detection.wiki

Detection rules › Kusto

Zero Networks Segment - New API Token created

Status
available
Severity
low
Time window
5m
Source
github.com/Azure/Azure-Sentinel

'Detects when a api token has been created.'

MITRE ATT&CK coverage

TacticTechniques
Credential Access

Rule body

id: 603a6b18-b54a-43b7-bb61-d2b0b47d224a
name: Zero Networks Segment - New API Token created
description: |
  'Detects when a api token has been created.'
severity: Low
status: Available
requiredDataConnectors:
  - connectorId: ZeroNetworksSegmentAuditFunction
    dataTypes:
      - ZNSegmentAudit_CL
  - connectorId: ZeroNetworksSegmentAuditNativePoller
    dataTypes:
      - ZNSegmentAuditNativePoller_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CredentialAccess
relevantTechniques:
  - T1528
query: |
  ZNSegmentAudit
  | where AuditTypeId == 25
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: PerformedByName
version: 1.0.1
kind: Scheduled

Stages and Predicates

Stage 1: source

ZNSegmentAudit

Stage 2: where

| where AuditTypeId == 25

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
AuditTypeIdeq
  • 25
field:"AuditTypeId" kind:eq value:"25"