Zscaler - ZPA connections from new IP

Status: available
Severity: medium
Time window: 14d
Group by: DstUserName, SrcIpAddr
Source: github.com/Azure/Azure-Sentinel

'Detects ZPA connections from new IP.'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts `T1133` External Remote Services

Rule body

id: 24f0779d-3927-403a-aac1-cc8791653606
name: Zscaler - ZPA connections from new IP
description: |
  'Detects ZPA connections from new IP.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: CustomLogsAma
    datatypes:
      - ZPA_CL
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1078
  - T1133
query: |
  let listIPs =
  ZPAEvent 
  | where TimeGenerated > ago(14d)
  | where DvcAction == 'open'
  | summarize ListofIPs = make_set(SrcIpAddr) by DstUserName
  | project ListofIPs;
  ZPAEvent
  | where isnotempty(SrcIpAddr)
  | where SrcIpAddr !in (listIPs)
  | summarize EventCount = count() by DstUserName, SrcIpAddr
  | project-away EventCount
  | extend IPCustomEntity = SrcIpAddr, AccountCustomEntity = DstUserName
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountCustomEntity
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity
version: 1.0.2
kind: Scheduled

Stages and Predicates

Let binding: `listIPs` used in Stage 3

let listIPs = ZPAEvent 
| where TimeGenerated > ago(14d)
| where DvcAction == 'open'
| summarize ListofIPs = make_set(SrcIpAddr) by DstUserName
| project ListofIPs;

Stage 1: `source`

ZPAEvent

Stage 2: `where`

| where isnotempty(SrcIpAddr)

Stage 3: `where`

| where SrcIpAddr !in (listIPs)

Stage 4: `summarize`

| summarize EventCount = count() by DstUserName, SrcIpAddr

Stage 5: `project-away`

| project-away EventCount

Stage 6: `extend`

| extend IPCustomEntity = SrcIpAddr, AccountCustomEntity = DstUserName

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`SrcIpAddr`	eq	`listIPs`	`excludes:SrcIpAddr` `field:"SrcIpAddr" value:"listIPs"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`SrcIpAddr`	is_not_null	(no value, null check)	`field:"src_ip" kind:is_not_null`

Output fields

These fields are emitted when the rule matches.

Field	Source
`DstUserName`	`summarize`
`SrcIpAddr`	`summarize`
`AccountCustomEntity`	`extend`
`IPCustomEntity`	`extend`

Zscaler - ZPA connections from new IP

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Let binding: listIPs used in Stage 3

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: summarize

Stage 5: project-away

Stage 6: extend

Exclusions

Indicators

Output fields

Let binding: `listIPs` used in Stage 3

Stage 1: `source`

Stage 2: `where`

Stage 3: `where`

Stage 4: `summarize`

Stage 5: `project-away`

Stage 6: `extend`