Box - User role changed to owner

Status: available
Severity: medium
Time window: 14d
Group by: AccessibleByName, AdditionalDetailsRole, FileDirectory
Source: github.com/Azure/Azure-Sentinel

'Detects when user collaboration role is changed to owner.'

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1078` Valid Accounts

Rule body

id: 174c31c9-22ec-42e5-8226-814391c08200
name: Box - User role changed to owner
description: |
  'Detects when user collaboration role is changed to owner.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: BoxDataConnector
    dataTypes:
      - BoxEvents_CL
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - PrivilegeEscalation
relevantTechniques:
  - T1078
query: |
  let lbperiod = 14d;
  let lbtime = 1h;
  BoxEvents
  | where EventEndTime between (ago(lbperiod) .. ago(lbtime))
  | where EventType =~ 'COLLABORATION_INVITE'
  | where AdditionalDetailsRole !~ 'Owner'
  | summarize min(EventEndTime) by AccessibleByName, FileDirectory, AdditionalDetailsRole
  | project AccessibleByName, FileDirectory, InitialRole = AdditionalDetailsRole
  |join (BoxEvents
            | where EventType =~ 'COLLABORATION_ROLE_CHANGE'
            | summarize max(EventEndTime) by AccessibleByName, FileDirectory, AdditionalDetailsRole
            | project AccessibleByName, FileDirectory, NewRole = AdditionalDetailsRole
            ) on FileDirectory, AccessibleByName
  | where NewRole =~ 'Owner'
  | project AccessibleByName, FileDirectory
  | extend AccountCustomEntity = AccessibleByName
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
version: 1.0.1
kind: Scheduled

Stages and Predicates

Parameters

let lbperiod = 14d;
let lbtime = 1h;

Stage 1: `source`

BoxEvents

Stage 2: `where`

| where EventEndTime between (ago(lbperiod) .. ago(lbtime))

Stage 3: `where`

| where EventType =~ 'COLLABORATION_INVITE'

Stage 4: `where`

| where AdditionalDetailsRole !~ 'Owner'

Stage 5: `summarize`

| summarize min(EventEndTime) by AccessibleByName, FileDirectory, AdditionalDetailsRole

Stage 6: `project`

| project AccessibleByName, FileDirectory, InitialRole = AdditionalDetailsRole

Stage 7: `join`

| join (BoxEvents
          | where EventType =~ 'COLLABORATION_ROLE_CHANGE'
          | summarize max(EventEndTime) by AccessibleByName, FileDirectory, AdditionalDetailsRole
          | project AccessibleByName, FileDirectory, NewRole = AdditionalDetailsRole
          ) on FileDirectory, AccessibleByName

Stage 8: `where`

| where NewRole =~ 'Owner'

Stage 9: `project`

| project AccessibleByName, FileDirectory

Stage 10: `extend`

| extend AccountCustomEntity = AccessibleByName

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AdditionalDetailsRole`	ne	`Owner`	`field:"AdditionalDetailsRole" kind:ne value:"Owner"`
`EventType`	eq	`COLLABORATION_INVITE` `COLLABORATION_ROLE_CHANGE`	`field:"EventType" kind:eq`
`NewRole`	eq	`Owner`	`field:"NewRole" kind:eq value:"Owner"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AccessibleByName`	`project`
`FileDirectory`	`project`
`AccountCustomEntity`	`extend`

Box - User role changed to owner

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: summarize

Stage 6: project

Stage 7: join

Stage 8: where

Stage 9: project

Stage 10: extend

Indicators

Output fields

Stage 1: `source`

Stage 2: `where`

Stage 3: `where`

Stage 4: `where`

Stage 5: `summarize`

Stage 6: `project`

Stage 7: `join`

Stage 8: `where`

Stage 9: `project`

Stage 10: `extend`