NordPass - Deleting items of deleted member

Back


Id	0068dca4-dea0-46a3-a970-655e067a145f
Rulename	NordPass - Deleting items of deleted member
Description	This will alert you if the deleted user’s items have been removed without being transferred to another active user, as this could result in the loss of access to critical tools or information.
Severity	High
Tactics	Impact
Techniques	T1485
Required data connectors	NordPass
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_items_reassignment_deletion.yaml
Version	1.0.0
Arm template	0068dca4-dea0-46a3-a970-655e067a145f.json

KQL

NordPassEventLogs_CL
| where event_type == "item_delete"
| where action == "item_reassignment_deleted"
| extend TargetEmail = user_email

YAML

queryPeriod: 5m
id: 0068dca4-dea0-46a3-a970-655e067a145f
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_items_reassignment_deletion.yaml
incidentConfiguration:
  createIncident: false
triggerOperator: gt
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - identifier: MailboxPrimaryAddress
    columnName: TargetEmail
  entityType: Mailbox
displayName: Deleting items of deleted member
kind: Scheduled
name: NordPass - Deleting items of deleted member
relevantTechniques:
- T1485
description: |
    This will alert you if the deleted user's items have been removed without being transferred to another active user, as this could result in the loss of access to critical tools or information.
query: |
  NordPassEventLogs_CL
  | where event_type == "item_delete"
  | where action == "item_reassignment_deleted"
  | extend TargetEmail = user_email  
version: 1.0.0
tactics:
- Impact
requiredDataConnectors:
- dataTypes:
  - NordPassEventLogs_CL
  connectorId: NordPass
severity: High
queryFrequency: 5m

ARM