Detection rules › Kusto
Azure DevOps Retention Reduced
'AzureDevOps retains items such as run records and produced artifacts for a configurable amount of time. An attacker looking to reduce the footprint left by their malicious activity may look to reduce the retention time for artifacts and runs. This query will look for where retention has been reduced to the minimum level - 1, or reduced by more than half.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth |
Rule body
id: 71d374e0-1cf8-4e50-aecd-ab6c519795c2
name: Azure DevOps Retention Reduced
description: |
'AzureDevOps retains items such as run records and produced artifacts for a configurable amount of time. An attacker looking to reduce the footprint left by their malicious activity may look to reduce the retention time for artifacts and runs.
This query will look for where retention has been reduced to the minimum level - 1, or reduced by more than half.'
severity: Low
status: Available
requiredDataConnectors: []
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
- DefenseEvasion
relevantTechniques:
- T1564
query: |
ADOAuditLogs
| where OperationName =~ "Pipelines.PipelineRetentionSettingChanged"
| where Data.SettingName in ("PurgeArtifacts", "PurgeRuns")
| where Data.NewValue == 1 or Data.NewValue < Data.OldValue/2
| project-reorder TimeGenerated, OperationName, ActorUPN, IpAddress, UserAgent, Data
| extend timestamp = TimeGenerated
| extend AccountName = tostring(split(ActorUPN, "@")[0]), AccountUPNSuffix = tostring(split(ActorUPN, "@")[1])
entityMappings:
- entityType: Account
fieldMappings:
- identifier: FullName
columnName: ActorUPN
- identifier: Name
columnName: AccountName
- identifier: UPNSuffix
columnName: AccountUPNSuffix
- entityType: IP
fieldMappings:
- identifier: Address
columnName: IpAddress
version: 1.0.5
kind: Scheduled
Stages and Predicates
Stage 1: source
ADOAuditLogs
Stage 2: where
| where OperationName =~ "Pipelines.PipelineRetentionSettingChanged"
Stage 3: where
| where Data.SettingName in ("PurgeArtifacts", "PurgeRuns")
Stage 4: where
| where Data.NewValue == 1 or Data.NewValue < Data.OldValue/2
Stage 5: project-reorder
| project-reorder TimeGenerated, OperationName, ActorUPN, IpAddress, UserAgent, Data
Stage 6: extend
| extend timestamp = TimeGenerated
Stage 7: extend
| extend AccountName = tostring(split(ActorUPN, "@")[0]), AccountUPNSuffix = tostring(split(ActorUPN, "@")[1])
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
NewValue | eq |
| field:"Details" kind:eq value:"1" |
OperationName | eq |
| field:"OperationName" kind:eq value:"Pipelines.PipelineRetentionSettingChanged" |
SettingName | in |
| field:"SettingName" kind:in |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
timestamp | extend |
AccountName | extend |
AccountUPNSuffix | extend |