F&O - Mass update or deletion of user records

Status: available
Severity: medium
Time window: 1h
Group by: LogType, TableName, Username
Source: github.com/Azure/Azure-Sentinel

Identifies large delete or update operations on Finance & Operations user records based on predefined thresholds.

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1485` Data Destruction `T1491` Defacement `T1565` Data Manipulation

Rule body

id: 5ab00fbb-ba2c-44dc-b02e-f119639b9a11
kind: Scheduled
name: F&O - Mass update or deletion of user records
description: Identifies large delete or update operations on Finance & Operations
  user records based on predefined thresholds.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: Dynamics365Finance
    dataTypes:
      - FinanceOperationsActivity_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Impact
relevantTechniques:
  - T1485
  - T1565
  - T1491
query: |
  // Set threshold for number of updated or deleted records
  let update_detection_threshold = 50;
  let deleted_detection_threshold = 10;
  FinanceOperationsActivity_CL
  | where TableName == "UserInfo" and LogType in ("Update", "Delete")
  | summarize
      TotalEvents = count(),
      StartTime = min(LogCreatedDateTime),
      EndTime = max(LogCreatedDateTime)
      by TableName, Username, LogType
  | where (LogType == "Update" and TotalEvents > update_detection_threshold) or (LogType == "Delete" and TotalEvents > deleted_detection_threshold)
  | extend FinOpsAppId = 32780
  | project StartTime, EndTime, Username, LogType, TableName, TotalEvents, FinOpsAppId
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: Username
  - entityType: CloudApplication
    fieldMappings:
      - identifier: AppId
        columnName: FinOpsAppId
alertDetailsOverride:
  alertDisplayNameFormat: F&O - many user account records deleted
  alertDescriptionFormat: '{{TotalEvents}} user records deleted in F&O by user {{Username}}'
version: 3.2.0

Stages and Predicates

Parameters

let update_detection_threshold = 50;
let deleted_detection_threshold = 10;

Stage 1: `source`

FinanceOperationsActivity_CL

Stage 2: `where`

| where TableName == "UserInfo" and LogType in ("Update", "Delete")

Stage 3: `summarize`

| summarize
    TotalEvents = count(),
    StartTime = min(LogCreatedDateTime),
    EndTime = max(LogCreatedDateTime)
    by TableName, Username, LogType

Stage 4: `where`

| where (LogType == "Update" and TotalEvents > update_detection_threshold) or (LogType == "Delete" and TotalEvents > deleted_detection_threshold)

Stage 5: `extend`

| extend FinOpsAppId = 32780

Stage 6: `project`

| project StartTime, EndTime, Username, LogType, TableName, TotalEvents, FinOpsAppId

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`LogType`	eq	`Delete` `Update`	`field:"LogType" kind:eq`
`LogType`	in	`Delete` `Update`	`field:"LogType" kind:in`
`TableName`	eq	`UserInfo`	`field:"TableName" kind:eq value:"UserInfo"`
`TotalEvents`	gt	`10` `50`	`field:"TotalEvents" kind:gt`

Output fields

These fields are emitted when the rule matches.

Field	Source
`EndTime`	`project`
`FinOpsAppId`	`project`
`LogType`	`project`
`StartTime`	`project`
`TableName`	`project`
`TotalEvents`	`project`
`Username`	`project`

F&O - Mass update or deletion of user records

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Stage 1: source

Stage 2: where

Stage 3: summarize

Stage 4: where

Stage 5: extend

Stage 6: project