Detection rules › Kusto
SAP BTP - Mass user deletion in a sub account
Identifies user account deletion activity where the amount of deleted users exceeds a predefined threshold.
MITRE ATT&CK coverage
Rule body
id: 6f1e58bd-cd95-4dfb-8883-94207f30929a
kind: Scheduled
name: SAP BTP - Mass user deletion in a sub account
description: Identifies user account deletion activity where the amount of deleted
users exceeds a predefined threshold.
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: SAPBTPAuditEvents
dataTypes:
- SAPBTPAuditLog_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
relevantTechniques:
- T1531
- T1485
- T1489
- T0813
- T0826
- T0827
query: |
let bulk_delete_threshold = 10;
SAPBTPAuditLog_CL
| where isnotnull(Message.object)
| where Message.object has "scim user" and Message.object has "DELETE"
| mv-expand Attributes = Message.attributes
| where isnotempty(Attributes.old)
| extend DeletedUserName = tostring(parse_json(tostring(Attributes.old)).userName)
| where isnotempty(DeletedUserName)
| summarize
Start = min(UpdatedOn),
End = max(UpdatedOn),
DeletedUsers = make_set(DeletedUserName, 100)
by UserName, Tenant, SpaceId
| where array_length(DeletedUsers) > bulk_delete_threshold
| project Start, End, UserName, DeletedUsers, Tenant, SpaceId, CloudApp = "SAP BTP"
| extend AccountName = split(UserName, "@")[0], UPNSuffix = split(UserName, "@")[1]
eventGroupingSettings:
aggregationKind: SingleAlert
entityMappings:
- entityType: Account
fieldMappings:
- identifier: Name
columnName: AccountName
- identifier: UPNSuffix
columnName: UPNSuffix
- entityType: CloudApplication
fieldMappings:
- identifier: Name
columnName: CloudApp
version: 3.0.6
Stages and Predicates
Parameters
let bulk_delete_threshold = 10;
Stage 1: source
SAPBTPAuditLog_CL
Stage 2: where
| where isnotnull(Message.object)
Stage 3: where
| where Message.object has "scim user" and Message.object has "DELETE"
Stage 4: mv-expand
| mv-expand Attributes = Message.attributes
Stage 5: where
| where isnotempty(Attributes.old)
Stage 6: extend
| extend DeletedUserName = tostring(parse_json(tostring(Attributes.old)).userName)
Stage 7: where
| where isnotempty(DeletedUserName)
Stage 8: summarize
| summarize
Start = min(UpdatedOn),
End = max(UpdatedOn),
DeletedUsers = make_set(DeletedUserName, 100)
by UserName, Tenant, SpaceId
Stage 9: where
| where array_length(DeletedUsers) > bulk_delete_threshold
Stage 10: project
| project Start, End, UserName, DeletedUsers, Tenant, SpaceId, CloudApp = "SAP BTP"
Stage 11: extend
| extend AccountName = split(UserName, "@")[0], UPNSuffix = split(UserName, "@")[1]
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
DeletedUserName | is_not_null | field:"DeletedUserName" kind:is_not_null | |
object | is_not_null | field:"group.name" kind:is_not_null | |
object | match |
| field:"group.name" kind:match |
old | is_not_null | field:"old" kind:is_not_null |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
CloudApp | project |
DeletedUsers | project |
End | project |
SpaceId | project |
Start | project |
Tenant | project |
UserName | project |
AccountName | extend |
UPNSuffix | extend |