Azure secure score user risk policy

Status: available
Severity: medium
Time window: 6h
Source: github.com/Azure/Azure-Sentinel

'This query searches for an active Azure Premium P2 license is required to use and edit this policy. You will be required to have setup the MFA Policy before activating this policy'

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1529` System Shutdown/Reboot

Rule body

id: 1C07A4CB-E31B-4917-BD2A-3572E42F602C
name: Azure secure score user risk policy
description: |
  'This query searches for an active Azure Premium P2 license is required to use and edit this policy. 
   You will be required to have setup the MFA Policy before activating this policy'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: SenservaPro
    dataTypes:
      - SenservaPro_CL
queryFrequency: 6h
queryPeriod: 6h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Impact
relevantTechniques:
  - T1529
query: |
  SenservaPro_CL
  | where ControlName_s == 'AzureSecureScoreUserRiskPolicy'
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: ControlName_s
      - identifier: AadTenantId
        columnName: TenantId
      - identifier: DisplayName
        columnName: TenantDisplayName_s 
  - entityType: SecurityGroup
    fieldMappings:
      - identifier: DistinguishedName
        columnName: Group_s
  - entityType: AzureResource
    fieldMappings:
      - identifier: ResourceId
        columnName: SourceSystem 
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

SenservaPro_CL

Stage 2: `where`

| where ControlName_s == 'AzureSecureScoreUserRiskPolicy'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ControlName_s`	eq	`AzureSecureScoreUserRiskPolicy`	`field:"ControlName_s" kind:eq value:"AzureSecureScoreUserRiskPolicy"`