External User Access Enabled

Severity: low
Time window: 1d
Author: Microsoft Security Research
Source: github.com/Azure/Azure-Sentinel

'This alerts when the account setting is changed to allow either external domain access or anonymous access to meetings.'

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1098` Account Manipulation `T1556` Modify Authentication Process
Credential Access	`T1556` Modify Authentication Process

Rule body

id: 8e267e91-6bda-4b3c-bf68-9f5cbdd103a3
name: External User Access Enabled
description: |
  'This alerts when the account setting is changed to allow either external domain access or anonymous access to meetings.'
severity: Low
requiredDataConnectors: []
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CredentialAccess
  - Persistence
relevantTechniques:
  - T1098
  - T1556
query: |
  ZoomLogs
  | where Event =~ "account.settings_updated"
  | extend EnforceLogin = columnifexists("payload_object_settings_schedule_meeting_enfore_login_b", "")
  | extend EnforceLoginDomain = columnifexists("payload_object_settings_schedule_meeting_enfore_login_b", "")
  | extend GuestAlerts = columnifexists("payload_object_settings_in_meeting_alert_guest_join_b", "")
  | where EnforceLogin == 'false' or EnforceLoginDomain == 'false' or GuestAlerts == 'false'
  | extend SettingChanged = case(EnforceLogin == 'false' and EnforceLoginDomain == 'false' and GuestAlerts == 'false', "All settings changed",
                              EnforceLogin == 'false' and EnforceLoginDomain == 'false', "Enforced Logons and Restricted Domains Changed",
                              EnforceLoginDomain == 'false' and GuestAlerts == 'false', "Enforced Domains Changed",
                              EnforceLoginDomain == 'false', "Enfored Domains Changed",
                              GuestAlerts == 'false', "Guest Join Alerts Changed",
                              EnforceLogin == 'false', "Enforced Logins Changed",
                              "No Changes")
  | extend AccountName = tostring(split(User, "@")[0]), AccountUPNSuffix = tostring(split(User, "@")[1])
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: User
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountUPNSuffix
version: 1.0.4
kind: Scheduled
metadata:
    source:
        kind: Community
    author:
        name: Microsoft Security Research
    support:
        tier: Community
    categories:
        domains: [ "Security - Others", "Identity" ]

Stages and Predicates

Stage 1: `source`

ZoomLogs

Stage 2: `where`

| where Event =~ "account.settings_updated"

Stage 3: `extend` (3 consecutive steps)

| extend EnforceLogin = columnifexists("payload_object_settings_schedule_meeting_enfore_login_b", "")
| extend EnforceLoginDomain = columnifexists("payload_object_settings_schedule_meeting_enfore_login_b", "")
| extend GuestAlerts = columnifexists("payload_object_settings_in_meeting_alert_guest_join_b", "")

Stage 4: `where`

| where EnforceLogin == 'false' or EnforceLoginDomain == 'false' or GuestAlerts == 'false'

Stage 5: `extend`

| extend SettingChanged = case(EnforceLogin == 'false' and EnforceLoginDomain == 'false' and GuestAlerts == 'false', "All settings changed",
                            EnforceLogin == 'false' and EnforceLoginDomain == 'false', "Enforced Logons and Restricted Domains Changed",
                            EnforceLoginDomain == 'false' and GuestAlerts == 'false', "Enforced Domains Changed",
                            EnforceLoginDomain == 'false', "Enfored Domains Changed",
                            GuestAlerts == 'false', "Guest Join Alerts Changed",
                            EnforceLogin == 'false', "Enforced Logins Changed",
                            "No Changes")

SettingChanged =

if(EnforceLogin == false and EnforceLoginDomain == false) and GuestAlerts == false"All settings changed"

elifEnforceLogin == false and EnforceLoginDomain == false"Enforced Logons and Restricted Domains Changed"

elifEnforceLoginDomain == false and GuestAlerts == false"Enforced Domains Changed"

elifEnforceLoginDomain == false"Enfored Domains Changed"

elifGuestAlerts == false"Guest Join Alerts Changed"

elifEnforceLogin == false"Enforced Logins Changed"

else"No Changes"

Stage 6: `extend`

| extend AccountName = tostring(split(User, "@")[0]), AccountUPNSuffix = tostring(split(User, "@")[1])

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EnforceLogin`	eq	`false`	`field:"EnforceLogin" kind:eq value:"false"`
`EnforceLoginDomain`	eq	`false`	`field:"EnforceLoginDomain" kind:eq value:"false"`
`Event`	eq	`account.settings_updated`	`field:"Event" kind:eq value:"account.settings_updated"`
`GuestAlerts`	eq	`false`	`field:"GuestAlerts" kind:eq value:"false"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`EnforceLogin`	`extend`
`EnforceLoginDomain`	`extend`
`GuestAlerts`	`extend`
`SettingChanged`	`extend`
`AccountName`	`extend`
`AccountUPNSuffix`	`extend`

External User Access Enabled

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: extend (3 consecutive steps)

Stage 4: where

Stage 5: extend

Stage 6: extend