ApexOne - Device access permissions was changed

Status: available
Severity: medium
Time window: 1h
Group by: DstUserName
Source: github.com/Azure/Azure-Sentinel

'Query shows device access permissions was changed.'

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1078` Valid Accounts

Rule body

id: b463b952-67b8-11ec-90d6-0242ac120003
name: ApexOne - Device access permissions was changed
description: |
  'Query shows device access permissions was changed.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: CefAma
    dataTypes:
      - CommonSecurityLog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - PrivilegeEscalation
relevantTechniques:
  - T1078
query: |
  let threshold = 1;
  TMApexOneEvent
  | where EventMessage has "Device access"
  | extend DeviceCustomNumber3 = coalesce(
                                    column_ifexists("FieldDeviceCustomNumber3", long(null)),
                                    DeviceCustomNumber3,
                                    long(null)
                                )
  | extend Permission = case(
                              DeviceCustomNumber3 == "0", "Modify", 
                              DeviceCustomNumber3 == "1", "Read and execute",
                              DeviceCustomNumber3 == "2", "Read",
                              DeviceCustomNumber3 == "3", "List device content only", 
                              DeviceCustomNumber3 == "4", "Block",
                              "unknown"
                        )
  | summarize Permissions = make_set(Permission) by DstUserName
  | extend PermissionCount = array_length(Permissions)
  | where PermissionCount > threshold
  | extend AccountCustomEntity = DstUserName
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountCustomEntity
version: 1.0.4
kind: Scheduled

Stages and Predicates

Parameters

let threshold = 1;

Stage 1: `source`

TMApexOneEvent

Stage 2: `where`

| where EventMessage has "Device access"

Stage 3: `extend`

| extend DeviceCustomNumber3 = coalesce(
                                  column_ifexists("FieldDeviceCustomNumber3", long(null)),
                                  DeviceCustomNumber3,
                                  long(null)
                              )

Stage 4: `extend`

| extend Permission = case(
                            DeviceCustomNumber3 == "0", "Modify", 
                            DeviceCustomNumber3 == "1", "Read and execute",
                            DeviceCustomNumber3 == "2", "Read",
                            DeviceCustomNumber3 == "3", "List device content only", 
                            DeviceCustomNumber3 == "4", "Block",
                            "unknown"
                      )

Permission =

ifDeviceCustomNumber3 == 0"Modify"

elifDeviceCustomNumber3 == 1"Read and execute"

elifDeviceCustomNumber3 == 2"Read"

elifDeviceCustomNumber3 == 3"List device content only"

elifDeviceCustomNumber3 == 4"Block"

else"unknown"

Stage 5: `summarize`

| summarize Permissions = make_set(Permission) by DstUserName

Stage 6: `extend`

| extend PermissionCount = array_length(Permissions)

Stage 7: `where`

| where PermissionCount > threshold

Stage 8: `extend`

| extend AccountCustomEntity = DstUserName

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventMessage`	match	`Device access` transforms: `term`	`field:"EventMessage" kind:match value:"Device access"`
`PermissionCount`	gt	`1`	`field:"PermissionCount" kind:gt value:"1"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`DstUserName`	`summarize`
`Permissions`	`summarize`
`PermissionCount`	`extend`
`AccountCustomEntity`	`extend`

ApexOne - Device access permissions was changed

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Stage 1: source

Stage 2: where

Stage 3: extend

Stage 4: extend

Stage 5: summarize

Stage 6: extend

Stage 7: where

Stage 8: extend