Idira - High-Risk Actions Outside Business Hours

Severity: high
Time window: 1d
Source: github.com/Azure/Azure-Sentinel

Detects privileged or destructive actions (delete/disable/rotate/elevate/etc.) occurring outside standard business hours. Useful for insider misuse or compromised admin detection.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	No specific technique

Rule body

id: 3733e1ac-991b-4504-99e8-24ff4fbaf6e4
kind: Scheduled
name: Idira - High-Risk Actions Outside Business Hours
description: >
  Detects privileged or destructive actions (delete/disable/rotate/elevate/etc.)
  occurring outside standard business hours. Useful for insider misuse or
  compromised admin detection.
severity: High
tactics:
  - DefenseEvasion
queryFrequency: 10M
queryPeriod: 1D
triggerOperator: GreaterThan
triggerThreshold: 0
query: |
  let risky = dynamic(["Delete","Remove","Rotate","Elevate","Disable","Grant","Policy","Safe","Vault","Key"]);
  CyberArk_AuditEvents_CL
  | where isnotempty(action) or isnotempty(actionType) or isnotempty(auditType) or isnotempty(message)
  | where hourofday(TimeGenerated) < 7 or hourofday(TimeGenerated) > 20
  | where action has_any (risky) or actionType has_any (risky) or auditType has_any (risky) or message has_any (risky)
  | extend cd = parse_json(customData)
  | extend cd_username = tostring(cd.username),
           cd_auth_method = tostring(cd.authentication_method),
           cd_client_ip = tostring(cd.client_ip_address),
           cd_source_ip = tostring(cd.source_ip_address),
           cd_device_os = tostring(cd.device_os),
           cd_browser = tostring(cd.browser_name),
           cd_geo_city = tostring(cd.geoip_city_name),
           cd_geo_country = tostring(cd.geoip_country_name),
           cd_target = coalesce(tostring(cd.target), tostring(cd.target_resource), tostring(cd.new_target))
  | project TimeGenerated, CyberArkTenantId, username, cd_username, identityType, action, actionType, auditType,
            target, targetAccount, safe, source, cd_source_ip, cd_client_ip, cd_auth_method, cd_device_os,
            cd_browser, cd_geo_city, cd_geo_country, cd_target, component, serviceName, message
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: username
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: target
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: source
suppressionEnabled: false
version: 1.0.0

Stages and Predicates

Parameters

let risky = dynamic(["Delete","Remove","Rotate","Elevate","Disable","Grant","Policy","Safe","Vault","Key"]);

Stage 1: `source`

CyberArk_AuditEvents_CL

Stage 2: `where`

| where isnotempty(action) or isnotempty(actionType) or isnotempty(auditType) or isnotempty(message)

Stage 3: `where`

| where hourofday(TimeGenerated) < 7 or hourofday(TimeGenerated) > 20

Stage 4: `where`

| where action has_any (risky) or actionType has_any (risky) or auditType has_any (risky) or message has_any (risky)

Stage 5: `extend`

| extend cd = parse_json(customData)

Stage 6: `extend`

| extend cd_username = tostring(cd.username),
         cd_auth_method = tostring(cd.authentication_method),
         cd_client_ip = tostring(cd.client_ip_address),
         cd_source_ip = tostring(cd.source_ip_address),
         cd_device_os = tostring(cd.device_os),
         cd_browser = tostring(cd.browser_name),
         cd_geo_city = tostring(cd.geoip_city_name),
         cd_geo_country = tostring(cd.geoip_country_name),
         cd_target = coalesce(tostring(cd.target), tostring(cd.target_resource), tostring(cd.new_target))

Stage 7: `project`

| project TimeGenerated, CyberArkTenantId, username, cd_username, identityType, action, actionType, auditType,
          target, targetAccount, safe, source, cd_source_ip, cd_client_ip, cd_auth_method, cd_device_os,
          cd_browser, cd_geo_city, cd_geo_country, cd_target, component, serviceName, message

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`action`	is_not_null	(no value, null check)	`field:"action" kind:is_not_null`
`action`	match	`Delete` transforms: `term` `Disable` transforms: `term` `Elevate` transforms: `term` `Grant` transforms: `term` `Key` transforms: `term` `Policy` transforms: `term` `Remove` transforms: `term` `Rotate` transforms: `term` `Safe` transforms: `term` `Vault` transforms: `term`	`field:"action" kind:match`
`actionType`	is_not_null	(no value, null check)	`field:"actionType" kind:is_not_null`
`actionType`	match	`Delete` transforms: `term` `Disable` transforms: `term` `Elevate` transforms: `term` `Grant` transforms: `term` `Key` transforms: `term` `Policy` transforms: `term` `Remove` transforms: `term` `Rotate` transforms: `term` `Safe` transforms: `term` `Vault` transforms: `term`	`field:"actionType" kind:match`
`auditType`	is_not_null	(no value, null check)	`field:"auditType" kind:is_not_null`
`auditType`	match	`Delete` transforms: `term` `Disable` transforms: `term` `Elevate` transforms: `term` `Grant` transforms: `term` `Key` transforms: `term` `Policy` transforms: `term` `Remove` transforms: `term` `Rotate` transforms: `term` `Safe` transforms: `term` `Vault` transforms: `term`	`field:"auditType" kind:match`
`message`	is_not_null	(no value, null check)	`field:"message" kind:is_not_null`
`message`	match	`Delete` transforms: `term` `Disable` transforms: `term` `Elevate` transforms: `term` `Grant` transforms: `term` `Key` transforms: `term` `Policy` transforms: `term` `Remove` transforms: `term` `Rotate` transforms: `term` `Safe` transforms: `term` `Vault` transforms: `term`	`field:"message" kind:match`

Output fields

These fields are emitted when the rule matches.

Field	Source
`CyberArkTenantId`	`project`
`TimeGenerated`	`project`
`action`	`project`
`actionType`	`project`
`auditType`	`project`
`cd_auth_method`	`project`
`cd_browser`	`project`
`cd_client_ip`	`project`
`cd_device_os`	`project`
`cd_geo_city`	`project`
`cd_geo_country`	`project`
`cd_source_ip`	`project`
`cd_target`	`project`
`cd_username`	`project`
`component`	`project`
`identityType`	`project`
`message`	`project`
`safe`	`project`
`serviceName`	`project`
`source`	`project`
`target`	`project`
`targetAccount`	`project`
`username`	`project`

Idira - High-Risk Actions Outside Business Hours

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: extend

Stage 6: extend

Stage 7: project