NordPass - User deletes items in bulk

Severity: high
Time window: 10m
Group by: user_email
Source: github.com/Azure/Azure-Sentinel

This will alert you if a user deletes items in bulk, namely, more than 10 items or in the span of 10 minutes. If a mix of bulk and one-off deletions were performed, this will group all actions and report the total number of items deleted.

MITRE ATT&CK coverage

Tactic	Techniques
Collection	`T1074` Data Staged
Impact	`T1485` Data Destruction

Rule body

id: f72f630f-c890-49fe-b747-80f4fb3b6348
name: NordPass - User deletes items in bulk
kind: Scheduled
version: 1.0.0
displayName: User deletes items in bulk
description: |
  This will alert you if a user deletes items in bulk, namely, more than 10 items or in the span of 10 minutes. 
  If a mix of bulk and one-off deletions were performed, this will group all actions and report the total number of items deleted.
severity: High
query: |
  NordPassEventLogs_CL
  | where action == "items_deleted" and event_type == "item_delete"
  | extend item_count = array_length(todynamic(metadata).items)
  | summarize total_items = sum(item_count) by user_email
  | where total_items >= 10
requiredDataConnectors:
  - connectorId: NordPass
    dataTypes:
      - NordPassEventLogs_CL
queryFrequency: 5m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Impact
  - Collection
relevantTechniques:
  - T1485
  - T1074
incidentConfiguration:
  createIncident: false
customDetails:
  ItemCount: total_items
  User: user_email
entityMappings:
  - entityType: Mailbox
    fieldMappings:
      - identifier: MailboxPrimaryAddress
        columnName: user_email

Stages and Predicates

Stage 1: `source`

NordPassEventLogs_CL

Stage 2: `where`

| where action == "items_deleted" and event_type == "item_delete"

Stage 3: `extend`

| extend item_count = array_length(todynamic(metadata).items)

Stage 4: `summarize`

| summarize total_items = sum(item_count) by user_email

Stage 5: `where`

| where total_items >= 10

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`action`	eq	`items_deleted`	`field:"action" kind:eq value:"items_deleted"`
`event_type`	eq	`item_delete`	`field:"event_type" kind:eq value:"item_delete"`
`total_items`	ge	`10`	`field:"total_items" kind:ge value:"10"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`total_items`	`summarize`
`user_email`	`summarize`

NordPass - User deletes items in bulk

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: extend

Stage 4: summarize