Zscaler - Unexpected ZPA session duration

Status: available
Severity: medium
Time window: 1d
Group by: ConnectionID, DstUserName, SrcIpAddr
Source: github.com/Azure/Azure-Sentinel

'Detects Unexpected ZPA session duration.'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts `T1133` External Remote Services

Rule body

id: e07846e0-43ad-11ec-81d3-0242ac130003
name: Zscaler - Unexpected ZPA session duration
description: |
  'Detects Unexpected ZPA session duration.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: CustomLogsAma
    datatypes:
      - ZPA_CL
queryFrequency: 1h
queryPeriod: 24h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1078
  - T1133
query: |
  let dt_lookBack = 24h;
  let time_treshhold = timespan(08:00:00);
  let open_sessions =
  ZPAEvent
  | where TimeGenerated > ago(dt_lookBack)
  | where DvcAction == 'open'
  | summarize timestampstart = min(TimeGenerated) by DstUserName, SrcIpAddr, ConnectionID
  | sort by timestampstart asc;
  let closed_sessions =
  ZPAEvent
  | where TimeGenerated > ago(dt_lookBack)
  | where DvcAction == 'close'
  | summarize timestampend = max(TimeGenerated) by DstUserName, SrcIpAddr, ConnectionID
  | sort by timestampend asc;
  open_sessions
  | join (closed_sessions) on DstUserName, SrcIpAddr, ConnectionID
  | extend duration = timestampend - timestampstart
  | where duration > time_treshhold
  | where DstUserName !has "ZPA LSS"
  | sort by timestampstart asc
  | extend IPCustomEntity = SrcIpAddr, AccountCustomEntity = DstUserName
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountCustomEntity
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity
version: 1.0.3
kind: Scheduled

Stages and Predicates

Parameters

let dt_lookBack = 24h;
let time_treshhold = timespan(08:00:00);

let open_sessions is inlined into the numbered stages below.

Let binding: `closed_sessions` used in Stage 6

let closed_sessions = ZPAEvent
| where TimeGenerated > ago(dt_lookBack)
| where DvcAction == 'close'
| summarize timestampend = max(TimeGenerated) by DstUserName, SrcIpAddr, ConnectionID
| sort by timestampend asc;

Stages 1 to 5 define let open_sessions (the rule's main pipeline source); stages 6 to 11 run on it.

Stage 1: `source`

ZPAEvent

Stage 2: `where`

| where TimeGenerated > ago(dt_lookBack)

Stage 3: `where`

| where DvcAction == 'open'

Stage 4: `summarize`

| summarize timestampstart = min(TimeGenerated) by DstUserName, SrcIpAddr, ConnectionID

Stage 5: `sort`

| sort by timestampstart asc

Stage 6: `join`

open_sessions
| join (closed_sessions) on DstUserName, SrcIpAddr, ConnectionID

Stage 7: `extend`

| extend duration = timestampend - timestampstart

Stage 8: `where`

| where duration > time_treshhold

Stage 9: `where`

| where DstUserName !has "ZPA LSS"

Stage 10: `sort`

| sort by timestampstart asc

Stage 11: `extend`

| extend IPCustomEntity = SrcIpAddr, AccountCustomEntity = DstUserName

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`DstUserName`	match	`ZPA LSS`	`excludes:DstUserName` `field:"DstUserName" value:"ZPA LSS"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`DvcAction`	eq	`close` `open`	`field:"DvcAction" kind:eq`
`duration`	cross_field_compare	`time_treshhold` transforms: `op:gt`	`field:"duration" kind:cross_field_compare value:"time_treshhold"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`ConnectionID`	`summarize`
`DstUserName`	`summarize`
`SrcIpAddr`	`summarize`
`timestampstart`	`summarize`
`duration`	`extend`
`AccountCustomEntity`	`extend`
`IPCustomEntity`	`extend`

Zscaler - Unexpected ZPA session duration

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Let binding: closed_sessions used in Stage 6

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: summarize

Stage 5: sort

Stage 6: join

Stage 7: extend

Stage 8: where

Stage 9: where

Stage 10: sort

Stage 11: extend