Detection rules › Kusto

Box - Many items deleted by user

Status
available
Severity
medium
Time window
1h
Group by
SrcUserName
Source
github.com/Azure/Azure-Sentinel

'Detects when a user deletes many items in short period of time.'

MITRE ATT&CK coverage

TacticTechniques
Impact

Rule body

id: 1b212329-6f2c-46ca-9071-de3464f3d88d
name: Box - Many items deleted by user
description: |
  'Detects when a user deletes many items in short period of time.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: BoxDataConnector
    dataTypes:
      - BoxEvents_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Impact
relevantTechniques:
  - T1485
query: |
  let threshold = 100;
  BoxEvents
  | where EventType =~ 'DELETE'
  | summarize deleted_items = dcount(SourceItemName) by SrcUserName, bin(EventEndTime, 5m)
  | where deleted_items > threshold
  | extend AccountCustomEntity = SrcUserName
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
version: 1.0.1
kind: Scheduled

Stages and Predicates

Parameters

let threshold = 100;

Stage 1: source

BoxEvents

Stage 2: where

| where EventType =~ 'DELETE'

Stage 3: summarize

| summarize deleted_items = dcount(SourceItemName) by SrcUserName, bin(EventEndTime, 5m)

Stage 4: where

| where deleted_items > threshold

Stage 5: extend

| extend AccountCustomEntity = SrcUserName

Indicators

These rows show field, operator, and value matches.

Output fields

These fields are emitted when the rule matches.

FieldSource
SrcUserNamesummarize
deleted_itemssummarize
AccountCustomEntityextend