Fake Replies

Description

Use this query to find spoofed reply emails that contain certain keywords in the subject. The emails are also checked for a link to a document in Google Docs. These attacks have been observed leading to ransomware

Query · kql

let SubjectTerms = pack_array('onus','equired','all','urvey','eb', 'eport','you','nation','me','itting','book','ocument','ill'); 
EmailEvents 
| where EmailDirection == "Inbound" 
| where Subject startswith "RE:" 
| where Subject has_any(SubjectTerms) 
| join EmailUrlInfo on $left.NetworkMessageId == $right.NetworkMessageId 
| where Url startswith "https://docs.google.com/document/"
Raw source Fake Replies · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 8c4da386-7a95-4927-b24c-a13137294e0c
name: Fake Replies
description: |
  Use this query to find spoofed reply emails that contain certain keywords in the subject. The emails are also checked for a link to a document in Google Docs.
  These attacks have been observed leading to ransomware
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
  - EmailUrlInfo
tactics:
- Initial access
- Ransomware
query: |
  let SubjectTerms = pack_array('onus','equired','all','urvey','eb', 'eport','you','nation','me','itting','book','ocument','ill'); 
  EmailEvents 
  | where EmailDirection == "Inbound" 
  | where Subject startswith "RE:" 
  | where Subject has_any(SubjectTerms) 
  | join EmailUrlInfo on $left.NetworkMessageId == $right.NetworkMessageId 
  | where Url startswith "https://docs.google.com/document/"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.