Detection rules › Panther
Zendesk Account Owner Changed
Only one admin user can be the account owner. Ensure the change in ownership is expected.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Privilege Escalation | T1078 Valid Accounts |
Rule body yaml
AnalysisType: rule
Filename: zendesk_new_owner.py
RuleID: "Zendesk.AccountOwnerChanged"
DedupPeriodMinutes: 60
DisplayName: "Zendesk Account Owner Changed"
Enabled: true
LogTypes:
- Zendesk.Audit
Severity: High
Tags:
- Zendesk
- Privilege Escalation:Valid Accounts
Reports:
MITRE ATT&CK:
- TA0004:T1078
Description: Only one admin user can be the account owner. Ensure the change in ownership is expected.
Reference: https://support.zendesk.com/hc/en-us/articles/4408822084634-Changing-the-account-owner
SummaryAttributes:
- p_any_ip_addresses
Tests:
- Name: Zendesk - Owner Changed
ExpectedResult: true
Log:
{
"url": "https://myzendek.zendesk.com/api/v2/audit_logs/111222333444.json",
"id": 123456789123,
"action_label": "Updated",
"actor_id": 123,
"actor_name": "John Doe",
"source_id": 123,
"source_type": "account",
"source_label": "Account: Account",
"action": "update",
"change_description": "Owner changed from Bob Cat to Mountain Lion",
"ip_address": "127.0.0.1",
"created_at": "2021-05-28T18:39:50Z",
"p_log_type": "Zendesk.Audit",
}
- Name: Zendesk - Admin Role Assigned
ExpectedResult: false
Log:
{
"url": "https://myzendek.zendesk.com/api/v2/audit_logs/111222333444.json",
"id": 123456789123,
"action_label": "Updated",
"actor_id": 123,
"actor_name": "John Doe",
"source_id": 123,
"source_type": "user",
"source_label": "Account: Account",
"action": "update",
"change_description": "Role changed from End User to Administrator",
"ip_address": "127.0.0.1",
"created_at": "2021-05-28T18:39:50Z",
"p_log_type": "Zendesk.Audit",
}
Detection logic
Condition
action eq "update"
source_type eq "account"
This rule also runs imperative logic the parser cannot express as a filter; the conditions above are the structured part it could extract.
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
action | eq |
|
source_type | eq |
|