Highly Sensitive Password Accessed

Status: available
Severity: medium
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

'This rule will monitor access to highly sensitive passwords. Within the Watchlist called 'LastPass' define passwords which are deemed highly sensitive (such as password to a high privileged application). When an activity is observed against such password, an incident is created.'

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1555` Credentials from Password Stores
Discovery	`T1087` Account Discovery

Rule body

id: b39e6482-ab7e-4817-813d-ec910b64b26e
name: Highly Sensitive Password Accessed
description: |
  'This rule will monitor access to highly sensitive passwords.
  Within the Watchlist called 'LastPass' define passwords which are deemed highly sensitive (such as password to a high privileged application).
  When an activity is observed against such password, an incident is created.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: LastPass
    dataTypes:
      - LastPassNativePoller_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
eventGroupingSettings:
  aggregationKind: AlertPerResult
tactics:
  - CredentialAccess
  - Discovery
relevantTechniques:
 - T1555
 - T1087
query: |
  let watchlist = (_GetWatchlist("LastPass") | project name);
  LastPassNativePoller_CL
  | where Data_s in (watchlist)
  | extend AccountCustomEntity = Username_s, IPCustomEntity = IP_Address_s, URLCustomEntity = Data_s
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountCustomEntity
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: URLCustomEntity
version: 1.0.0
kind: Scheduled

Stages and Predicates

Let binding: `watchlist` used in Stage 2

let watchlist = (_GetWatchlist("LastPass") | project name);

Stage 1: `source`

LastPassNativePoller_CL

Stage 2: `where`

| where Data_s in (watchlist)

Stage 3: `extend`

| extend AccountCustomEntity = Username_s, IPCustomEntity = IP_Address_s, URLCustomEntity = Data_s

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Data_s`	in	`watchlist`	`field:"Data_s" kind:in value:"watchlist"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AccountCustomEntity`	`extend`
`IPCustomEntity`	`extend`
`URLCustomEntity`	`extend`