Detection rules › Kusto
Detect external user sending suspicious link to multiple users
An external sender suddenly sending the same link to multiple internal users, can indicate that external user being compromised and used for BEC Attacks. In these kind of attacks compromised accounts are used to send phishing links or attachments to users in business relationships.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access |
References
Telemetry coverage
Rule body
// External user sending same link to multiple users via Teams
let threshold = 5;
MessageEvents
| where TimeGenerated > ago(1d)
// Focus on chat messsages
| where ThreadType == "chat"
// Only return external users sending messages
| join kind=leftanti (
IdentityInfo
| where TimeGenerated > ago(14d)
| distinct AccountObjectId
) on $left.SenderObjectId == $right.AccountObjectId
// Only flag messages with Teams Links
| join kind=inner MessageUrlInfo on TeamsMessageId
// Exclude teams file thumbnails
| where Url !~ "http://dummy.jpg/"
// Make a set of the chats a user sends a specific URL to
| summarize ChatSet = make_set(ThreadId) by SenderEmailAddress, Url
// Count the amount of chats
| extend ChatCount = array_length(ChatSet)
| where ChatCount > threshold
Stages and Predicates
Stage 0: let
let threshold = 5;
Stage 1: source
MessageEvents
Stage 2: where
| where TimeGenerated > ago(1d)
Stage 3: where
| where ThreadType == "chat"
Stage 4: join (negated)
join kind=leftanti (IdentityInfo) on SenderObjectId, AccountObjectId
Stage 5: join
| join kind=inner MessageUrlInfo on TeamsMessageId
Stage 6: where
where Url !~ "http://dummy.jpg/"
Stage 7: summarize
summarize ChatSet by SenderEmailAddress, Url
Stage 8: extend
extend ChatCount
Stage 9: where
where ChatCount > 5
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ChatCount | gt |
| field:"ChatCount" kind:gt value:"5" |
ThreadType | eq |
| field:"ThreadType" kind:eq value:"chat" |
Url | ne |
| field:"Url" kind:ne value:"http://dummy.jpg/" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
ChatSet | summarize |
SenderEmailAddress | summarize |
Url | summarize |
ChatCount | extend |