NordPass - Manual invitation, suspension, or deletion

Severity: medium
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

This will alert you when the user is manually invited, suspended, or deleted. !This rule should be enabled only by organizations that have User and Group Provisioning enabled.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1098` Account Manipulation

Rule body

id: 693c5217-e840-427f-9661-3fa0ef266040
name: NordPass - Manual invitation, suspension, or deletion
kind: Scheduled
version: 1.0.0
displayName: Manual invitation, suspension, or deletion
description: |
  This will alert you when the user is manually invited, suspended, or deleted.
  
  !This rule should be enabled only by organizations that have User and Group Provisioning enabled.
severity: Medium
query: |
  NordPassEventLogs_CL  
  | extend metadataParsed = parse_json(metadata)  
  | where (event_type == "invites" and action == "user_invited") or (event_type == "access" and action == "user_status_updated" and (metadataParsed.status == "suspended" or metadataParsed.status == "deleted"))  
  | extend TargetEmail = user_email
requiredDataConnectors:
  - connectorId: NordPass
    dataTypes:
      - NordPassEventLogs_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Persistence
relevantTechniques:
  - T1098
incidentConfiguration:
  createIncident: false
entityMappings:
  - entityType: Mailbox
    fieldMappings:
      - identifier: MailboxPrimaryAddress
        columnName: TargetEmail

Stages and Predicates

Stage 1: `source`

NordPassEventLogs_CL

Stage 2: `extend`

| extend metadataParsed = parse_json(metadata)

Stage 3: `where`

| where (event_type == "invites" and action == "user_invited") or (event_type == "access" and action == "user_status_updated" and (metadataParsed.status == "suspended" or metadataParsed.status == "deleted"))

Stage 4: `extend`

| extend TargetEmail = user_email

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`action`	eq	`user_invited` `user_status_updated`	`field:"action" kind:eq`
`event_type`	eq	`access` `invites`	`field:"event_type" kind:eq`
`status`	eq	`deleted` `suspended`	`field:"status" kind:eq`

Output fields

These fields are emitted when the rule matches.

Field	Source
`metadataParsed`	`extend`
`TargetEmail`	`extend`