Detection rules › Kusto
Utimaco ESKM - Burst of KMIP DESTROY operations by a single user
Identifies a single KMIP user issuing 20 or more DESTROY operations within 10 minutes on Utimaco ESKM. May indicate mass key/object deletion, insider sabotage, or ransomware-style cryptographic-material destruction.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Impact |
Rule body
id: 9b1a3b3e-7e16-4a3b-8a8f-7f1f2b1c0a03
name: Utimaco ESKM - Burst of KMIP DESTROY operations by a single user
description: |
Identifies a single KMIP user issuing 20 or more DESTROY operations within 10 minutes on Utimaco ESKM. May indicate mass key/object deletion, insider sabotage, or ransomware-style cryptographic-material destruction.
severity: High
status: Available
requiredDataConnectors:
- connectorId: UtimacoESKMConnector
dataTypes:
- UtimacoESKMKmipServerLogs_CL
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
relevantTechniques:
- T1485
query: |
UtimacoESKMKmipServerLogs_CL
| where TimeGenerated > ago(10m)
| where Operation == "DESTROY"
| where Result == "SUCCESS"
| where isnotempty(User)
| summarize DestroyCount = count(), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), ObjectTypes = make_set(ObjectType, 25), UUIDs = make_set(UUID, 100), SourceIPs = make_set(IP, 25) by User
| where DestroyCount >= 20
| extend AccountCustomEntity = User
entityMappings:
- entityType: Account
fieldMappings:
- identifier: Name
columnName: AccountCustomEntity
version: 1.0.0
kind: Scheduled
Stages and Predicates
Stage 1: source
UtimacoESKMKmipServerLogs_CL
Stage 2: where
| where TimeGenerated > ago(10m)
Stage 3: where
| where Operation == "DESTROY"
Stage 4: where
| where Result == "SUCCESS"
Stage 5: where
| where isnotempty(User)
Stage 6: summarize
| summarize DestroyCount = count(), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), ObjectTypes = make_set(ObjectType, 25), UUIDs = make_set(UUID, 100), SourceIPs = make_set(IP, 25) by User
Stage 7: where
| where DestroyCount >= 20
Stage 8: extend
| extend AccountCustomEntity = User
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
DestroyCount | ge |
| field:"DestroyCount" kind:ge value:"20" |
Operation | eq |
| field:"Operation" kind:eq value:"DESTROY" |
Result | eq |
| field:"Result" kind:eq value:"SUCCESS" |
User | is_not_null | field:"user" kind:is_not_null |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
DestroyCount | summarize |
EndTime | summarize |
ObjectTypes | summarize |
SourceIPs | summarize |
StartTime | summarize |
UUIDs | summarize |
User | summarize |
AccountCustomEntity | extend |