Unusual Volume of Password Updated or Removed

Status: available
Severity: low
Time window: 14d
Group by: IP_Address_s, Username_s
Source: github.com/Azure/Azure-Sentinel

'This rule will check if there is an unnormal activity of sites that are deleted or changed per user. The normal amount of actions is calculated based on the previous 14 days of activity. If there is a significant increase, an incident will be created.'

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1485` Data Destruction

Rule body

id: a3bbdf60-0a6d-4cc2-b1d1-dd70aca184ce
name: Unusual Volume of Password Updated or Removed
description: |
  'This rule will check if there is an unnormal activity of sites that are deleted or changed per user.
   The normal amount of actions is calculated based on the previous 14 days of activity. If there is a significant increase, an incident will be created.'
severity: Low
status: Available
requiredDataConnectors:
  - connectorId: LastPass
    dataTypes:
      - LastPassNativePoller_CL
queryFrequency: 1d
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
eventGroupingSettings:
  aggregationKind: AlertPerResult
tactics:
  - Impact
relevantTechniques:
 - T1485
query: |
    let threshold = toscalar (LastPassNativePoller_CL
    | where todatetime(Time_s) >= startofday(ago(14d)) and todatetime(Time_s) < startofday(ago(1d))
    | where Action_s == "Site Changed" or Action_s == "Deleted Sites" 
    | summarize count() by Username_s, bin(todatetime(Time_s),1d)
    | summarize avg(count_), stdev(count_)
    | project threshold = avg_count_+stdev_count_*2);
    LastPassNativePoller_CL
    | where Username_s != "API"
    | where Action_s == "Site Changed" or Action_s == "Deleted Sites" and todatetime(Time_s) >= startofday(ago(1d))
    | summarize count() by Username_s, IP_Address_s
    | where count_ > ['threshold']
    | extend AccountCustomEntity = Username_s, IPCustomEntity = IP_Address_s
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountCustomEntity
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity
version: 1.0.0
kind: Scheduled

Stages and Predicates

Let binding: `threshold` used in Stage 5

let threshold = toscalar (LastPassNativePoller_CL
| where todatetime(Time_s) >= startofday(ago(14d)) and todatetime(Time_s) < startofday(ago(1d))
| where Action_s == "Site Changed" or Action_s == "Deleted Sites" 
| summarize count() by Username_s, bin(todatetime(Time_s),1d)
| summarize avg(count_), stdev(count_)
| project threshold = avg_count_+stdev_count_*2);

Stage 1: `source`

LastPassNativePoller_CL

Stage 2: `where`

| where Username_s != "API"

Stage 3: `where`

| where Action_s == "Site Changed" or Action_s == "Deleted Sites" and todatetime(Time_s) >= startofday(ago(1d))

Stage 4: `summarize`

| summarize count() by Username_s, IP_Address_s

Stage 5: `where`

| where count_ > ['threshold']

Stage 6: `extend`

| extend AccountCustomEntity = Username_s, IPCustomEntity = IP_Address_s

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Action_s`	eq	`Deleted Sites` `Site Changed`	`field:"Action_s" kind:eq`
`Username_s`	ne	`API`	`field:"Username_s" kind:ne value:"API"`
`count_`	cross_field_compare	`threshold` transforms: `op:gt`	`field:"count_" kind:cross_field_compare value:"threshold"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`IP_Address_s`	`summarize`
`Username_s`	`summarize`
`AccountCustomEntity`	`extend`
`IPCustomEntity`	`extend`

Unusual Volume of Password Updated or Removed

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Let binding: threshold used in Stage 5

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: summarize

Stage 5: where

Stage 6: extend