detect-archive-exfiltration-to-competitor

Description

This query can be used to detect instances of a malicious insider creating a file archive and then emailing that archive to an external "competitor" organization.

Query · kql

EmailEvents
| where RecipientEmailAddress contains "competitor"
and AttachmentCount >=1
| join (
EmailAttachmentInfo
//| where isnotempty(SHA256)
)on NetworkMessageId
| join (
DeviceFileEvents
| where InitiatingProcessFileName in ("7z.exe", "7zG.exe", "AxCrypt.exe", "BitLocker.exe", "Diskcryptor.exe", "GNUPrivacyGuard.exe", "GPG4Win.exe", "PeaZip.exe", "VeraCrypt.exe", "WinRAR.exe", "WinZip.exe")
| project FileName, SHA256
) on FileName
Raw source detect-archive-exfiltration-to-competitor · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 8baad907-3b15-4f26-be09-dbba3d32fc3f
name: detect-archive-exfiltration-to-competitor
description: |
  This query can be used to detect instances of a malicious insider creating a file archive and then emailing that archive to an external "competitor" organization.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
  - EmailAttachmentInfo
  - DeviceFileEvents
tactics:
- Exfiltration
query: |
  EmailEvents
  | where RecipientEmailAddress contains "competitor"
  and AttachmentCount >=1
  | join (
  EmailAttachmentInfo
  //| where isnotempty(SHA256)
  )on NetworkMessageId
  | join (
  DeviceFileEvents
  | where InitiatingProcessFileName in ("7z.exe", "7zG.exe", "AxCrypt.exe", "BitLocker.exe", "Diskcryptor.exe", "GNUPrivacyGuard.exe", "GPG4Win.exe", "PeaZip.exe", "VeraCrypt.exe", "WinRAR.exe", "WinZip.exe")
  | project FileName, SHA256
  ) on FileName

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.