GroupMembership

Action	Sample	Rule
Join Group	Y	Y
Leave Group	Y	N
Change Group Membership Role	N	N

gm-join: Join Group

Description

A user joined a group.

Fields #

Name	Description	Rules
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`actor_uuid`	Actor identifier.
`actor_details.uuid`	Actor identifier.
`actor_details.name`	Actor's full name.
`actor_details.email`	Actor's email address.
`actor_type`	Type of actor.
`actor_account_uuid`	1Password account identifier of the actor.
`account_uuid`	1Password account identifier.
`action`	Action performed.	1 detection rule
`object_type`	Type of affected object.	1 detection rule
`object_uuid`	Identifier of the affected object.	1 detection rule
`object_details.uuid`	Affected user identifier, when applicable.
`object_details.name`	Affected user's full name, when applicable.
`object_details.email`	Affected user's email address, when applicable.
`aux_id`	Numeric identifier for related event data.
`aux_uuid`	Identifier for related event data.
`aux_details.uuid`	Related user identifier, when applicable.
`aux_details.name`	Related user's full name, when applicable.
`aux_details.email`	Related user's email address, when applicable.
`aux_info`	Additional event information.
`session.uuid`	Session identifier.
`session.login_time`	Time the session started.
`session.device_uuid`	Identifier of the session device.
`session.ip`	IP address used for the session.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.

Example Event #

The source export stringifies aux_id; the 1Password Events API schema defines aux_id as an integer.

{
  "uuid": "7IEPLBPSJX3N473UMJVQGS2UGW",
  "timestamp": "12/15/2023, 10:54:41.356 AM",
  "location": {
    "country": "The Netherlands",
    "region": "North Holland",
    "city": "Amsterdam",
    "latitude": 52.3759,
    "longitude": 4.8975
  },
  "actor_uuid": "AVHAFAP4PRDF5K3724I67N3CEU",
  "actor_details": {
    "uuid": "AVHAFAP4PRDF5K3724I67N3CEU",
    "name": "Automated User Provisioning",
    "email": "zkv4c3mauxjbw@1passwordserviceaccounts.com"
  },
  "action": "join",
  "object_type": "gm",
  "object_uuid": "l4oh2ghravchmzkuactjffwieu",
  "aux_id": "11848060",
  "aux_uuid": "AVHAFAP4PRDF5K3724I67N3CEU",
  "aux_details": {
    "uuid": "AVHAFAP4PRDF5K3724I67N3CEU",
    "name": "Automated User Provisioning",
    "email": "zkv4c3mauxjbw@1passwordserviceaccounts.com"
  },
  "aux_info": "A",
  "session": {
    "uuid": "TPEFXHZ62ZGTHCHMSNEMLLDPMA",
    "login_time": "2023-12-14T11:39:44.9931456Z",
    "device_uuid": "pjleru42mvdhql4nl7mab6ympm",
    "ip": "4.175.88.205"
  }
}

Common Indicators #

Positive field/value combinations most frequently checked by detection rules attached to this catalog entry, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`actor_details.email` (kusto rule field)	macro	`(tostring(actor_details.email) != tostring(aux_details.email))`	1 rule	kusto
`object_type` (kusto rule field)	eq	`gm`	1 rule	kusto

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Kusto #

1Password - User added to privileged group source medium: This will alert when a user is added to a privileged group which has been implemented by an actor that was not the target user account. Once the analytics rule is triggered it will group all related future alerts for upto 30 minutes when all related entities are the same. Ref: https://1password.com/ Ref: https://github.com/securehats/T1098

References #

gm-leave: Leave Group

Description

A user left a group.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`actor_uuid`	Actor identifier.
`actor_details.uuid`	Actor identifier.
`actor_details.name`	Actor's full name.
`actor_details.email`	Actor's email address.
`actor_type`	Type of actor.
`actor_account_uuid`	1Password account identifier of the actor.
`account_uuid`	1Password account identifier.
`action`	Action performed.
`object_type`	Type of affected object.
`object_uuid`	Identifier of the affected object.
`object_details.uuid`	Affected user identifier, when applicable.
`object_details.name`	Affected user's full name, when applicable.
`object_details.email`	Affected user's email address, when applicable.
`aux_id`	Numeric identifier for related event data.
`aux_uuid`	Identifier for related event data.
`aux_details.uuid`	Related user identifier, when applicable.
`aux_details.name`	Related user's full name, when applicable.
`aux_details.email`	Related user's email address, when applicable.
`aux_info`	Additional event information.
`session.uuid`	Session identifier.
`session.login_time`	Time the session started.
`session.device_uuid`	Identifier of the session device.
`session.ip`	IP address used for the session.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.

Example Event #

The source export stringifies aux_id; the 1Password Events API schema defines aux_id as an integer.

{
  "uuid": "CFHE6GAZKDOAEBV7JGVF7EJBFG",
  "timestamp": "1/3/2024, 1:16:09.412 PM",
  "location": {
    "country": "The Netherlands",
    "region": "North Brabant",
    "city": "Rijen",
    "latitude": 51.5923,
    "longitude": 4.9218
  },
  "actor_uuid": "QD3Q2WVSVZFHZMC3O6HY3VSC6Y",
  "actor_details": {
    "uuid": "QD3Q2WVSVZFHZMC3O6HY3VSC6Y",
    "name": "Walter White",
    "email": "walter.white@securehats.nl"
  },
  "action": "leave",
  "object_type": "gm",
  "object_uuid": "mewjxg24s7mdhmel2akm73bway",
  "aux_id": "11935842",
  "aux_uuid": "Q3IELCBNUFAYXAECYF6FHCLXXQ",
  "aux_details": {
    "uuid": "Q3IELCBNUFAYXAECYF6FHCLXXQ",
    "name": "Nigel Powers",
    "email": "nigel.powers@securehats.nl"
  },
  "session": {
    "uuid": "2JERYZS455CLZJFLYPUPLCAWYE",
    "login_time": "2024-01-03T13:14:12.2688730Z",
    "device_uuid": "uh7t35mrsnycrf4vz6wbdhs4y4",
    "ip": "76.75.244.76"
  }
}

References #

gm-role: Change Group Membership Role

Description

A user's group membership role was changed.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`actor_uuid`	Actor identifier.
`actor_details.uuid`	Actor identifier.
`actor_details.name`	Actor's full name.
`actor_details.email`	Actor's email address.
`actor_type`	Type of actor.
`actor_account_uuid`	1Password account identifier of the actor.
`account_uuid`	1Password account identifier.
`action`	Action performed.
`object_type`	Type of affected object.
`object_uuid`	Identifier of the affected object.
`object_details.uuid`	Affected user identifier, when applicable.
`object_details.name`	Affected user's full name, when applicable.
`object_details.email`	Affected user's email address, when applicable.
`aux_id`	Numeric identifier for related event data.
`aux_uuid`	Identifier for related event data.
`aux_details.uuid`	Related user identifier, when applicable.
`aux_details.name`	Related user's full name, when applicable.
`aux_details.email`	Related user's email address, when applicable.
`aux_info`	Additional event information.
`session.uuid`	Session identifier.
`session.login_time`	Time the session started.
`session.device_uuid`	Identifier of the session device.
`session.ip`	IP address used for the session.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.

References #

any: Group membership (catch-all)

Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.

Description

Scope-level aggregate for rules that match any group membership event. Not a distinct 1Password Events API record.

Fields #

Name	Description	Rules
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`actor_uuid`	Actor identifier.
`actor_details.uuid`	Actor identifier.
`actor_details.name`	Actor's full name.
`actor_details.email`	Actor's email address.
`actor_type`	Type of actor.
`actor_account_uuid`	1Password account identifier of the actor.
`account_uuid`	1Password account identifier.
`action`	Action performed.	1 detection rule
`object_type`	Type of affected object.	1 detection rule
`object_uuid`	Identifier of the affected object.
`object_details.uuid`	Affected user identifier, when applicable.
`object_details.name`	Affected user's full name, when applicable.
`object_details.email`	Affected user's email address, when applicable.
`aux_id`	Numeric identifier for related event data.
`aux_uuid`	Identifier for related event data.
`aux_details.uuid`	Related user identifier, when applicable.
`aux_details.name`	Related user's full name, when applicable.
`aux_details.email`	Related user's email address, when applicable.
`aux_info`	Additional event information.
`session.uuid`	Session identifier.
`session.login_time`	Time the session started.
`session.device_uuid`	Identifier of the session device.
`session.ip`	IP address used for the session.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.

Common Indicators #

Field	Kind	Value	Rules	Vendors
`actor_details.email` (kusto rule field)	macro	`(tostring(actor_details.email) == tostring(aux_details.email))`	1 rule	kusto
`log_source` (kusto rule field)	eq	`auditevents`	1 rule	kusto
`object_type` (kusto rule field)	eq	`gm`	1 rule	kusto

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Kusto #

1Password - Potential insider privilege escalation via group source medium: This will alert when an actor grants, or updates their own permissions via a group. Once this analytics rule is triggered it will group all related future alerts for upto an hour when all related entities are the same. Ref: https://1password.com/ Ref: https://github.com/securehats/T1078