detection.wiki

Detection rules › Panther

Zendesk User Suspension Status Changed

Severity
high
Log types
Zendesk.Audit
Tags
Zendesk, Impact:Account Access Removal
Reference
https://support.zendesk.com/hc/en-us/articles/4408889293978-Suspending-a-user#:~:text=select%20Unsuspend%20access.-,Identifying%20suspended%20users,name%20on%20the%20Customers%20page
Source
github.com/panther-labs/panther-analysis

A user's Zendesk suspension status was changed.

MITRE ATT&CK coverage

TacticTechniques
ImpactT1531 Account Access Removal

Rule body yaml

AnalysisType: rule
Filename: zendesk_user_suspension.py
RuleID: "Zendesk.UserSuspension"
DedupPeriodMinutes: 60
DisplayName: "Zendesk User Suspension Status Changed"
Enabled: true
LogTypes:
  - Zendesk.Audit
Tags:
  - Zendesk
  - Impact:Account Access Removal
Reports:
  MITRE ATT&CK:
    - TA0040:T1531
Severity: High
Description: A user's Zendesk suspension status was changed.
Runbook: Ensure the user's suspension status is appropriate.
Reference: https://support.zendesk.com/hc/en-us/articles/4408889293978-Suspending-a-user#:~:text=select%20Unsuspend%20access.-,Identifying%20suspended%20users,name%20on%20the%20Customers%20page
SummaryAttributes:
  - p_any_ip_addresses
Tests:
  - Name: Zendesk - Suspension Enabled
    ExpectedResult: true
    Log:
      {
        "url": "https://myzendek.zendesk.com/api/v2/audit_logs/111222333444.json",
        "id": 123456789123,
        "action_label": "Updated",
        "actor_id": 123,
        "actor_name": "John Doe",
        "source_id": 123,
        "source_type": "user_setting",
        "source_label": "Suspension state: Bob Cat",
        "action": "create",
        "change_description": "Suspended",
        "ip_address": "127.0.0.1",
        "created_at": "2021-05-28T18:39:50Z",
        "p_log_type": "Zendesk.Audit",
      }
  - Name: Zendesk - Suspension Disabled
    ExpectedResult: true
    Log:
      {
        "url": "https://myzendek.zendesk.com/api/v2/audit_logs/111222333444.json",
        "id": 123456789123,
        "action_label": "Updated",
        "actor_id": 123,
        "actor_name": "John Doe",
        "source_id": 123,
        "source_type": "user_setting",
        "source_label": "Suspension state: Bob Cat",
        "action": "update",
        "change_description": "Unsuspended",
        "ip_address": "127.0.0.1",
        "created_at": "2021-05-28T18:39:50Z",
        "p_log_type": "Zendesk.Audit",
      }
  - Name: Zendesk - Admin Role Assigned
    ExpectedResult: false
    Log:
      {
        "url": "https://myzendek.zendesk.com/api/v2/audit_logs/111222333444.json",
        "id": 123456789123,
        "action_label": "Updated",
        "actor_id": 123,
        "actor_name": "John Doe",
        "source_id": 123,
        "source_type": "user",
        "source_label": "Bob Cat",
        "action": "update",
        "change_description": "Role changed from End User to Administrator",
        "ip_address": "127.0.0.1",
        "created_at": "2021-05-28T18:39:50Z",
        "p_log_type": "Zendesk.Audit",
      }

Detection logic

Condition

source_type eq "user_setting"
action in ["create", "update"]

This rule also runs imperative logic the parser cannot express as a filter; the conditions above are the structured part it could extract.

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
actionin
  • create
  • update
source_typeeq
  • user_setting

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

Field
actor_user