WASOC Threat Intelligence Repository

This repository contains Threat Intelligence content from Western Australian Security Operations Center.

Table of Contents

1. Analytic Rules and deployments
2. Analytic Rule deployment guide

Analytic Rules for detections with Threat Intelligence

The following Analytic rules can be deployed to Microsoft Sentinel environment to enable the detection of suspicious/potentially malicious activity based on Threat Intelligence shared by WASOC.

Rule Name	Deploy Rule
Phishing domain-name accessed by users - DeviceNetworkEvents
Phishing Url accessed by users - DeviceEvents
Phishing Url clicked by users - UrlClickEvents
Suspicious sign-in attempts from malicious IPs related to phishing - OfficeActivity
Office Activity from malicious IPs related to phishing - OfficeActivity
Phishing email potentially delivered to users mailbox
Detect inbound traffic from IP address(s) known (by WASOC) for active exploitation of vulnerabilities

Analytic Rule Deployment guide

---

Click on the Deploy to Azure button on the table in 'Analytic Rules and deployments' and follow the below instructions for the deployment.

Step 1

Fill in the relevant details of the listed items as noted below.

1. Select the Subscription your workspace is under
2. Select the specific Resource Group
3. Select the Region
4. Provide your Workspace Name found under Log Analytics workspace settings
5. Leave the newGuid() to generate a unique Rule Id for your rule

Step 2

Ensure the details provided in the previous stage are all accurate and proceed to the next step.

Step 3

If the analytic rule has been successfully deployed, you will see the below screen. Click on the 'Go to Resource' button to view the deployed analytic rule(s). You can also navigate to the Analytics blade in the Microsoft Sentinel environment to confirm if the rules have successfully been deployed.