Detection rules › Kusto
Threat Essentials - Mass Cloud resource deletions Time Series Anomaly
'This query generates baseline pattern of cloud resource deletions by an user and generated anomaly when any unusual spike is detected. These anomalies from unusual or privileged users could be an indication of cloud infrastructure take-down by an adversary '
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Impact |
Rule body
id: fa2658fe-3714-4c55-bb12-2b7275c628e8
name: Threat Essentials - Mass Cloud resource deletions Time Series Anomaly
description: |
'This query generates baseline pattern of cloud resource deletions by an user and generated anomaly when any unusual spike is detected.
These anomalies from unusual or privileged users could be an indication of cloud infrastructure take-down by an adversary '
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: AzureActivity
dataTypes:
- AzureActivity
queryFrequency: 1d
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
relevantTechniques:
- T1485
tags:
- DEV-0537
query: |
let starttime = 14d;
let endtime = 1d;
let timeframe = 1h;
let TotalEventsThreshold = 25;
let TimeSeriesData =
AzureActivity
| where TimeGenerated between (startofday(ago(starttime))..startofday(ago(endtime)))
| where OperationNameValue endswith "delete"
| project TimeGenerated, Caller
| make-series Total = count() on TimeGenerated from startofday(ago(starttime)) to startofday(ago(endtime)) step timeframe by Caller;
let TimeSeriesAlerts = materialize(TimeSeriesData
| extend (anomalies, score, baseline) = series_decompose_anomalies(Total, 3, -1, 'linefit')
| mv-expand Total to typeof(double), TimeGenerated to typeof(datetime), anomalies to typeof(double), score to typeof(double), baseline to typeof(long)
| where anomalies > 0
| project Caller, TimeGenerated, Total, baseline, anomalies, score
| where Total > TotalEventsThreshold and baseline > 0 );
TimeSeriesAlerts
| where TimeGenerated > (ago(endtime))
| project TimeGenerated, Caller
| join kind = inner (AzureActivity
| where TimeGenerated > (ago(endtime))
| where OperationNameValue endswith "delete"
| summarize count(), make_set(OperationNameValue), make_set(Resource) by bin(TimeGenerated, 1h), Caller) on TimeGenerated, Caller
| extend Name = iif(Caller has '@',tostring(split(Caller,'@',0)[0]),"")
| extend UPNSuffix = iif(Caller has '@',tostring(split(Caller,'@',1)[0]),"")
| extend AadUserId = iif(Caller !has '@',Caller,"")
entityMappings:
- entityType: Account
fieldMappings:
- identifier: Name
columnName: Name
- identifier: UPNSuffix
columnName: UPNSuffix
- identifier: AadUserId
columnName: AadUserId
version: 1.0.2
kind: Scheduled
Stages and Predicates
Parameters
let starttime = 14d;
let endtime = 1d;
let timeframe = 1h;
let TotalEventsThreshold = 25;
let TimeSeriesData and let TimeSeriesAlerts are inlined into the numbered stages below.
Stages 1 to 10 define let TimeSeriesAlerts (the rule's main pipeline source); stages 11 to 14 run on it.
Stage 1: source
AzureActivity
Stage 2: where
| where TimeGenerated between (startofday(ago(starttime))..startofday(ago(endtime)))
Stage 3: where
| where OperationNameValue endswith "delete"
Stage 4: project
| project TimeGenerated, Caller
The stages below score time-series anomalies (make-series, series_decompose_anomalies).
Stage 5: make-series
| make-series Total = count() on TimeGenerated from startofday(ago(starttime)) to startofday(ago(endtime)) step timeframe by Caller
Stage 6: extend
| extend (anomalies, score, baseline) = series_decompose_anomalies(Total, 3, -1, 'linefit')
Stage 7: mv-expand
| mv-expand Total to typeof(double), TimeGenerated to typeof(datetime), anomalies to typeof(double), score to typeof(double), baseline to typeof(long)
Stage 8: where
| where anomalies > 0
Stage 9: project
| project Caller, TimeGenerated, Total, baseline, anomalies, score
Stage 10: where
| where Total > TotalEventsThreshold and baseline > 0
Stage 11: where
TimeSeriesAlerts
| where TimeGenerated > (ago(endtime))
Stage 12: project
| project TimeGenerated, Caller
Stage 13: join
| join kind = inner (AzureActivity
| where TimeGenerated > (ago(endtime))
| where OperationNameValue endswith "delete"
| summarize count(), make_set(OperationNameValue), make_set(Resource) by bin(TimeGenerated, 1h), Caller) on TimeGenerated, Caller
Stage 14: extend (3 consecutive steps)
| extend Name = iif(Caller has '@',tostring(split(Caller,'@',0)[0]),"")
| extend UPNSuffix = iif(Caller has '@',tostring(split(Caller,'@',1)[0]),"")
| extend AadUserId = iif(Caller !has '@',Caller,"")
Indicators
These rows show field, operator, and value matches.
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
Caller | project |
TimeGenerated | project |
Name | extend |
UPNSuffix | extend |
AadUserId | extend |