Box - Abmormal user activity

Status: available
Severity: medium
Time window: 14d
Group by: SourceName, SrcUserName, User, k
Source: github.com/Azure/Azure-Sentinel

'Detects spikes (deviations from avarage) in user activity.'

MITRE ATT&CK coverage

Tactic	Techniques
Collection	`T1530` Data from Cloud Storage

Rule body

id: 1139230c-cf10-45db-b616-fed0d1415c05
name: Box - Abmormal user activity
description: |
  'Detects spikes (deviations from avarage) in user activity.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: BoxDataConnector
    dataTypes:
      - BoxEvents_CL
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Collection
relevantTechniques:
  - T1530
query: |
  let lbperiod_start = 14d;
  let lbperiod_end = 24h;
  let user_actions_1 = BoxEvents
  | where EventEndTime between (ago(lbperiod_start) .. ago(lbperiod_end))
  | summarize TotalEvents = count() by SourceName
  | project TotalEvents, User = SourceName;
  let user_actions_2 = BoxEvents
  | where EventEndTime between (ago(lbperiod_start) .. ago(lbperiod_end))
  | summarize TotalEvents = count() by SrcUserName
  | project TotalEvents, User = SrcUserName;
  let TotalActions = (union user_actions_1, user_actions_2)
  | summarize TotalEvents = count() by User
  | extend EventsPerDay = TotalEvents / 29
  | extend k = 1;
  let actions1_last_h = BoxEvents
  | summarize TotalEventsH = count() by SourceName
  | project TotalEventsH, User = SourceName;
  let actions2_last_h = BoxEvents
  | summarize TotalEventsH = count() by SourceName
  | project TotalEventsH, User = SourceName;
  let TotalActionsLastHour = (union actions1_last_h, actions2_last_h)
  | summarize TotalEventsH = sum(TotalEventsH) by User
  | extend k = 1;
  TotalActions
  | join (TotalActionsLastHour) on k
  | where EventsPerDay > TotalEventsH
  | project User
  | extend AccountCustomEntity = User
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
version: 1.0.1
kind: Scheduled

Stages and Predicates

Parameters

let lbperiod_start = 14d;
let lbperiod_end = 24h;

Let binding: `actions1_last_h`

let actions1_last_h = BoxEvents
| summarize TotalEventsH = count() by SourceName
| project TotalEventsH, User = SourceName;

Let binding: `actions2_last_h`

let actions2_last_h = BoxEvents
| summarize TotalEventsH = count() by SourceName
| project TotalEventsH, User = SourceName;

Let binding: `TotalActionsLastHour`

let TotalActionsLastHour = (union actions1_last_h, actions2_last_h)
| summarize TotalEventsH = sum(TotalEventsH) by User
| extend k = 1;

union (2 sources)

Each leg below queries one source; the rule matches if any leg does. Sources: user_actions_1, user_actions_2

Leg 1: `user_actions_1`

Leg 2: `user_actions_2`

Applied to the combined result

| summarize TotalEvents = count() by User
| extend EventsPerDay = TotalEvents / 29
| extend k = 1 | join (TotalActionsLastHour) on k | where EventsPerDay > TotalEventsH | project User | extend AccountCustomEntity = User

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventsPerDay`	cross_field_compare	`TotalEventsH` transforms: `op:gt`	`field:"EventsPerDay" kind:cross_field_compare value:"TotalEventsH"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`User`	`project`
`AccountCustomEntity`	`extend`