Detection rules › Panther
Unusual 1Password Client Detected
Detects when unusual or undesirable 1Password clients access your 1Password account
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1555 Credentials from Password Stores |
Rule body yaml
AnalysisType: rule
Filename: onepassword_unusual_client.py
RuleID: "OnePassword.Unusual.Client"
DedupPeriodMinutes: 120
DisplayName: "Unusual 1Password Client Detected"
Enabled: true
LogTypes:
- OnePassword.SignInAttempt
Severity: Medium
Description: Detects when unusual or undesirable 1Password clients access your 1Password account
Reference: https://support.1password.com/category/accounts/
Tags:
- 1Password
- Credential Access:Credentials from Password Stores
Reports:
MITRE ATT&CK:
- TA0006:T1555
SummaryAttributes:
- p_any_ip_addresses
- p_any_emails
Tests:
- Name: 1Password - Expected Client
ExpectedResult: false
Log:
{
"uuid": "1234",
"session_uuid": "12345",
"timestamp": "2021-12-15 18:02:23",
"category": "success",
"type": "credentials_ok",
"country": "US",
"target_user":
{
"email": "homer@springfield.gov",
"name": "Homer Simpson",
"uuid": "1234",
},
"client":
{
"app_name": "1Password for Mac",
"app_version": "70902005",
"ip_address": "1.1.1.1",
"os_name": "MacOSX",
"os_version": "11.6.1",
"platform_name": "US - C02FR0H8MD6P",
"platform_version": "MacBookPro16,1",
},
"p_log_type": "OnePassword.SignInAttempt",
}
- Name: 1Password - Bad Client
ExpectedResult: true
Log:
{
"uuid": "1234",
"session_uuid": "12345",
"timestamp": "2021-12-15 18:02:23",
"category": "success",
"type": "credentials_ok",
"country": "US",
"target_user":
{
"email": "homer@springfield.gov",
"name": "Homer Simpson",
"uuid": "1234",
},
"client":
{
"app_name": "Bartco 1Password Manager",
"app_version": "70902005",
"ip_address": "1.1.1.1",
"os_name": "MacOSX",
"os_version": "11.6.1",
"platform_name": "US - C02FR0H8MD6P",
"platform_version": "MacBookPro16,1",
},
"p_log_type": "OnePassword.SignInAttempt",
}
Detection logic
Condition
client.app_name not in ["1Password CLI", "1Password for Web", "1Password for Mac", "1Password SCIM Bridge", "1Password for Windows", "1Password for iOS", "1Password Browser Extension", "1Password for Android", "1Password for Linux", "1Password SDK"]
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
client.app_name | in | 1Password Browser Extension, 1Password CLI, 1Password SCIM Bridge, 1Password SDK, 1Password for Android, 1Password for Linux, 1Password for Mac, 1Password for Web, 1Password for Windows, 1Password for iOS |
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
app_name | client.app_name |