F&O - Reverted bank account number modifications

Status: available
Severity: low
Time window: 1d
Group by: OldAccountNum, UpdatedAccount
Source: github.com/Azure/Azure-Sentinel

Identifies changes to bank account numbers in Finance & Operations, whereby a bank account number is modified but then subsequently reverted a short time later.

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1496` Resource Hijacking `T1565` Data Manipulation
Impact	`T0828` Loss of Productivity and Revenue `T0831` Manipulation of Control

Rule body

id: 44b1021c-d517-4b7a-9ba6-a91eab94e632
kind: Scheduled
name: F&O - Reverted bank account number modifications
description: Identifies changes to bank account numbers in Finance & Operations, whereby
  a bank account number is modified but then subsequently reverted a short time later.
severity: Low
status: Available
requiredDataConnectors:
  - connectorId: Dynamics365Finance
    dataTypes:
      - FinanceOperationsActivity_CL
queryFrequency: 15m
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Impact
relevantTechniques:
  - T1565
  - T1496
  - T0828
  - T0831
query: |
  let detection_window = 24h;
  let query_frequency = 15m;
  let bank_changes = FinanceOperationsActivity_CL
      | where LogType == "Update" and TableName == "BankAccountTable"
      | extend AccountId = tostring(parse_json(tostring(FormattedData.AccountID)).NewData)
      | extend AccountNum = parse_json(tostring(FormattedData.AccountNum))
      | extend
          CurrentAccountNum = tostring(AccountNum.NewData),
          OldAccountNum = tostring(AccountNum.OldData)
      | where CurrentAccountNum != OldAccountNum;
  bank_changes
  | join kind=inner (bank_changes
      | where TimeGenerated >= ago(query_frequency)
      | project-rename UpdatedTime = LogCreatedDateTime, UpdatedAccount = CurrentAccountNum)
      on $left.OldAccountNum == $right.UpdatedAccount
  | where UpdatedTime between (LogCreatedDateTime .. (LogCreatedDateTime + detection_window))
  | extend FinOpsAppId = 32780
  | project
      TimeGenerated,
      LogCreatedDateTime,
      LogType,
      TableName,
      Username,
      AccountId,
      CurrentAccountNum,
      OldAccountNum,
      FinOpsAppId
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: Username
  - entityType: CloudApplication
    fieldMappings:
      - identifier: AppId
        columnName: FinOpsAppId
alertDetailsOverride:
  alertDisplayNameFormat: F&O - Suspicious bank account number changes
  alertDescriptionFormat: A suspicous bank account change was made in F&O, the bank
    account number was updated and then changed back to the orginal number a short
    time later. {{AccountId}} was changed by {{Username}}
version: 3.2.0

Stages and Predicates

Parameters

let detection_window = 24h;
let query_frequency = 15m;

let bank_changes is inlined into the numbered stages below.

Stages 1 to 4 define let bank_changes (the rule's main pipeline source); stages 5 to 8 run on it.

Stage 1: `source`

FinanceOperationsActivity_CL

Stage 2: `where`

| where LogType == "Update" and TableName == "BankAccountTable"

Stage 3: `extend` (3 consecutive steps)

| extend AccountId = tostring(parse_json(tostring(FormattedData.AccountID)).NewData)
| extend AccountNum = parse_json(tostring(FormattedData.AccountNum))
| extend
        CurrentAccountNum = tostring(AccountNum.NewData),
        OldAccountNum = tostring(AccountNum.OldData)

Stage 4: `where`

| where CurrentAccountNum != OldAccountNum

Stage 5: `join`

bank_changes
| join kind=inner (bank_changes
    | where TimeGenerated >= ago(query_frequency)
    | project-rename UpdatedTime = LogCreatedDateTime, UpdatedAccount = CurrentAccountNum)
    on $left.OldAccountNum == $right.UpdatedAccount

Stage 6: `where` UpdatedTime - LogCreatedDateTime >= 0s AND UpdatedTime - LogCreatedDateTime <= 1d

| where UpdatedTime between (LogCreatedDateTime .. (LogCreatedDateTime + detection_window))

Stage 7: `extend`

| extend FinOpsAppId = 32780

Stage 8: `project`

| project
    TimeGenerated,
    LogCreatedDateTime,
    LogType,
    TableName,
    Username,
    AccountId,
    CurrentAccountNum,
    OldAccountNum,
    FinOpsAppId

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CurrentAccountNum`	cross_field_compare	`OldAccountNum` transforms: `op:ne`	`field:"CurrentAccountNum" kind:cross_field_compare value:"OldAccountNum"`
`LogType`	eq	`Update`	`field:"LogType" kind:eq value:"Update"`
`TableName`	eq	`BankAccountTable`	`field:"TableName" kind:eq value:"BankAccountTable"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AccountId`	`project`
`CurrentAccountNum`	`project`
`FinOpsAppId`	`project`
`LogCreatedDateTime`	`project`
`LogType`	`project`
`OldAccountNum`	`project`
`TableName`	`project`
`TimeGenerated`	`project`
`Username`	`project`

F&O - Reverted bank account number modifications

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Stage 1: source

Stage 2: where

Stage 3: extend (3 consecutive steps)

Stage 4: where

Stage 5: join

Stage 6: where UpdatedTime - LogCreatedDateTime >= 0s AND UpdatedTime - LogCreatedDateTime <= 1d

Stage 7: extend

Stage 8: project