SAP BTP - User added to sensitive privileged role collection

Status: available
Severity: low
Time window: 15m
Source: github.com/Azure/Azure-Sentinel

Identifies identity management actions whereby a user is added to a set of monitored privileged role collections.

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1078` Valid Accounts
Persistence	`T0859` Valid Accounts
Lateral Movement	`T0859` Valid Accounts

Rule body

id: 5acbe4cb-a379-4acc-9ad3-28dc48ad33d3
kind: Scheduled
name: SAP BTP - User added to sensitive privileged role collection
description: Identifies identity management actions whereby a user is added to a set
  of monitored privileged role collections.
severity: Low
status: Available
requiredDataConnectors:
  - connectorId: SAPBTPAuditEvents
    dataTypes:
      - SAPBTPAuditLog_CL
queryFrequency: 15m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - LateralMovement
  - PrivilegeEscalation
relevantTechniques:
  - T0859
  - T1078
query: |
  let monitored_rolecollections = dynamic(["Subaccount Service Administrator", "Subaccount Administrator", "Connectivity and Destination Administrator", "Destination Administrator", "Cloud Connector Administrator"]);
  SAPBTPAuditLog_CL
  | where Message.object has "xs_rolecollection2user"
  | extend ObjectId = parse_json((Message.object).id)
  | where ObjectId.crudType == "CREATE"
  | extend RoleCollection = ObjectId.rolecollection_name, TargetUserId = ObjectId.user_id
  | where RoleCollection in (monitored_rolecollections)
  | project UpdatedOn, UserName, RoleCollection, TargetUserId, Tenant, SpaceId, CloudApp = "SAP BTP"
  | extend AccountName = split(UserName, "@")[0], UPNSuffix = split(UserName, "@")[1]
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: UPNSuffix
  - entityType: CloudApplication
    fieldMappings:
      - identifier: Name
        columnName: CloudApp
version: 3.0.6

Stages and Predicates

Let binding: `monitored_rolecollections` used in Stage 6

let monitored_rolecollections = dynamic(["Subaccount Service Administrator", "Subaccount Administrator", "Connectivity and Destination Administrator", "Destination Administrator", "Cloud Connector Administrator"]);

Stage 1: `source`

SAPBTPAuditLog_CL

Stage 2: `where`

| where Message.object has "xs_rolecollection2user"

Stage 3: `extend`

| extend ObjectId = parse_json((Message.object).id)

Stage 4: `where`

| where ObjectId.crudType == "CREATE"

Stage 5: `extend`

| extend RoleCollection = ObjectId.rolecollection_name, TargetUserId = ObjectId.user_id

Stage 6: `where`

| where RoleCollection in (monitored_rolecollections)

Stage 7: `project`

| project UpdatedOn, UserName, RoleCollection, TargetUserId, Tenant, SpaceId, CloudApp = "SAP BTP"

Stage 8: `extend`

| extend AccountName = split(UserName, "@")[0], UPNSuffix = split(UserName, "@")[1]

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`RoleCollection`	in	`Cloud Connector Administrator` `Connectivity and Destination Administrator` `Destination Administrator` `Subaccount Administrator` `Subaccount Service Administrator`	`field:"RoleCollection" kind:in`
`crudType`	eq	`CREATE`	`field:"crudType" kind:eq value:"CREATE"`
`object`	match	`xs_rolecollection2user` transforms: `term`	`field:"group.name" kind:match value:"xs_rolecollection2user"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`CloudApp`	`project`
`RoleCollection`	`project`
`SpaceId`	`project`
`TargetUserId`	`project`
`Tenant`	`project`
`UpdatedOn`	`project`
`UserName`	`project`
`AccountName`	`extend`
`UPNSuffix`	`extend`

SAP BTP - User added to sensitive privileged role collection

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Let binding: monitored_rolecollections used in Stage 6

Stage 1: source

Stage 2: where

Stage 3: extend

Stage 4: where

Stage 5: extend

Stage 6: where

Stage 7: project

Stage 8: extend