KQL Search

id: f8a9b0c1-d2e3-4f4a-5b6c-7d8e9f0a1b3d
name: "Netskope - Suspicious File Download from Uncategorized Domain"
version: 1.0.0
kind: Scheduled
description: |
  Detects file downloads from newly registered, uncategorized, or suspicious domains.
  Attackers frequently stage payloads on disposable domains that have not yet been
  categorized by URL classification engines.
  Uses the custom NetskopeWebTx_CL table via Blob Storage ingestion.
  MITRE ATT&CK: T1105 (Ingress Tool Transfer), T1204.002 (User Execution: Malicious File)
severity: Medium
requiredDataConnectors:
  - connectorId: NetskopeWebTransactions
    dataTypes:
      - NetskopeWebTx_CL
queryFrequency: PT30M
queryPeriod: P1D
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Execution
  - CommandAndControl
relevantTechniques:
  - T1105
  - T1204
query: |
  let _NetskopeEmpty = datatable(TimeGenerated:datetime, action_s:string, category_s:string, severity_s:string, malware_name_s:string, malware_type_s:string, threat_name_s:string, user_s:string, domain_s:string, dstip_s:string, srcip_s:string, bytes_uploaded_d:real, bytes_downloaded_d:real, app_s:string, url_s:string, dlp_rule_s:string, dlp_profile_s:string, activity_s:string, file_type_s:string, object_s:string, dst_country_s:string, src_country_s:string, ccl_s:string, access_method_s:string, traffic_type_s:string)[];
  let SuspiciousCategories = dynamic([
      "Uncategorized", "Unknown", "Newly Observed Domain",
      "Newly Registered Domain", "Suspicious", "Parked",
      "Dynamic DNS Host"]);
  let RiskyFileTypes = dynamic([
      "exe", "dll", "scr", "bat", "cmd", "ps1", "vbs", "js",
      "hta", "msi", "iso", "img", "zip", "7z", "rar"]);
  union isfuzzy=true _NetskopeEmpty, NetskopeWebTx_CL
  | where TimeGenerated > ago(1d)
  | where isnotempty(user_s) and isnotempty(domain_s)
  | where activity_s has_any ("Download", "download")
      or todouble(bytes_downloaded_d) > 1048576
  | where category_s in (SuspiciousCategories)
  | where isnotempty(file_type_s) or isnotempty(object_s)
  | summarize
      DownloadCount     = count(),
      TotalMBDownloaded = round(sum(todouble(bytes_downloaded_d)) / 1048576, 2),
      UniqueFiles       = dcount(object_s),
      FileNames         = make_set(object_s, 10),
      FileTypes         = make_set(file_type_s, 10),
      Domains           = make_set(domain_s, 10),
      Categories        = make_set(category_s, 5),
      URLSamples        = make_set(url_s, 5),
      DstCountries      = make_set(dst_country_s, 5),
      SourceIPs         = make_set(srcip_s, 5),
      FirstSeen         = min(TimeGenerated),
      LastSeen          = max(TimeGenerated)
    by user_s
  | where DownloadCount >= 1
  | order by TotalMBDownloaded desc, DownloadCount desc
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: user_s
customDetails:
  DownloadCount: DownloadCount
  TotalMBDownloaded: TotalMBDownloaded
  FileTypes: FileTypes
alertDetailsOverride:
  alertDisplayNameFormat: "Netskope Suspicious Download - {{user_s}} ({{DownloadCount}} files, {{TotalMBDownloaded}} MB)"
  alertDescriptionFormat: "User {{user_s}} downloaded {{DownloadCount}} files ({{TotalMBDownloaded}} MB) from uncategorized/suspicious domains."
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: PT6H
    matchingMethod: Selected
    groupByEntities:
      - Account
    groupByAlertDetails: []
    groupByCustomDetails: []