Whisper Security - Newly Registered Domain on Threat ASN

Original query, unchanged.

// MITRE ATT&CK: T1583.001 - Acquire Infrastructure: Domains
// Tactic: Resource Development
// Correlates newly registered domains with high-threat ASN reputation data
let maxDomainAgeDays = 7;
let asnThreatThreshold = 50;
// Defensive: WhisperInfraChainPipeline currently emits domainAge=-1 as a
// sentinel when the create date is unknown (tracked bug - proper fix needs
// CALL whisper.history() integration). Filter the sentinel out so the rule
// does not fire on every domain with an ASN.
let newDomains = WhisperInfraContext_CL
    | where TimeGenerated > ago(1d)
    | where domainAge >= 0 and domainAge < maxDomainAgeDays
    | where isnotempty(asns)
    | extend parsedAsn = tostring(split(asns, ",")[0])
    | extend parsedIp = tostring(split(ipAddresses, ",")[0])
    | project TimeGenerated, indicator, domainAge, parsedAsn, parsedIp, registrar, countries;
let threatAsns = WhisperASNReputation_CL
    | where TimeGenerated > ago(1d)
    | where maxThreatScore > asnThreatThreshold
    | project asn, asnName, reputationScore, reputationLevel, maxThreatScore;
newDomains
    | join kind=inner (threatAsns) on $left.parsedAsn == $right.asn
    | extend DnsDomain = indicator, IPAddress = parsedIp
    | project TimeGenerated, DnsDomain, IPAddress, domainAge, registrar, countries, asn, asnName, reputationScore, reputationLevel, maxThreatScore