Detection rules › Panther
BETA - Sensitive 1Password Item Accessed
Alerts when a user defined list of sensitive items in 1Password is accessed
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1552 Unsecured Credentials |
Rule body yaml
AnalysisType: rule
Filename: onepassword_lut_sensitive_item_access.py
RuleID: "OnePassword.Lut.Sensitive.Item"
DedupPeriodMinutes: 30
DisplayName: "BETA - Sensitive 1Password Item Accessed"
Enabled: false
LogTypes:
- OnePassword.ItemUsage
Reference: https://support.1password.com/1password-com-items/
Severity: Low
Description: Alerts when a user defined list of sensitive items in 1Password is accessed
SummaryAttributes:
- p_any_ip_addresses
- p_any_emails
Tags:
- Configuration Required
- 1Password
- Lookup Table
- Credential Access:Unsecured Credentials
Status: Experimental
Reports:
MITRE ATT&CK:
- TA0006:T1552
Tests:
- Name: 1Password - Sensitive Item Accessed
ExpectedResult: true
Log:
{
"client":
{
"app_name": "1Password Browser Extension",
"app_version": "20195",
"ip_address": "1.1.1.1",
"os_name": "MacOSX",
"os_version": "10.15.7",
"platform_name": "Chrome",
"platform_version": "98.0.4758.102",
},
"item_uuid": "1234",
"p_enrichment":
{
"1Password Translation":
{
"item_uuid":
{
"title": "demo_item",
"updatedAt": "2022-02-14 17:44:50.000000000",
"uuid": "12344321",
},
},
},
"p_log_type": "OnePassword.ItemUsage",
"timestamp": "2022-02-23 22:11:50.591",
"user":
{
"email": "homer@springfield.gov",
"name": "Homer Simpson",
"uuid": "12345",
},
"uuid": "12345",
"vault_uuid": "54321",
}
- Name: 1Password - Non-Sensitive Item Accessed
ExpectedResult: false
Log:
{
"client":
{
"app_name": "1Password Browser Extension",
"app_version": "20195",
"ip_address": "1.1.1.1",
"os_name": "MacOSX",
"os_version": "10.15.7",
"platform_name": "Chrome",
"platform_version": "98.0.4758.102",
},
"item_uuid": "1234",
"p_enrichment":
{
"1Password Translation":
{
"item_uuid":
{
"title": "not_sensitive",
"updatedAt": "2022-02-14 17:44:50.000000000",
"uuid": "12344321",
},
},
},
"p_log_type": "OnePassword.ItemUsage",
"timestamp": "2022-02-23 22:11:50.591",
"user":
{
"email": "homer@springfield.gov",
"name": "Homer Simpson",
"uuid": "12345",
},
"uuid": "12345",
"vault_uuid": "54321",
}
Detection logic
Condition
p_enrichment.1Password Translation.item_uuid.title in "demo_item"
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
p_enrichment.1Password Translation.item_uuid.title | in |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
user | user.name |
item_name | p_enrichment.1Password Translation.item_uuid.title |
client | client.app_name |
ip_address | source_ip |
event_time | timestamp |