1Password - User account MFA settings changed

Severity: medium
Time window: 30m
Source: github.com/Azure/Azure-Sentinel

This will alert when a user creates, updates, or disables the user account MFA settings. Once this analytics rule is triggered it will group all related future alerts for upto an hour when all related entities are the same. Ref: https://1password.com/ Ref: https://github.com/securehats/

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1556` Modify Authentication Process

Telemetry coverage

Platform	Record / event type
1Password	any: User (catch-all)

Rule body

id: 3c8140eb-e946-4bf2-8c61-03e4df56d400
name: 1Password - User account MFA settings changed
version: 1.0.0
kind: Scheduled
description: |-
  This will alert when a user creates, updates, or disables the user account MFA settings. Once this analytics rule is triggered it will group all related future alerts for upto an hour when all related entities are the same.

  Ref: https://1password.com/
  Ref: https://github.com/securehats/
severity: Medium
requiredDataConnectors:
  - connectorId: 1Password
    dataTypes:
      - OnePasswordEventLogs_CL
queryFrequency: 30m
queryPeriod: 30m
triggerOperator: gt
triggerThreshold: 0
tactics:
- Persistence
- DefenseEvasion
relevantTechniques:
- T1556
query: |-
  OnePasswordEventLogs_CL
  | where log_source == "auditevents"
  | where action has_any("enblmfa", "updatmfa", "disblmfa")
  | where object_type == "user"
  | extend
      ActorUsername = actor_details.email
      , SrcIpAddr = session.ip
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1h
    matchingMethod: AllEntities
suppressionDuration: 5h
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: ActorUsername
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SrcIpAddr

Stages and Predicates

Stage 1: `source`

OnePasswordEventLogs_CL

Stage 2: `where`

| where log_source == "auditevents"

Stage 3: `where`

| where action has_any("enblmfa", "updatmfa", "disblmfa")

Stage 4: `where`

| where object_type == "user"

Stage 5: `extend`

| extend
    ActorUsername = actor_details.email
    , SrcIpAddr = session.ip

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`action`	match	`disblmfa` transforms: `term` `enblmfa` transforms: `term` `updatmfa` transforms: `term`	`field:"action" kind:match`
`log_source`	eq	`auditevents`	`field:"log_source" kind:eq value:"auditevents"`
`object_type`	eq	`user`	`field:"object_type" kind:eq value:"user"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`ActorUsername`	`extend`
`SrcIpAddr`	`extend`