Zscaler - Connections by dormant user

Status: available
Severity: high
Time window: 14d
Group by: DstUserName
Source: github.com/Azure/Azure-Sentinel

'Detects ZPA connections by dormant user.'

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1078` Valid Accounts

Rule body

id: 66bc77ee-3e45-11ec-9bbc-0242ac130002
name: Zscaler - Connections by dormant user
description: |
  'Detects ZPA connections by dormant user.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: CustomLogsAma
    datatypes:
      - ZPA_CL
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Persistence
relevantTechniques:
  - T1078
query: |
  let dt_lastlogintime = 14d;
  let activeUsers =
  ZPAEvent 
  | where TimeGenerated > ago(dt_lastlogintime)
  | where DvcAction == 'open'
  | summarize lastLoginTime = max(TimeGenerated) by DstUserName
  | summarize makelist(DstUserName);
  ZPAEvent
  | where DstUserName !in~ (activeUsers)
  | summarize EventCount = count() by DstUserName
  | project-away EventCount
  | extend AccountCustomEntity = DstUserName
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountCustomEntity
version: 1.0.2
kind: Scheduled

Stages and Predicates

Parameters

let dt_lastlogintime = 14d;

Let binding: `activeUsers` used in Stage 2

let activeUsers = ZPAEvent 
| where TimeGenerated > ago(dt_lastlogintime)
| where DvcAction == 'open'
| summarize lastLoginTime = max(TimeGenerated) by DstUserName
| summarize makelist(DstUserName);

Stage 1: `source`

ZPAEvent

Stage 2: `where`

| where DstUserName !in~ (activeUsers)

Stage 3: `summarize`

| summarize EventCount = count() by DstUserName

Stage 4: `project-away`

| project-away EventCount

Stage 5: `extend`

| extend AccountCustomEntity = DstUserName

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`DstUserName`	eq	`activeUsers`	`excludes:DstUserName` `field:"DstUserName" value:"activeUsers"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`DstUserName`	`summarize`
`AccountCustomEntity`	`extend`

Zscaler - Connections by dormant user

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Let binding: activeUsers used in Stage 2

Stage 1: source

Stage 2: where

Stage 3: summarize

Stage 4: project-away

Stage 5: extend

Exclusions

Output fields

Let binding: `activeUsers` used in Stage 2

Stage 1: `source`

Stage 2: `where`

Stage 3: `summarize`

Stage 4: `project-away`

Stage 5: `extend`