KQL Search

id: e5f6a7b8-c9d0-4e1f-2a3b-4c5d6e7f8a9b
name: "Netskope - Multi-User Phishing Campaign Detection"
version: 1.0.0
kind: Scheduled
description: |
  Detects multiple users accessing the same phishing or newly registered domain within
  a short time window, indicating an active phishing campaign. Correlates Netskope blocked
  and allowed requests to phishing-categorized destinations.
  MITRE ATT&CK: T1566 (Phishing), T1566.002 (Spearphishing Link)
severity: High
requiredDataConnectors:
  - connectorId: NetskopeWebTransactions
    dataTypes:
      - NetskopeWebTx_CL
queryFrequency: PT15M
queryPeriod: P1D
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let _NetskopeEmpty = datatable(TimeGenerated:datetime, action_s:string, category_s:string, severity_s:string, malware_name_s:string, malware_type_s:string, threat_name_s:string, user_s:string, domain_s:string, dstip_s:string, srcip_s:string, bytes_uploaded_d:real, bytes_downloaded_d:real, app_s:string, url_s:string, dlp_rule_s:string, dlp_profile_s:string, activity_s:string, file_type_s:string, object_s:string)[];
  let PhishingCategories = dynamic([
      "Phishing", "Phishing and Other Frauds", "Newly Observed Domain",
      "Newly Registered Domain", "Suspicious", "Malware"]);
  union isfuzzy=true _NetskopeEmpty, NetskopeWebTx_CL
  | where TimeGenerated > ago(1d)
  | where category_s in (PhishingCategories)
      or severity_s in ("high", "critical")
  | where isnotempty(user_s) and isnotempty(domain_s)
  | summarize
      UniqueUsers      = dcount(user_s),
      UserList         = make_set(user_s, 30),
      TotalRequests    = count(),
      Blocked          = countif(action_s in ("block", "Block", "blocked", "Blocked")),
      Allowed          = countif(action_s !in ("block", "Block", "blocked", "Blocked")),
      Categories       = make_set(category_s, 5),
      URLSamples       = make_set(url_s, 5),
      FirstSeen        = min(TimeGenerated),
      LastSeen         = max(TimeGenerated)
    by domain_s
  | where UniqueUsers >= 3
  | extend CampaignDuration = datetime_diff('minute', LastSeen, FirstSeen)
  | order by UniqueUsers desc, TotalRequests desc
entityMappings:
  - entityType: DNS
    fieldMappings:
      - identifier: DomainName
        columnName: domain_s
customDetails:
  UniqueUsers: UniqueUsers
  TotalRequests: TotalRequests
  Allowed: Allowed
alertDetailsOverride:
  alertDisplayNameFormat: "Netskope Phishing Campaign - {{domain_s}} ({{UniqueUsers}} users)"
  alertDescriptionFormat: "Phishing campaign detected: {{UniqueUsers}} users accessed {{domain_s}}. {{Allowed}} requests were allowed through."
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: PT6H
    matchingMethod: Selected
    groupByEntities:
      - DNS
    groupByAlertDetails: []
    groupByCustomDetails: []