KQL Search

id: 5e6f7a8b-9c0d-4e1f-2a3b-4c5d6e7f8a92
name: "Netskope (Built-in) - Multi-User Phishing Campaign Detection"
version: 1.0.0
kind: Scheduled
description: |
  Detects multiple users accessing the same phishing domain within a short window,
  indicating an active phishing campaign. Uses the built-in NetskopeEvents_CL table.
  MITRE ATT&CK: T1566 (Phishing), T1566.002 (Spearphishing Link)
severity: High
requiredDataConnectors:
  - connectorId: NetskopeDataConnector
    dataTypes:
      - NetskopeEvents_CL
queryFrequency: PT15M
queryPeriod: P1D
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let _NetskopeEmpty = datatable(TimeGenerated:datetime, action_s:string, category_s:string, severity_s:string, malware_name_s:string, malware_type_s:string, threat_name_s:string, user_s:string, domain_s:string, dstip_s:string, srcip_s:string, bytes_uploaded_d:real, bytes_downloaded_d:real, app_s:string, url_s:string, dlp_rule_s:string, dlp_profile_s:string, activity_s:string, file_type_s:string, object_s:string, dst_country_s:string, src_country_s:string, ccl_s:string, access_method_s:string, traffic_type_s:string)[];
  let PhishingCategories = dynamic([
      "Phishing", "Phishing and Other Frauds", "Newly Observed Domain",
      "Newly Registered Domain", "Suspicious", "Malware"]);
  union isfuzzy=true _NetskopeEmpty, NetskopeEvents_CL
  | where TimeGenerated > ago(1d)
  | where category_s in (PhishingCategories)
      or severity_s in ("high", "critical")
  | where isnotempty(user_s) and isnotempty(domain_s)
  | summarize
      UniqueUsers      = dcount(user_s),
      UserList         = make_set(user_s, 30),
      TotalRequests    = count(),
      Blocked          = countif(action_s in ("block", "Block", "blocked", "Blocked")),
      Allowed          = countif(action_s !in ("block", "Block", "blocked", "Blocked")),
      Categories       = make_set(category_s, 5),
      URLSamples       = make_set(url_s, 5),
      FirstSeen        = min(TimeGenerated),
      LastSeen         = max(TimeGenerated)
    by domain_s
  | where UniqueUsers >= 3
  | extend CampaignDuration = datetime_diff('minute', LastSeen, FirstSeen)
  | order by UniqueUsers desc, TotalRequests desc
entityMappings:
  - entityType: DNS
    fieldMappings:
      - identifier: DomainName
        columnName: domain_s
customDetails:
  UniqueUsers: UniqueUsers
  Allowed: Allowed
alertDetailsOverride:
  alertDisplayNameFormat: "Netskope BI Phishing Campaign - {{domain_s}} ({{UniqueUsers}} users)"
  alertDescriptionFormat: "{{UniqueUsers}} users accessed phishing domain {{domain_s}} with {{Allowed}} allowed requests."
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: PT6H
    matchingMethod: Selected
    groupByEntities:
      - DNS
    groupByAlertDetails: []
    groupByCustomDetails: []