Idira - Sensitive Safe/Permission/Entitlement Changes (with customData)

Severity: low
Time window: 1d
Source: github.com/Azure/Azure-Sentinel

Alerts on control-plane modifications: safes, permissions, roles, entitlements, policy changes. Leverages customData fields such as changeType/role/permission/policy/entitlement to reduce misses.

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	No specific technique

Rule body

id: 30938118-8812-4b5f-afa4-a8d4ba2b5d86
kind: Scheduled
name: Idira - Sensitive Safe/Permission/Entitlement Changes (with customData)
description: >
  Alerts on control-plane modifications: safes, permissions, roles, entitlements, policy changes.
  Leverages customData fields such as changeType/role/permission/policy/entitlement to reduce misses.
severity: Low
tactics:
  - PrivilegeEscalation
queryFrequency: 10M
queryPeriod: 1D
triggerOperator: GreaterThan
triggerThreshold: 0
query: |
  let indicators = dynamic(["SafeMember","Permission","Access","ACL","Owner","Role","Entitlement","Policy"]);
  let changeVerbs = dynamic(["grant","revoke","assign","elevate","enable","disable","remove","delete","update"]);
  let actions = dynamic(["policy-add", "policy-change"]);
  CyberArk_AuditEvents_CL
  | extend cd = parse_json(tostring(customData))
  | extend cd_changeType = tolower(tostring(cd.changeType)),
           cd_role       = tostring(cd.role),
           cd_perm       = tostring(cd.permission),
           cd_policy     = tostring(cd.policy),
           cd_entitle    = tostring(cd.entitlement),
           cd_description= tostring(cd.description),
           cd_action     = tostring(cd.action)
  | where 
      action has_any(actions) and
      (auditType has_any (indicators)
      or message has_any (indicators)
      or cd_description has_any (indicators)
      or cd_action has_any (indicators)
      or cd_role !~ "" or cd_perm !~ "" or cd_policy !~ "" or cd_entitle !~ ""
      or cd_changeType in (changeVerbs))
  | project TimeGenerated, CyberArkTenantId, serviceName, username, userId, safe,
            action, actionType, auditType,
            cd_action, cd_description, cd_changeType, cd_role, cd_perm, cd_policy, cd_entitle,
            target, message
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: username
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: target
suppressionEnabled: false
version: 1.0.0

Stages and Predicates

Parameters

let indicators = dynamic(["SafeMember","Permission","Access","ACL","Owner","Role","Entitlement","Policy"]);
let changeVerbs = dynamic(["grant","revoke","assign","elevate","enable","disable","remove","delete","update"]);
let actions = dynamic(["policy-add", "policy-change"]);

Stage 1: `source`

CyberArk_AuditEvents_CL

Stage 2: `extend`

| extend cd = parse_json(tostring(customData))

Stage 3: `extend`

| extend cd_changeType = tolower(tostring(cd.changeType)),
         cd_role       = tostring(cd.role),
         cd_perm       = tostring(cd.permission),
         cd_policy     = tostring(cd.policy),
         cd_entitle    = tostring(cd.entitlement),
         cd_description= tostring(cd.description),
         cd_action     = tostring(cd.action)

Stage 4: `where`

| where 
    action has_any(actions) and
    (auditType has_any (indicators)
    or message has_any (indicators)
    or cd_description has_any (indicators)
    or cd_action has_any (indicators)
    or cd_role !~ "" or cd_perm !~ "" or cd_policy !~ "" or cd_entitle !~ ""
    or cd_changeType in (changeVerbs))

Stage 5: `project`

| project TimeGenerated, CyberArkTenantId, serviceName, username, userId, safe,
          action, actionType, auditType,
          cd_action, cd_description, cd_changeType, cd_role, cd_perm, cd_policy, cd_entitle,
          target, message

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`action`	match	`policy-add` transforms: `term` `policy-change` transforms: `term`	`field:"action" kind:match`
`auditType`	match	`ACL` transforms: `term` `Access` transforms: `term` `Entitlement` transforms: `term` `Owner` transforms: `term` `Permission` transforms: `term` `Policy` transforms: `term` `Role` transforms: `term` `SafeMember` transforms: `term`	`field:"auditType" kind:match`
`cd_action`	match	`ACL` transforms: `term` `Access` transforms: `term` `Entitlement` transforms: `term` `Owner` transforms: `term` `Permission` transforms: `term` `Policy` transforms: `term` `Role` transforms: `term` `SafeMember` transforms: `term`	`field:"cd_action" kind:match`
`cd_changeType`	in	`assign` `delete` `disable` `elevate` `enable` `grant` `remove` `revoke` `update`	`field:"cd_changeType" kind:in`
`cd_description`	match	`ACL` transforms: `term` `Access` transforms: `term` `Entitlement` transforms: `term` `Owner` transforms: `term` `Permission` transforms: `term` `Policy` transforms: `term` `Role` transforms: `term` `SafeMember` transforms: `term`	`field:"cd_description" kind:match`
`message`	match	`ACL` transforms: `term` `Access` transforms: `term` `Entitlement` transforms: `term` `Owner` transforms: `term` `Permission` transforms: `term` `Policy` transforms: `term` `Role` transforms: `term` `SafeMember` transforms: `term`	`field:"message" kind:match`

Output fields

These fields are emitted when the rule matches.

Field	Source
`CyberArkTenantId`	`project`
`TimeGenerated`	`project`
`action`	`project`
`actionType`	`project`
`auditType`	`project`
`cd_action`	`project`
`cd_changeType`	`project`
`cd_description`	`project`
`cd_entitle`	`project`
`cd_perm`	`project`
`cd_policy`	`project`
`cd_role`	`project`
`message`	`project`
`safe`	`project`
`serviceName`	`project`
`target`	`project`
`userId`	`project`
`username`	`project`