Kusto rules: 2h

id: 944d0ab5-b654-47f9-a398-2e77a0b7906e
name: "[Entra ID] Domain Federation Trust Settings Modified"
version: 1.0.0
kind: Scheduled
description: |
  Detects changes to domain federation trust settings or domain authentication mode. These changes can be used to redirect sign-in trust and should be reviewed immediately.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: AzureActiveDirectory
    dataTypes:
      - AuditLogs
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CredentialAccess
  - Persistence
relevantTechniques:
  - T1555
  - T1098
query: |
  (union isfuzzy=true
      (
      AuditLogs
      | where OperationName =~ "Set federation settings on domain"
      //| where Result =~ "success"   // commenting out, as it may be interesting to capture failed attempts
      | mv-expand TargetResources
      | extend modifiedProperties = parse_json(TargetResources).modifiedProperties
      | mv-expand modifiedProperties
      | extend targetDisplayName = tostring(parse_json(modifiedProperties).displayName)
      ),
      (
      AuditLogs
      | where OperationName =~ "Set domain authentication"
      //| where Result =~ "success"   // commenting out, as it may be interesting to capture failed attempts
      | mv-expand TargetResources
      | extend modifiedProperties = parse_json(TargetResources).modifiedProperties
      | mv-expand modifiedProperties
      | mv-apply Property = modifiedProperties on
          (
          where Property.displayName =~ "LiveType"
          | extend
              targetDisplayName = tostring(Property.displayName),
              NewDomainValue = tostring(Property.newValue)
          )
      | where NewDomainValue has "Federated"
      )
  )
  | mv-apply AdditionalDetail = AdditionalDetails on
      (
      where AdditionalDetail.key =~ "User-Agent"
      | extend UserAgent = tostring(AdditionalDetail.value)
      )
  | extend InitiatingUserOrApp = iff(isnotempty(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName))
  | extend InitiatingAppName = tostring(InitiatedBy.app.displayName)
  | extend InitiatingAppServicePrincipalId = tostring(InitiatedBy.app.servicePrincipalId)
  | extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)
  | extend InitiatingAadUserId = tostring(InitiatedBy.user.id)
  | extend InitiatingIpAddress = tostring(iff(isnotempty(InitiatedBy.user.ipAddress), InitiatedBy.user.ipAddress, InitiatedBy.app.ipAddress))
  | extend InitiatingAppServicePrincipalName = tostring(InitiatedBy.app.displayName)
  | extend
      InitiatingAccountName = tostring(split(InitiatingUserPrincipalName, "@")[0]),
      InitiatingAccountUPNSuffix = tostring(split(InitiatingUserPrincipalName, "@")[1])
  | extend Source_Network_IPLocation = ""
  | project
      Alert_Time_TW = datetime_utc_to_local(TimeGenerated, 'Asia/Taipei'),
      Alert_Time_UTC0 = TimeGenerated,
          Alert_Category_en = "Entra ID",
      Alert_SubCategory_en = "Anomaly Config Modification",
      Alert_Name_en = "Domain Federation Trust Settings Modified",
      Alert_Description_en=strcat(
                           "At Taiwan time: ",
                           format_datetime(datetime_utc_to_local(TimeGenerated, "Asia/Taipei"), "yyyy-MM-dd HH:mm:ss"),
                           " in Entra ID:  ",
                           "",
                           ", detected that Entra ID domain authentication was set to Federated",
                           " operation action: ",
                           iff(isnotempty(OperationName), OperationName, "<NoOperationName>"),
                           ", changed property: ",
                           iff(isnotempty(targetDisplayName), targetDisplayName, "<NoProperty>"),
                           ", operator/application: ",
                           iff(isnotempty(InitiatingUserOrApp), InitiatingUserOrApp, "<NoInitiator>"),
                           ", source IP: ",
                           iff(isnotempty(InitiatingIpAddress), InitiatingIpAddress, "<NoIP>"),
                           ", location: ",
                           iff(isnotempty(Source_Network_IPLocation), Source_Network_IPLocation, "<NoLocation>"),
                           ", User-Agent:",
                           iff(isnotempty(UserAgent), UserAgent, "<NoUserAgent>"),
                           "This is a high-risk domain-level change that may allow the entire tenant identity to be taken over by external federation."
                       ),
      Alert_TriageStep_en=strcat(
                          "1. Confirm whether the change was authorized. Operation action: ",
                          iff(isnotempty(OperationName), OperationName, "<NoOperationName>"),
                          ", operator: ",
                          iff(isnotempty(InitiatingUserOrApp), InitiatingUserOrApp, "<NoInitiator>"),
                          "  has formal approval.",
                          "2. Check source risk. Source IP: ",
                          iff(isnotempty(InitiatingIpAddress), InitiatingIpAddress, "<NoIP>"),
                          ", location: ",
                          iff(isnotempty(Source_Network_IPLocation), Source_Network_IPLocation, "<NoLocation>"),
                          "  is a company named location or an abnormal country.",
                          "3. Check the operation tool User-Agent: ",
                          iff(isnotempty(UserAgent), UserAgent, "<NoUserAgent>"),
                          "  to determine whether it is an expected management entry point (Portal/PowerShell/Graph) or a suspicious script.",
                          "4. Immediately inventory the impact scope: confirm which domains were set to Federated and whether all user sign-in flows are affected."
                      ),
      Alert_Containment_en=strcat(
                           "1. If determined to be an unauthorized change, immediately change the affected domain authentication method back to Managed and remove any unauthorized Federation settings. ",
                           "2. Immediately revoke the operator's sign-in tokens and administrative permissions, and reset the password and re-register MFA if necessary. ",
                           "3. Block the source IP immediately or restrict management-plane access to prevent continued change attempts. ",
                           "4. Initiate tenant emergency response: check whether any accounts have successfully signed in through the Federated domain and performed administrative operations."
                       ),
      Alert_Remediation_en=strcat(
                           "1. Strengthen domain-level governance: limit the role scope that can execute Set federation / Set domain authentication, and enforce two-person review. ",
                           "2. Strengthen Conditional Access: allow management-plane operations only from named locations, compliant devices, and MFA, and directly block abnormal countries or new User-Agents. ",
                           "3. Automated detection and response: establish SOAR for related events (notification, account suspension, source IP blocking). ",
                           "4. Regularly audit domain and federation settings: inventory all domain authentication modes and remove unnecessary or unused Federation and trust relationships."
                       ),
              //Event_Code = AliveTime,
      Event_Action = OperationName,
      //Event_Description = Role ,
      Event_TimeRange_Start_TW = datetime_utc_to_local(TimeGenerated, 'Asia/Taipei'),
      Event_TimeRange_End_TW = datetime_utc_to_local(TimeGenerated, 'Asia/Taipei'),
      Source_Identity_FullName = InitiatingUserOrApp,
      Source_Identity_Type = iff(isnotempty(InitiatingUserPrincipalName), "User", "Service"),
      Source_Network_IPAddress = InitiatingIpAddress,
      Source_Network_IPLocation = Source_Network_IPLocation,
      Source_Identity_DomainType = iff(InitiatingUserPrincipalName contains "EXT", 'External', 'Internal'),
      Source_Resource_Name = UserAgent,
      Target_Identity_ID = targetDisplayName,
      //Target_Identity_Type = "Service",
      Target_Resource_ID = "",
      Target_Resource_Name = "Microsoft Entra ID",
      Target_Resource_Type = "Microsoft Entra ID"
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: Source_Identity_FullName
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: Source_Network_IPAddress

id: 5f0d80db-3415-4265-9d52-8466b7372e3a
name: Azure DevOps PAT used with Browser
description: |
  'Personal Access Tokens (PATs) are used as an alternate password to authenticate into Azure DevOps. PATs are intended for programmatic access use in code or applications. 
  This can be prone to attacker theft if not adequately secured. This query looks for the use of a PAT in authentication but from a User Agent indicating a browser. 
  This should not be normal activity and could be an indicator of an attacker using a stolen PAT.'
severity: Medium
status: Available
requiredDataConnectors: []
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CredentialAccess
relevantTechniques:
  - T1528
query: |
  ADOAuditLogs
  | where AuthenticationMechanism startswith "PAT"
  // Look for useragents that include a redenring engine
  | where UserAgent has_any ("Gecko", "WebKit", "Presto", "Trident", "EdgeHTML", "Blink")
  | extend AccountName = tostring(split(ActorUPN, "@")[0]), AccountUPNSuffix = tostring(split(ActorUPN, "@")[1])
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: ActorUPN
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountUPNSuffix
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IpAddress
version: 1.0.6
kind: Scheduled

id: 5efb0cfd-063d-417a-803b-562eae5b0301
name: Azure DevOps Service Connection Addition/Abuse - Historic allow list
description: |
  'This detection builds an allow list of historic service connection use by Builds and Releases and compares to recent history, flagging growth of service connection use which are not manually included in the allow list and not historically included in the allow list Build/Release runs.
  This is to determine if someone is hijacking a build/release and adding many service connections in order to abuse or dump credentials from service connections.'
severity: Medium
status: Available
requiredDataConnectors: []
queryFrequency: 6h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Persistence
  - Impact
relevantTechniques:
  - T1098
  - T1496
query: |
  let starttime = 14d;
  let endtime = 6h;
  // Ignore Build/Releases with less/equal this number
  let ServiceConnectionThreshold = 3;
  // New Connections need to exhibit execution of more "new" connections than this number.
  let NewConnectionThreshold = 1;
  // List of Builds/Releases to ignore in your space
  let BypassDefIds = datatable(DefId:string, Type:string, ProjectName:string)
  [
  //"103", "Release", "ProjectA",
  //"42", "Release", "ProjectB",
  //"122", "Build", "ProjectB"
  ];
  let HistoricDefs = ADOAuditLogs
  | where TimeGenerated between (ago(starttime) .. ago(endtime))
  | where OperationName == "Library.ServiceConnectionExecuted"
  | extend DefId = tostring(Data.DefinitionId), Type = tostring(Data.PlanType), ConnectionId = tostring(Data.ConnectionId)
  | summarize HistoricCount = dcount(tostring(ConnectionId)), ConnectionNames = make_set(tostring(Data.ConnectionName))
    by DefId = tostring(DefId), Type = tostring(Type), ProjectId, ProjectName, ActorUPN;
  ADOAuditLogs
  | where TimeGenerated >= ago(endtime)
  | where OperationName == "Library.ServiceConnectionExecuted"
  | extend DefId = tostring(Data.DefinitionId), Type = tostring(Data.PlanType), ConnectionId = tostring(Data.ConnectionId)
  | parse ScopeDisplayName with OrganizationName ' (Organization)'
  | summarize CurrentCount = dcount(tostring(ConnectionId)), ConnectionNames = make_set(tostring(Data.ConnectionName)), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated)
    by OrganizationName, DefId = tostring(DefId), Type = tostring(Type), ProjectId, ProjectName, ActorUPN
  | where CurrentCount > ServiceConnectionThreshold
  | join (HistoricDefs) on ProjectId, DefId, Type, ActorUPN
  | join kind=anti BypassDefIds on $left.DefId==$right.DefId and $left.Type == $right.Type and $left.ProjectName == $right.ProjectName
  | extend link = iff(
  Type == "Build", strcat('https://dev.azure.com/', OrganizationName, '/', ProjectName, '/_build?definitionId=', DefId),
  strcat('https://dev.azure.com/', OrganizationName, '/', ProjectName, '/_release?_a=releases&view=mine&definitionId=', DefId))
  | where CurrentCount >= HistoricCount + NewConnectionThreshold
  | project StartTime, OrganizationName, ProjectName, DefId, link, RecentDistinctServiceConnections = CurrentCount, HistoricDistinctServiceConnections = HistoricCount,
    RecentConnections = ConnectionNames, HistoricConnections = ConnectionNames1, ActorUPN
  | extend timestamp = StartTime
  | extend AccountName = tostring(split(ActorUPN, "@")[0]), AccountUPNSuffix = tostring(split(ActorUPN, "@")[1])
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: ActorUPN
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountUPNSuffix
version: 1.0.6
kind: Scheduled

id: e3c95148-04b6-4165-b9a6-a107f8a119d9
name: BloodHound Attack Path Finding - Large Default Groups in DCOM Users Groups
description: BloodHound Attack Path Finding - Large Default Groups in DCOM Users Groups
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: BloodHoundEnterprise
    dataTypes:
      - BHEAttackPathsData_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics: []
relevantTechniques: []
query: BHEAttackPathsData_CL | where Finding == "LargeDefaultGroupsDCOM"
entityMappings:
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: domain_name
customDetails:
  Description: ShortDescription
  Remediation: ShortRemediation
version: 1.0.0
kind: Scheduled

id: 645b0f09-f318-41c3-860d-6c0fb595af2b
name: BloodHound Attack Path Finding - WriteOwnerLimitedRights Privileges on Tier
  Zero Objects
description: BloodHound Attack Path Finding - WriteOwnerLimitedRights Privileges on
  Tier Zero Objects
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: BloodHoundEnterprise
    dataTypes:
      - BHEAttackPathsData_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics: []
relevantTechniques: []
query: BHEAttackPathsData_CL | where Finding == "T0WriteOwnerLimitedRights"
entityMappings:
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: domain_name
customDetails:
  Description: ShortDescription
  Remediation: ShortRemediation
version: 1.0.0
kind: Scheduled

id: b58af025-1b74-436a-8517-b230864cbbb6
name: BloodHound Attack Path Finding - WriteServicePrincipalName Privileges on Tier
  Zero Objects
description: BloodHound Attack Path Finding - WriteServicePrincipalName Privileges
  on Tier Zero Objects
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: BloodHoundEnterprise
    dataTypes:
      - BHEAttackPathsData_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics: []
relevantTechniques: []
query: BHEAttackPathsData_CL | where Finding == "T0WriteSPN"
entityMappings:
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: domain_name
customDetails:
  Description: ShortDescription
  Remediation: ShortRemediation
version: 1.0.0
kind: Scheduled

id: edbf38d7-e170-4af2-ad50-1a05b374611b
name: Box - Inactive user login
description: |
  'Detects user login after long inactivity period.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: BoxDataConnector
    dataTypes:
      - BoxEvents_CL
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1078
query: |
  let lbperiod_start = 14d;
  let lbperiod_end = 7d;
  let lbtime = 1h;
  let active_users = BoxEvents
  | where EventEndTime between (ago(lbperiod_end) .. ago(lbtime))
  | where EventType =~ 'LOGIN'
  | summarize makeset(SourceName);
  let inactive_users = BoxEvents
  | where EventEndTime between (ago(lbperiod_start) .. ago(lbperiod_end))
  | where EventType =~ 'LOGIN'
  | where SourceName !in (active_users)
  | summarize makeset(SourceName);
  BoxEvents
  | where EventType == 'LOGIN'
  | where SourceName in (inactive_users)
  | extend AccountCustomEntity = SourceName
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
version: 1.0.1
kind: Scheduled

id: aa5eaac7-1264-4833-b620-8f062be75541
name: Certified Pre-Owned - backup of CA private key - rule 1
description: |
  This query identifies someone that performs a read operation of they CA key from the file.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
  - connectorId: WindowsSecurityEvents
    dataTypes:
      - SecurityEvent
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1036
query: |
  SecurityEvent
  // Fill in the machine name of your CA.
  | where EventID == 5058 and Computer contains "<YOUR CA MACHINE NAME>"
  | where EventData contains "%%2499" // Machine key.
  | extend EventData=parse_xml(EventData)
  | mv-apply d=EventData.EventData.Data on
  (
      where d["@Name"]=="KeyName"
      | project KeyName=tostring(d["#text"])
  )
  | mv-apply d=EventData.EventData.Data on
  (
      where d["@Name"]=="SubjectUserName"
      | project SubjectUserName=tostring(d["#text"])
  )
  | mv-apply d=EventData.EventData.Data on
  (
      where d["@Name"]=="Operation"
      | project Operation=tostring(d["#text"])
  )
  | extend Operation=iff(Operation == "%%2458", "Read persisted key from file", Operation)
  // This one is a guess and very poorly documented :(
  | extend Operation=iff(Operation == "%%2459", "Write persisted key to file", Operation)
  // Fill in the keyname of the CA key.
  | where KeyName == "<INSERT ISSUING CA KEY HERE>" // Or any other key you want to monitor.

entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: Computer
version: 1.0.1
kind: Scheduled

id: 729c6d21-fad9-4a6a-9c7f-482393c95958
name: Cloudflare - Empty user agent
description: |
  'Detects requests where user agent is empty.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: CloudflareDataConnector
    dataTypes:
      - Cloudflare
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1190
  - T1133
query: |
  Cloudflare
  | where isempty(HttpUserAgentOriginal)
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SrcIpAddr
version: 1.0.1
kind: Scheduled

id: 05850746-9ae4-412f-838b-844f0903f4a9
name: Corelight - External Proxy Detected
description: |
  'Detects external proxy usage.'
severity: Low
status: Available
requiredDataConnectors:
  - connectorId: Corelight
    dataTypes:
      - corelight_http
      - corelight_http_red
      - corelight_http2
      - corelight_http_agg
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - DefenseEvasion
  - CommandAndControl
relevantTechniques:
  - T1090 
query: |
  union isfuzzy=true corelight_http, corelight_http_agg
  | where isnotempty(proxied)
  | where not(ipv4_is_private(id_orig_h))
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: id_orig_h
version: 2.2.0
kind: Scheduled

id: c5e75cb6-cea0-49c2-a998-da414035aac1
kind: Scheduled
name: Dataverse - Terminated employee exfiltration to USB drive
description: Identifies files downloaded from Dataverse by departing or terminated
  employees which are copied to USB mounted drives.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: Dataverse
    dataTypes:
      - DataverseActivity
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceInfo
      - DeviceEvents
      - DeviceFileEvents
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Exfiltration
relevantTechniques:
  - T1052
query: |
  let drive_mount_lookback = 14d;
  let query_frequency = 1h;
  DataverseActivity
  | distinct InstanceUrl
  | join kind=inner (DeviceFileEvents
      | where TimeGenerated >= ago(query_frequency))
      on $left.InstanceUrl == $right.FileOriginUrl
  | join kind=inner (MSBizAppsTerminatedEmployees()) on $left.InitiatingProcessAccountUpn == $right.UserPrincipalName
  | join kind=inner (DeviceEvents
      | where TimeGenerated >= ago(drive_mount_lookback)
      | where ActionType == "UsbDriveMounted"
      | extend DriveLetter = tostring(AdditionalFields.DriveLetter)
      | summarize MountedDriveLetters = make_set(DriveLetter, 26) by DeviceId, DeviceName)
      on DeviceId
  | extend TargetDriveLetter = tostring(split(FolderPath, "\\")[0])
  | where set_has_element(MountedDriveLetters, TargetDriveLetter)
  | join kind=inner (DeviceInfo
      | summarize arg_max(TimeGenerated, DeviceId, PublicIP) by DeviceName)
      on DeviceId
  | project-rename
      UserId = UserPrincipalName
  | summarize LatestEvent = arg_max(TimeGenerated, *), Files = make_set(FileName, 100) by UserId, InstanceUrl
  | extend
      CloudAppId = int(32780),
      AccountName = tostring(split(UserId, '@')[0]),
      UPNSuffix = tostring(split(UserId, '@')[1])
  | project
      LatestEvent,
      UserId,
      PublicIP,
      Files,
      InstanceUrl,
      CloudAppId,
      AccountName,
      UPNSuffix
eventGroupingSettings:
  aggregationKind: AlertPerResult
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: UPNSuffix
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: PublicIP
  - entityType: CloudApplication
    fieldMappings:
      - identifier: AppId
        columnName: CloudAppId
      - identifier: InstanceName
        columnName: InstanceUrl
alertDetailsOverride:
  alertDisplayNameFormat: Dataverse - terminated user copied files from {{InstanceUrl}}
    to USB
  alertDescriptionFormat: '{{UserId}} , on the TerminatedUsers watchlist, was found
    to copy files to a USB mounted drive.'
customDetails: {}
version: 3.2.0

id: 8138863e-e55f-4f02-ac94-72796e203d27
name: Defender Alert Evidence
version: 1.0.0
type: Microsoft.OperationalInsights/workspaces/providers/alertRules
kind: Scheduled
status: Available
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - AlertEvidence
severity: High
description: This analytic rule is looking for new alert evidence from Microsoft Defender for Endpoint. The intent is to create entries in the SecurityAlert table for every new alert evidence attached to an entity of type Device or User monitored by Defender for Endpoint.
tactics: 
  - Persistence
relevantTechniques:
  - T1546
query: |
  AlertEvidence
  | where EntityType in ("Device", "User")
queryFrequency: 60m
queryPeriod: 60m
triggerOperator: GreaterThan
triggerThreshold: 0
suppressionDuration: PT5H
suppressionEnabled: false
incidentConfiguration:
  createIncident: false
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountName
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: LocalIP
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: DeviceName

AzureActivity 
| where TimeGenerated > ago(1h)
| where CategoryValue == "Administrative"
| where OperationNameValue =~ "Microsoft.Compute/virtualMachines/runCommand/action"
    or OperationNameValue =~ "MICROSOFT.COMPUTE/VIRTUALMACHINES/EXTENSIONS/WRITE"
| extend VMName = tostring(todynamic(Properties).resource)
| summarize make_list(ActivityStatusValue), TimeGenerated = max(TimeGenerated) by CorrelationId, CallerIpAddress, Caller, ResourceGroup, VMName
| join kind=inner (AADUserRiskEvents | where TimeGenerated > ago(14d) ) on $left.Caller == $right.UserPrincipalName

id: 80e4db30-5636-4fbd-8816-24c3ded8d243
name: GCP IAM - New Authentication Token for Service Account
description: |
  'Detects when new authentication token is created for service account.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: GCPIAMDataConnector
    dataTypes:
      - GCP_IAM
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - LateralMovement
relevantTechniques:
  - T1550
query: |
  GCP_IAM
  | where PayloadMethodname in ('GenerateAccessToken', 'google.iam.admin.v1.GenerateAccessToken')
  | extend result = parse_json(todynamic(PayloadAuthorizationinfo))[0]['granted']
  | where result =~ 'true'
  | extend service_account = extract(@'serviceAccounts\/(.*?)@', 1, PayloadResponseName)
  | project-away result
  | extend AccountName = tostring(split(service_account, "@")[0]), AccountUPNSuffix = tostring(split(service_account, "@")[1])
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: service_account
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountUPNSuffix
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SrcIpAddr
version: 1.0.2
kind: Scheduled

id: a9c7a4be-b7e7-4045-8028-0d1ffaa049af
name: GCP Security Command Center - Detect DNSSEC disabled for DNS zones
description: |
  Detects Google Cloud DNS zones where DNSSEC is disabled using Security Command Center findings (DNSSEC_DISABLED).
  Disabling DNSSEC increases risk of DNS hijacking and man-in-the-middle attacks. This analytic rule alerts on findings where DNSSEC is reported as disabled for a managed zone.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: GoogleSCCDefinition
    dataTypes:
      - GoogleCloudSCC
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Collection
  - CommandAndControl
  - DefenseEvasion
relevantTechniques:
  - T1557
  - T1071.004
  - T1562.001
tags:
  - CIS GCP Foundation 3.0 3.3
  - NIST 800-53 R5 AC-18, CM-2, CM-6, CM-7, CM-9
  - PCI-DSS v4.0 1.1.1, 1.2.1, 1.2.6, 1.2.7, 1.4.2, 1.5.1, 2.1.1, 2.2.1
  - ISO-27001 v2022 A.8.9
  - Cloud Controls Matrix 4 IVS-04
  - NIST Cybersecurity Framework 1.0 PR-IP-1
  - SOC2 v2017 CC5.2.2
  - CIS Controls 8.0 4.2
query: |
  GoogleCloudSCC
  | where tostring(Findings.state) == "ACTIVE"
  | extend FindingsJson = parse_json(Findings)
  | extend FindingCategory = tostring(FindingsJson.category)
  | where FindingCategory == "DNSSEC_DISABLED"
  | extend ResourceName = tostring(FindingsJson.resourceName)
  | extend
    ResourceType = tostring(FindingsResource.type),
    ExternalUri = tostring(FindingsJson.externalUri),
    SourceProps = parse_json(tostring(FindingsJson.sourceProperties)),
    GcpResource = parse_json(tostring(FindingsJson.resource))
  // Extract project and managed zone from resourceName like //dns.googleapis.com/projects/PROJECT/managedZones/ZONE
  | extend ProjectName = extract(@"projects/([^/]+)", 1, ResourceName)
  | extend ManagedZone = extract(@"managedZones/([^/]+)", 1, ResourceName)
  | extend Severity = tostring(FindingsJson.severity)
  | summarize
    TimeGenerated = max(TimeGenerated)
    by ProjectName, ManagedZone, ResourceType, ResourceName, Severity, ExternalUri
entityMappings:
  - entityType: CloudApplication
    fieldMappings:
      - identifier: Name
        columnName: ResourceName
customDetails:
  ProjectName: ProjectName
  ManagedZone: ManagedZone
  ExternalUri: ExternalUri
alertDetailsOverride:
  alertDisplayNameFormat: "GCP DNS zone {{ManagedZone}} has DNSSEC disabled"
  alertDescriptionFormat: |-
    DNSSEC is disabled for managed zone {{ManagedZone}} in project {{ProjectName}}. Review the zone configuration and enable DNSSEC where appropriate.
version: 1.0.0
kind: Scheduled

id: 599fdc92-eb6d-4b54-8d79-2a3f740a846a
name: Illumio Enforcement Change Analytic Rule
description: |
  'Create Microsoft Sentinel Incident When Ven Changes Enforcement State from Full/Selective To Idle/Visibility state'
severity: Medium
status: Available
requiredDataConnectors: 
  - connectorId: IllumioSaaSDataConnector
    dataTypes:
      - Illumio_Auditable_Events_CL
  - connectorId: SyslogAma
    datatypes:
      - Syslog      
queryFrequency: 60m
queryPeriod: 60m
triggerOperator: gt
triggerThreshold: 0
tactics:
- DefenseEvasion
relevantTechniques:
- T1562
query: |
  let enf_state = dynamic(["full", "selective"]);
  let visibility_state = dynamic(["visibility_only", "idle"]);
  Illumio_Auditable_Events_CL
  | union IllumioSyslogAuditEvents
  | extend temp_resource_changes = parse_json(resource_changes)[0]
  | where event_type == 'workloads.update' 
  | extend old_mode = temp_resource_changes.changes.enforcement_mode.before,
          new_mode = temp_resource_changes.changes.enforcement_mode.after,
          workload_href = temp_resource_changes.resource.workload.href,
          workload_name = temp_resource_changes.resource.workload.hostname,
          ipaddress = action.src_ip
  | where new_mode in (visibility_state) and old_mode in (enf_state)
  | project-away temp_*
  | project old_mode, new_mode, workload_href, workload_name, TimeGenerated, created_by, ipaddress
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: workload_name  
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: created_by
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: ipaddress                  
alertDetailsOverride:
  alertDisplayNameFormat: | 
    Illumio Enforcement Change Incident for {{workload_name}}
  alertDescriptionFormat: | 
    Illumio Enforcement Change Incident for {{workload_name}} generated at {{TimeGenerated}}
version: 1.0.7
kind: Scheduled