Detection rules › Kusto

Mimecast Targeted Threat Protection - Attachment Protect

This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.

Severity: high
Time window: 15m
Source: github.com/Azure/Azure-Sentinel

Detects a threat for an unsafe attachment in an email

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T0865` Spearphishing Attachment

Rule body

id: aa75944c-a663-4901-969e-7b55bfa49a73
name: Mimecast Targeted Threat Protection - Attachment Protect
description: Detects a threat for an unsafe attachment in an email
severity: High
requiredDataConnectors:
  - connectorId: MimecastTTPAPI
    dataTypes:
      - MimecastTTPAttachment_CL
enabled: true
query: MimecastTTPAttachment_CL| where result_s <> "safe";
queryFrequency: 5m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
suppressionDuration: 5h
suppressionEnabled: false
tactics:
- InitialAccess
- Discovery
relevantTechniques:
- T0865
alertRuleTemplateName:
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1d
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: AlertPerResult
customDetails:
  fileHash: fileHash_s
  fileName: fileName_s
  fileType: fileType_s
  details: details_s
entityMappings:
  - entityType: MailMessage
    fieldMappings:
      - identifier: Sender
        columnName: senderAddress_s
      - identifier: Recipient
        columnName: recipientAddress_s
      - identifier: Subject
        columnName: subject_s
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

MimecastTTPAttachment_CL

Stage 2: `where`

| where result_s <> "safe";

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`result_s`	ne	`safe`	`field:"result_s" kind:ne value:"safe"`