PaloAlto - User privileges was changed

Status: available
Severity: medium
Time window: 14d
Group by: DstUsername
Source: github.com/Azure/Azure-Sentinel

'Detects changing of user privileges.'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1133` External Remote Services `T1190` Exploit Public-Facing Application

Rule body

id: 38f9e010-51ca-11ec-bf63-0242ac130002
name: PaloAlto - User privileges was changed
description: |
  'Detects changing of user privileges.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: CefAma
    dataTypes:
      - CommonSecurityLog
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1190
  - T1133
query: |
  let q_period = 14d;
  let dt_lookBack = 24h;
  let p = PaloAltoCDLEvent
  | where TimeGenerated between (ago(q_period)..ago(dt_lookBack))
  | summarize OldPrivileges = make_set(DestinationUserPrivileges) by DstUsername;
  PaloAltoCDLEvent
  | where TimeGenerated > ago(dt_lookBack)
  | summarize NewPrivileges = make_set(DestinationUserPrivileges) by DstUsername
  | join kind=innerunique (p) on DstUsername
  | where tostring(OldPrivileges) != tostring(NewPrivileges)
  | extend AccountCustomEntity = DstUsername
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountCustomEntity
version: 1.0.4
kind: Scheduled

Stages and Predicates

Parameters

let q_period = 14d;
let dt_lookBack = 24h;

Let binding: `p` used in Stage 4

let p = PaloAltoCDLEvent
| where TimeGenerated between (ago(q_period)..ago(dt_lookBack))
| summarize OldPrivileges = make_set(DestinationUserPrivileges) by DstUsername;

Stage 1: `source`

PaloAltoCDLEvent

Stage 2: `where`

| where TimeGenerated > ago(dt_lookBack)

Stage 3: `summarize`

| summarize NewPrivileges = make_set(DestinationUserPrivileges) by DstUsername

Stage 4: `join`

| join kind=innerunique (p) on DstUsername

Stage 5: `where`

| where tostring(OldPrivileges) != tostring(NewPrivileges)

Stage 6: `extend`

| extend AccountCustomEntity = DstUsername

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`OldPrivileges`	ne	`NewPrivileges` transforms: `tostring`	`field:"OldPrivileges" kind:ne value:"NewPrivileges"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`DstUsername`	`summarize`
`NewPrivileges`	`summarize`
`AccountCustomEntity`	`extend`

PaloAlto - User privileges was changed

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Let binding: p used in Stage 4

Stage 1: source

Stage 2: where

Stage 3: summarize

Stage 4: join

Stage 5: where

Stage 6: extend

Indicators

Output fields

Let binding: `p` used in Stage 4

Stage 1: `source`

Stage 2: `where`

Stage 3: `summarize`

Stage 4: `join`

Stage 5: `where`

Stage 6: `extend`