Box - Inactive user login

Status: available
Severity: medium
Time window: 14d
Source: github.com/Azure/Azure-Sentinel

'Detects user login after long inactivity period.'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts

Rule body

id: edbf38d7-e170-4af2-ad50-1a05b374611b
name: Box - Inactive user login
description: |
  'Detects user login after long inactivity period.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: BoxDataConnector
    dataTypes:
      - BoxEvents_CL
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1078
query: |
  let lbperiod_start = 14d;
  let lbperiod_end = 7d;
  let lbtime = 1h;
  let active_users = BoxEvents
  | where EventEndTime between (ago(lbperiod_end) .. ago(lbtime))
  | where EventType =~ 'LOGIN'
  | summarize makeset(SourceName);
  let inactive_users = BoxEvents
  | where EventEndTime between (ago(lbperiod_start) .. ago(lbperiod_end))
  | where EventType =~ 'LOGIN'
  | where SourceName !in (active_users)
  | summarize makeset(SourceName);
  BoxEvents
  | where EventType == 'LOGIN'
  | where SourceName in (inactive_users)
  | extend AccountCustomEntity = SourceName
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
version: 1.0.1
kind: Scheduled

Stages and Predicates

Parameters

let lbperiod_start = 14d;
let lbperiod_end = 7d;
let lbtime = 1h;

Let binding: `active_users`

let active_users = BoxEvents
| where EventEndTime between (ago(lbperiod_end) .. ago(lbtime))
| where EventType =~ 'LOGIN'
| summarize makeset(SourceName);

Let binding: `inactive_users` used in Stage 3

let inactive_users = BoxEvents
| where EventEndTime between (ago(lbperiod_start) .. ago(lbperiod_end))
| where EventType =~ 'LOGIN'
| where SourceName !in (active_users)
| summarize makeset(SourceName);

Stage 1: `source`

BoxEvents

Stage 2: `where`

| where EventType == 'LOGIN'

Stage 3: `where`

| where SourceName in (inactive_users)

Stage 4: `extend`

| extend AccountCustomEntity = SourceName

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventType`	eq	`LOGIN`	`field:"EventType" kind:eq value:"LOGIN"`
`SourceName`	in	`inactive_users`	`field:"SourceName" kind:in value:"inactive_users"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AccountCustomEntity`	`extend`

Box - Inactive user login

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Let binding: active_users

Let binding: inactive_users used in Stage 3

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: extend

Indicators

Output fields

Let binding: `active_users`

Let binding: `inactive_users` used in Stage 3

Stage 1: `source`

Stage 2: `where`

Stage 3: `where`

Stage 4: `extend`