WitFoo-Artifact ::: message={"activityGroupName":null,"alertDetections":[],"assignedTo":null,"azureSubscriptionId":null,"azureTenantId":"4055bd5f-b117-4bb4-befa-de484bd06de8","category":"ThreatManagement","closedDateTime":null,"cloudAppStates":[],"comments":["New alert"],"confidence":null,"createdDateTime":"2024-07-24T16:07:10.87Z","description":"Emails with malicious URL that were delivered and later removed -V1.0.0.3","detectionIds":[],"eventDateTime":"2024-07-24T16:03:15.7644052Z","feedback":null,"fileStates":[],"historyStates":[],"hostStates":[],"id":"74528a8f-50b3-8954-d200-08dcabfa173f","incidentIds":[],"investigationSecurityStates":[],"lastEventDateTime":null,"lastModifiedDateTime":"2024-07-24T19:09:41.62Z","malwareStates":[{"category":null,"family":"e99f40b2-9b8c-40c2-d6c6-08dcab45d2bf-3600466711026277654-1","name":null,"severity":null,"wasRunning":null},{"category":null,"family":"e99f40b2-9b8c-40c2-d6c6-08dcab45d2bf-7067053706471445382-1","name":null,"severity":null,"wasRunning":null}],"messageSecurityStates":[],"networkConnections":[{"applicationName":null,"destinationAddress":null,"destinationDomain":null,"destinationLocation":null,"destinationPort":null,"destinationUrl":"josebricenonunez.com","direction":null,"domainRegisteredDateTime":null,"localDnsName":null,"natDestinationAddress":null,"natDestinationPort":null,"natSourceAddress":null,"natSourcePort":null,"protocol":null,"riskScore":null,"sourceAddress":null,"sourceLocation":null,"sourcePort":null,"status":null,"urlParameters":null},{"applicationName":null,"destinationAddress":null,"destinationDomain":null,"destinationLocation":null,"destinationPort":null,"destinationUrl":"josebricenonunez.com","direction":null,"domainRegisteredDateTime":null,"localDnsName":null,"natDestinationAddress":null,"natDestinationPort":null,"natSourceAddress":null,"natSourcePort":null,"protocol":null,"riskScore":null,"sourceAddress":null,"sourceLocation":null,"sourcePort":null,"status":null,"urlParameters":null}],"processes":[],"recommendedActions":[],"registryKeyStates":[],"riskScore":null,"securityResources":[],"severity":"informational","sourceMaterials":["https://security.microsoft.com/viewalerts?id=74528a8f-50b3-8954-d200-08dcabfa173f"],"status":"resolved","tags":[],"title":"Email messages containing malicious URL removed after delivery​","triggers":[],"uriClickSecurityStates":[],"userStates":[{"aadUserId":null,"accountName":"latesha.jacksonxikxv","domainName":"umzhqdzs.connectcommunity.pt","emailRole":"sender","isVpn":null,"logonDateTime":null,"logonId":null,"logonIp":"178.78.232.124","logonLocation":null,"logonType":null,"onPremisesSecurityIdentifier":null,"riskScore":null,"userAccountType":null,"userPrincipalName":"latesha.jacksonxikxv@umzhqdzs.connectcommunity.pt"},{"aadUserId":null,"accountName":"reese","domainName":"wayne.com","emailRole":"recipient","isVpn":null,"logonDateTime":null,"logonId":null,"logonIp":null,"logonLocation":null,"logonType":null,"onPremisesSecurityIdentifier":null,"riskScore":null,"userAccountType":null,"userPrincipalName":"reese@wayne.com"},{"aadUserId":null,"accountName":"latesha.jacksonxikxv","domainName":"umzhqdzs.connectcommunity.pt","emailRole":"sender","isVpn":null,"logonDateTime":null,"logonId":null,"logonIp":"178.78.232.124","logonLocation":null,"logonType":null,"onPremisesSecurityIdentifier":null,"riskScore":null,"userAccountType":null,"userPrincipalName":"latesha.jacksonxikxv@umzhqdzs.connectcommunity.pt"},{"aadUserId":null,"accountName":"charles","domainName":"wayne.com","emailRole":"recipient","isVpn":null,"logonDateTime":null,"logonId":null,"logonIp":null,"logonLocation":null,"logonType":null,"onPremisesSecurityIdentifier":null,"riskScore":null,"userAccountType":null,"userPrincipalName":"charles@wayne.com"}],"vendorInformation":{"provider":"Office 365 Security and Compliance","providerVersion":null,"subProvider":null,"vendor":"Microsoft"},"vulnerabilityStates":[]} ::: application=ThreatManagement ::: endTimeUTC=2024-07-24T19:09:41.62Z ::: created_at=2024-07-24T16:03:15.7644052Z ::: severityLabel=informational ::: serverIP=178.78.232.124 ::: emailTo=charles@wayne.com ::: program=azure_security ::: startTimeUTC=2024-07-24T16:03:15.7644052Z ::: severityCode=5 ::: streamName=azure_security_alert ::: tags=[Emails with malicious URL that were delivered and later removed -V1.0.0.3,Email messages containing malicious URL removed after delivery​] ::: messageType=malicious_session ::: emailFrom=latesha.jacksonxikxv@umzhqdzs.connectcommunity.pt
{
    "application": "ThreatManagement",
    "emailfrom": "latesha.jacksonxikxv@umzhqdzs.connectcommunity.pt",
    "emailto": "charles@witfoo.com",
    "endtimeutc": "2024-07-24T19:09:41.62Z",
    "message": "WitFoo-Artifact ::: message={\"activityGroupName\":null,\"alertDetections\":[],\"assignedTo\":null,\"azureSubscriptionId\":null,\"azureTenantId\":\"4055bd5f-b117-4bb4-befa-de484bd06de8\",\"category\":\"ThreatManagement\",\"closedDateTime\":null,\"cloudAppStates\":[],\"comments\":[\"New alert\"],\"confidence\":null,\"createdDateTime\":\"2024-07-24T16:07:10.87Z\",\"description\":\"Emails with malicious URL that were delivered and later removed -V1.0.0.3\",\"detectionIds\":[],\"eventDateTime\":\"2024-07-24T16:03:15.7644052Z\",\"feedback\":null,\"fileStates\":[],\"historyStates\":[],\"hostStates\":[],\"id\":\"74528a8f-50b3-8954-d200-08dcabfa173f\",\"incidentIds\":[],\"investigationSecurityStates\":[],\"lastEventDateTime\":null,\"lastModifiedDateTime\":\"2024-07-24T19:09:41.62Z\",\"malwareStates\":[{\"category\":null,\"family\":\"e99f40b2-9b8c-40c2-d6c6-08dcab45d2bf-3600466711026277654-1\",\"name\":null,\"severity\":null,\"wasRunning\":null},{\"category\":null,\"family\":\"e99f40b2-9b8c-40c2-d6c6-08dcab45d2bf-7067053706471445382-1\",\"name\":null,\"severity\":null,\"wasRunning\":null}],\"messageSecurityStates\":[],\"networkConnections\":[{\"applicationName\":null,\"destinationAddress\":null,\"destinationDomain\":null,\"destinationLocation\":null,\"destinationPort\":null,\"destinationUrl\":\"josebricenonunez.com\",\"direction\":null,\"domainRegisteredDateTime\":null,\"localDnsName\":null,\"natDestinationAddress\":null,\"natDestinationPort\":null,\"natSourceAddress\":null,\"natSourcePort\":null,\"protocol\":null,\"riskScore\":null,\"sourceAddress\":null,\"sourceLocation\":null,\"sourcePort\":null,\"status\":null,\"urlParameters\":null},{\"applicationName\":null,\"destinationAddress\":null,\"destinationDomain\":null,\"destinationLocation\":null,\"destinationPort\":null,\"destinationUrl\":\"josebricenonunez.com\",\"direction\":null,\"domainRegisteredDateTime\":null,\"localDnsName\":null,\"natDestinationAddress\":null,\"natDestinationPort\":null,\"natSourceAddress\":null,\"natSourcePort\":null,\"protocol\":null,\"riskScore\":null,\"sourceAddress\":null,\"sourceLocation\":null,\"sourcePort\":null,\"status\":null,\"urlParameters\":null}],\"processes\":[],\"recommendedActions\":[],\"registryKeyStates\":[],\"riskScore\":null,\"securityResources\":[],\"severity\":\"informational\",\"sourceMaterials\":[\"https://security.microsoft.com/viewalerts?id=74528a8f-50b3-8954-d200-08dcabfa173f\"],\"status\":\"resolved\",\"tags\":[],\"title\":\"Email messages containing malicious URL removed after delivery\u200b\",\"triggers\":[],\"uriClickSecurityStates\":[],\"userStates\":[{\"aadUserId\":null,\"accountName\":\"latesha.jacksonxikxv\",\"domainName\":\"umzhqdzs.connectcommunity.pt\",\"emailRole\":\"sender\",\"isVpn\":null,\"logonDateTime\":null,\"logonId\":null,\"logonIp\":\"178.78.232.124\",\"logonLocation\":null,\"logonType\":null,\"onPremisesSecurityIdentifier\":null,\"riskScore\":null,\"userAccountType\":null,\"userPrincipalName\":\"latesha.jacksonxikxv@umzhqdzs.connectcommunity.pt\"},{\"aadUserId\":null,\"accountName\":\"reese\",\"domainName\":\"wayne.com\",\"emailRole\":\"recipient\",\"isVpn\":null,\"logonDateTime\":null,\"logonId\":null,\"logonIp\":null,\"logonLocation\":null,\"logonType\":null,\"onPremisesSecurityIdentifier\":null,\"riskScore\":null,\"userAccountType\":null,\"userPrincipalName\":\"reese@wayne.com\"},{\"aadUserId\":null,\"accountName\":\"latesha.jacksonxikxv\",\"domainName\":\"umzhqdzs.connectcommunity.pt\",\"emailRole\":\"sender\",\"isVpn\":null,\"logonDateTime\":null,\"logonId\":null,\"logonIp\":\"178.78.232.124\",\"logonLocation\":null,\"logonType\":null,\"onPremisesSecurityIdentifier\":null,\"riskScore\":null,\"userAccountType\":null,\"userPrincipalName\":\"latesha.jacksonxikxv@umzhqdzs.connectcommunity.pt\"},{\"aadUserId\":null,\"accountName\":\"charles\",\"domainName\":\"wayne.com\",\"emailRole\":\"recipient\",\"isVpn\":null,\"logonDateTime\":null,\"logonId\":null,\"logonIp\":null,\"logonLocation\":null,\"logonType\":null,\"onPremisesSecurityIdentifier\":null,\"riskScore\":null,\"userAccountType\":null,\"userPrincipalName\":\"charles@wayne.com\"}],\"vendorInformation\":{\"provider\":\"Office 365 Security and Compliance\",\"providerVersion\":null,\"subProvider\":null,\"vendor\":\"Microsoft\"},\"vulnerabilityStates\":[]} ::: application=ThreatManagement ::: endTimeUTC=2024-07-24T19:09:41.62Z ::: created_at=2024-07-24T16:03:15.7644052Z ::: severityLabel=informational ::: serverIP=178.78.232.124 ::: emailTo=charles@wayne.com ::: program=azure_security ::: startTimeUTC=2024-07-24T16:03:15.7644052Z ::: severityCode=5 ::: streamName=azure_security_alert ::: tags=[Emails with malicious URL that were delivered and later removed -V1.0.0.3,Email messages containing malicious URL removed after delivery\u200b] ::: messageType=malicious_session ::: emailFrom=latesha.jacksonxikxv@umzhqdzs.connectcommunity.pt",
    "messagetype": "malicious_session",
    "program": "azure_security",
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 5,
    "severitylabel": "notice",
    "sourceinfo": "unknown",
    "starttimeutc": "2024-07-24T16:03:15.7644052Z",
    "tags": [
        "Emails with malicious URL that were delivered and later removed -V1.0.0.3",
        "Email messages containing malicious URL removed after delivery\u200b",
        "azure_security_alert",
        "malicious_session"
    ],
    "streamName": "azure_security_alert",
    "serverIP": "178.78.232.124"
}