1Password - Service account integration token adjustment

Severity: medium
Time window: 5m
Source: github.com/Azure/Azure-Sentinel

This will alert when a service account integration token has been created, renamed, verified, or revoked. Once this analytics rule is triggered it will group all related future alerts for upto an hour when all related entities are the same. Ref: https://1password.com/ Ref: https://github.com/securehats/

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1134` Access Token Manipulation

Telemetry coverage

Platform	Record / event type
1Password	any: Service account token (catch-all)

Rule body

id: d54a3cf9-6169-449c-83f1-e7def3359702
name: 1Password - Service account integration token adjustment
version: 1.0.0
kind: Scheduled
description: |-
  This will alert when a service account integration token has been created, renamed, verified, or revoked. Once this analytics rule is triggered it will group all related future alerts for upto an hour when all related entities are the same.

  Ref: https://1password.com/
  Ref: https://github.com/securehats/
severity: Medium
requiredDataConnectors:
  - connectorId: 1Password
    dataTypes:
      - OnePasswordEventLogs_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
- DefenseEvasion
relevantTechniques:
- T1134
query: |-
  OnePasswordEventLogs_CL
  | where log_source == "auditevents"
  | where action has_any("create", "trename", "tverify", "trevoke")
  | where object_type == "satoken"
  | extend
      ActorUsername = actor_details.email
      , SrcIpAddr = session.ip
subTechniques:
- T1134.003
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1h
    matchingMethod: AllEntities
suppressionDuration: 5h
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: ActorUsername
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SrcIpAddr

Stages and Predicates

Stage 1: `source`

OnePasswordEventLogs_CL

Stage 2: `where`

| where log_source == "auditevents"

Stage 3: `where`

| where action has_any("create", "trename", "tverify", "trevoke")

Stage 4: `where`

| where object_type == "satoken"

Stage 5: `extend`

| extend
    ActorUsername = actor_details.email
    , SrcIpAddr = session.ip

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`action`	match	`create` transforms: `term` `trename` transforms: `term` `trevoke` transforms: `term` `tverify` transforms: `term`	`field:"action" kind:match`
`log_source`	eq	`auditevents`	`field:"log_source" kind:eq value:"auditevents"`
`object_type`	eq	`satoken`	`field:"object_type" kind:eq value:"satoken"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`ActorUsername`	`extend`
`SrcIpAddr`	`extend`