NordPass - Deleting items of deleted member

Severity: high
Time window: 5m
Source: github.com/Azure/Azure-Sentinel

This will alert you if the deleted user's items have been removed without being transferred to another active user, as this could result in the loss of access to critical tools or information.

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1485` Data Destruction

Rule body

id: 0068dca4-dea0-46a3-a970-655e067a145f
name: NordPass - Deleting items of deleted member
kind: Scheduled
version: 1.0.0
displayName: Deleting items of deleted member
description: |
  This will alert you if the deleted user's items have been removed without being transferred to another active user, as this could result in the loss of access to critical tools or information.
severity: High
query: |
  NordPassEventLogs_CL
  | where event_type == "item_delete"
  | where action == "item_reassignment_deleted"
  | extend TargetEmail = user_email
requiredDataConnectors:
  - connectorId: NordPass
    dataTypes:
      - NordPassEventLogs_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Impact
relevantTechniques:
  - T1485
incidentConfiguration:
  createIncident: false
entityMappings:
  - entityType: Mailbox
    fieldMappings:
      - identifier: MailboxPrimaryAddress
        columnName: TargetEmail

Stages and Predicates

Stage 1: `source`

NordPassEventLogs_CL

Stage 2: `where`

| where event_type == "item_delete"

Stage 3: `where`

| where action == "item_reassignment_deleted"

Stage 4: `extend`

| extend TargetEmail = user_email

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`action`	eq	`item_reassignment_deleted`	`field:"action" kind:eq value:"item_reassignment_deleted"`
`event_type`	eq	`item_delete`	`field:"event_type" kind:eq value:"item_delete"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`TargetEmail`	`extend`