeGenerated, TenantId, DeviceId, HostName, DeviceUser, DeviceOs, DeviceVersion, RuleId, RuleName, Pattern, Url, Action, IsIoc, ClientIp, ClientPort, UserAgent, Severity, Category, Source
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: HostName
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: Url
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: ClientIp
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

CybereinforceCTE_CL

Stage 2: `where`

| where EventType == "block.url"

Stage 3: `extend`

| extend d = parse_json(Details)

Stage 4: `extend`

| extend
    DeviceId = tostring(d.deviceId),
    HostName = iff(isnotempty(tostring(d.hostname)), tostring(d.hostname), strcat("cte-device-", substring(EntityId, 0, 8))),
    DeviceUser = tostring(d.deviceUser),
    DeviceOs = tostring(d.deviceOs),
    DeviceVersion = tostring(d.deviceVersion),
    RuleId = tostring(d.ruleId),
    RuleName = iff(isnotempty(tostring(d.ruleName)), tostring(d.ruleName), "Pattern Match"),
    Pattern = tostring(d.pattern),
    Url = tostring(d.url),
    Action = tostring(d.action),
    IsIoc = tobool(d.ioc),
    ClientIp = tostring(split(tostring(d.clientIp), ":")[0]),
    ClientPort = tostring(split(tostring(d.clientIp), ":")[1]),
    UserAgent = tostring(d.userAgent)

HostName =

if/* macro: isnotempty(tostring(d.hostname)) */tostring(d.hostname)

elsestrcat("cte-device-", substring(EntityId, 0, 8))

RuleName =

if/* macro: isnotempty(tostring(d.ruleName)) */tostring(d.ruleName)

else"Pattern Match"

Stage 5: `where`

| where RuleName == "Cybereinforce Threat Intelligence" or IsIoc == true

Stage 6: `project`

| project TimeGenerated, TenantId, DeviceId, HostName, DeviceUser, DeviceOs, DeviceVersion, RuleId, RuleName, Pattern, Url, Action, IsIoc, ClientIp, ClientPort, UserAgent, Severity, Category, Source

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventType`	eq	`block.url`	`field:"EventType" kind:eq value:"block.url"`
`IsIoc`	eq	`true`	`field:"IsIoc" kind:eq value:"true"`
`RuleName`	eq	`Cybereinforce Threat Intelligence`	`field:"RuleName" kind:eq value:"Cybereinforce Threat Intelligence"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Action`	`project`
`Category`	`project`
`ClientIp`	`project`
`ClientPort`	`project`
`DeviceId`	`project`
`DeviceOs`	`project`
`DeviceUser`	`project`
`DeviceVersion`	`project`
`HostName`	`project`
`IsIoc`	`project`
`Pattern`	`project`
`RuleId`	`project`
`RuleName`	`project`
`Severity`	`project`
`Source`	`project`
`TenantId`	`project`
`TimeGenerated`	`project`
`Url`	`project`
`UserAgent`	`project`

CTE - CTI Blocked URL Attempted

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: extend

Stage 4: extend

Stage 5: where

Stage 6: project