WitFoo-Artifact ::: streamName=azure_security_alert ::: created_at=2024-07-16T05:24:08.3571799Z ::: tags=[Emails messages from a campaign were delivered and later removed -V1.0.0.2,Email messages from a campaign removed after delivery​] ::: startTimeUTC=2024-07-16T05:24:08.3571799Z ::: application=ThreatManagement ::: messageType=malicious_session ::: endTimeUTC=2024-07-16T09:09:28.3033333Z ::: program=azure_security ::: serverIP=167.231.229.29 ::: emailFrom=james1mumh@lzyoepaz.altuniverse.com.br ::: message={"activityGroupName":null,"alertDetections":[],"assignedTo":null,"azureSubscriptionId":null,"azureTenantId":"4055bd5f-b117-4bb4-befa-de484bd06de8","category":"ThreatManagement","closedDateTime":null,"cloudAppStates":[],"comments":["New alert"],"confidence":null,"createdDateTime":"2024-07-16T05:27:13.8966667Z","description":"Emails messages from a campaign were delivered and later removed -V1.0.0.2","detectionIds":[],"eventDateTime":"2024-07-16T05:24:08.3571799Z","feedback":null,"fileStates":[],"historyStates":[],"hostStates":[],"id":"7b9252aa-468e-8072-1800-08dca5577f86","incidentIds":[],"investigationSecurityStates":[],"lastEventDateTime":null,"lastModifiedDateTime":"2024-07-16T09:09:28.3033333Z","malwareStates":[{"category":null,"family":"7b5e7006-4457-40d6-c95f-08dca525f469-3600466711026277654-1","name":null,"severity":null,"wasRunning":null},{"category":null,"family":"7b5e7006-4457-40d6-c95f-08dca525f469-7430783637839457266-1","name":null,"severity":null,"wasRunning":null},{"category":null,"family":"7b5e7006-4457-40d6-c95f-08dca525f469-7067053706471445382-1","name":null,"severity":null,"wasRunning":null}],"messageSecurityStates":[],"networkConnections":[],"processes":[],"recommendedActions":[],"registryKeyStates":[],"riskScore":null,"securityResources":[],"severity":"informational","sourceMaterials":["https://security.microsoft.com/viewalerts?id=7b9252aa-468e-8072-1800-08dca5577f86"],"status":"resolved","tags":[],"title":"Email messages from a campaign removed after delivery​","triggers":[],"uriClickSecurityStates":[],"userStates":[{"aadUserId":null,"accountName":"james1mumh","domainName":"lzyoepaz.altuniverse.com.br","emailRole":"sender","isVpn":null,"logonDateTime":null,"logonId":null,"logonIp":"167.231.229.29","logonLocation":null,"logonType":null,"onPremisesSecurityIdentifier":null,"riskScore":null,"userAccountType":null,"userPrincipalName":"james1mumh@lzyoepaz.altuniverse.com.br"},{"aadUserId":null,"accountName":"reese","domainName":"oscorp.com","emailRole":"recipient","isVpn":null,"logonDateTime":null,"logonId":null,"logonIp":null,"logonLocation":null,"logonType":null,"onPremisesSecurityIdentifier":null,"riskScore":null,"userAccountType":null,"userPrincipalName":"reese@oscorp.com"},{"aadUserId":null,"accountName":"james1mumh","domainName":"lzyoepaz.altuniverse.com.br","emailRole":"sender","isVpn":null,"logonDateTime":null,"logonId":null,"logonIp":"167.231.229.29","logonLocation":null,"logonType":null,"onPremisesSecurityIdentifier":null,"riskScore":null,"userAccountType":null,"userPrincipalName":"james1mumh@lzyoepaz.altuniverse.com.br"},{"aadUserId":null,"accountName":"mike","domainName":"oscorp.com","emailRole":"recipient","isVpn":null,"logonDateTime":null,"logonId":null,"logonIp":null,"logonLocation":null,"logonType":null,"onPremisesSecurityIdentifier":null,"riskScore":null,"userAccountType":null,"userPrincipalName":"mike@oscorp.com"},{"aadUserId":null,"accountName":"james1mumh","domainName":"lzyoepaz.altuniverse.com.br","emailRole":"sender","isVpn":null,"logonDateTime":null,"logonId":null,"logonIp":"167.231.229.29","logonLocation":null,"logonType":null,"onPremisesSecurityIdentifier":null,"riskScore":null,"userAccountType":null,"userPrincipalName":"james1mumh@lzyoepaz.altuniverse.com.br"},{"aadUserId":null,"accountName":"charles","domainName":"oscorp.com","emailRole":"recipient","isVpn":null,"logonDateTime":null,"logonId":null,"logonIp":null,"logonLocation":null,"logonType":null,"onPremisesSecurityIdentifier":null,"riskScore":null,"userAccountType":null,"userPrincipalName":"charles@oscorp.com"}],"vendorInformation":{"provider":"Office 365 Security and Compliance","providerVersion":null,"subProvider":null,"vendor":"Microsoft"},"vulnerabilityStates":[]} ::: severityLabel=informational ::: emailTo=charles@oscorp.com ::: severityCode=5
This is a syslog message from a product called Azure Security by Microsoft. The following fields were extracted from the message:
application: ThreatManagement
emailfrom: james1mumh@lzyoepaz.altuniverse.com.br
emailto: charles@witfoo.com
endtimeutc: 2024-07-16T09:09:28.3033333Z
messagetype: malicious_session
program: azure_security
senderhost: kafka.precinct
sensitivity: normal
severitycode: 5
severitylabel: notice
sourceinfo: unknown
starttimeutc: 2024-07-16T05:24:08.3571799Z
tags: ['Emails messages from a campaign were delivered and later removed -V1.0.0.2', 'Email messages from a campaign removed after delivery\u200b', 'azure_security_alert', 'malicious_session']
streamName: azure_security_alert
serverIP: 167.231.229.29