Dataverse - Honeypot instance activity

Back


Id	11650b85-d8cc-49c4-8c04-a8a739635983
Rulename	Dataverse - Honeypot instance activity
Description	Identifies activities in a predefined Honeypot Dataverse instance. Alerts when either sign-in to the Honeypot is detected or when monitored Dataverse tables in the Honeypot are accessed. Note: Requires a dedicated Honeypot Dataverse instance in Power Platform with auditing enabled.
Severity	Medium
Tactics	Discovery Exfiltration
Techniques	T1538 T1526 T1567
Required data connectors	Dataverse
Kind	Scheduled
Query frequency	1h
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Honeypot instance activity.yaml
Version	3.2.0
Arm template	11650b85-d8cc-49c4-8c04-a8a739635983.json

KQL

let honeypot_dataverse_instances = dynamic(["https://myinstance.crm.dynamics.com/"]);
let honeypot_authorized_users = dynamic(["scanner@mydomain.com"]);
let monitored_dataverse_entities = dynamic(["contact", "account", "opportunity", "lead", "competitor"]);
let query_frequency = 1h;
DataverseActivity
| where TimeGenerated >= ago(query_frequency)
| where InstanceUrl in (honeypot_dataverse_instances)
| where UserId !in (honeypot_authorized_users)
| where UserId !endswith "@onmicrosoft.com"
    and UserId != "Unknown"
    and isnotempty(ClientIp)
| where Message in ("UserSignIn") or EntityName in (monitored_dataverse_entities)
| summarize
    TimeStart = min(TimeGenerated),
    TimeEnd = max(TimeGenerated),
    Entities = make_set(EntityName, 10),
    Messages = make_set(Message, 10)
    by UserId, ClientIp, InstanceUrl
| extend Severity = iif(array_length(set_difference(Messages, dynamic(["UserSignIn"]))) > 0, "Medium", "Low")
| extend CloudAppId = int(32780)
| extend AccountName = tostring(split(UserId, '@')[0])
| extend UPNSuffix = tostring(split(UserId, '@')[1])
| project
    TimeStart,
    TimeEnd,
    UserId,
    ClientIp,
    InstanceUrl,
    Messages,
    Entities,
    Severity,
    CloudAppId,
    AccountName,
    UPNSuffix

YAML

relevantTechniques:
- T1538
- T1526
- T1567
name: Dataverse - Honeypot instance activity
queryPeriod: 1d
triggerThreshold: 0
alertDetailsOverride:
  alertDescriptionFormat: '{{UserId}} from {{ClientIp}} was detected in the Dataverse honeypot instance: {{InstanceUrl}}'
  alertSeverityColumnName: Severity
  alertDisplayNameFormat: 'Dataverse - Honeytoken activity detected in {{InstanceUrl}} '
id: 11650b85-d8cc-49c4-8c04-a8a739635983
eventGroupingSettings:
  aggregationKind: SingleAlert
severity: Medium
requiredDataConnectors:
- dataTypes:
  - DataverseActivity
  connectorId: Dataverse
description: |
  Identifies activities in a predefined Honeypot Dataverse instance. Alerts when either sign-in to the Honeypot is detected or when monitored Dataverse tables in the Honeypot are accessed.

  Note: Requires a dedicated Honeypot Dataverse instance in Power Platform with auditing enabled.  
version: 3.2.0
status: Available
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountName
    identifier: Name
  - columnName: UPNSuffix
    identifier: UPNSuffix
- entityType: IP
  fieldMappings:
  - columnName: ClientIp
    identifier: Address
- entityType: CloudApplication
  fieldMappings:
  - columnName: CloudAppId
    identifier: AppId
  - columnName: InstanceUrl
    identifier: InstanceName
tactics:
- Discovery
- Exfiltration
query: |
  let honeypot_dataverse_instances = dynamic(["https://myinstance.crm.dynamics.com/"]);
  let honeypot_authorized_users = dynamic(["scanner@mydomain.com"]);
  let monitored_dataverse_entities = dynamic(["contact", "account", "opportunity", "lead", "competitor"]);
  let query_frequency = 1h;
  DataverseActivity
  | where TimeGenerated >= ago(query_frequency)
  | where InstanceUrl in (honeypot_dataverse_instances)
  | where UserId !in (honeypot_authorized_users)
  | where UserId !endswith "@onmicrosoft.com"
      and UserId != "Unknown"
      and isnotempty(ClientIp)
  | where Message in ("UserSignIn") or EntityName in (monitored_dataverse_entities)
  | summarize
      TimeStart = min(TimeGenerated),
      TimeEnd = max(TimeGenerated),
      Entities = make_set(EntityName, 10),
      Messages = make_set(Message, 10)
      by UserId, ClientIp, InstanceUrl
  | extend Severity = iif(array_length(set_difference(Messages, dynamic(["UserSignIn"]))) > 0, "Medium", "Low")
  | extend CloudAppId = int(32780)
  | extend AccountName = tostring(split(UserId, '@')[0])
  | extend UPNSuffix = tostring(split(UserId, '@')[1])
  | project
      TimeStart,
      TimeEnd,
      UserId,
      ClientIp,
      InstanceUrl,
      Messages,
      Entities,
      Severity,
      CloudAppId,
      AccountName,
      UPNSuffix  
kind: Scheduled
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Honeypot instance activity.yaml
queryFrequency: 1h

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/11650b85-d8cc-49c4-8c04-a8a739635983')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/11650b85-d8cc-49c4-8c04-a8a739635983')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "{{UserId}} from {{ClientIp}} was detected in the Dataverse honeypot instance: {{InstanceUrl}}",
          "alertDisplayNameFormat": "Dataverse - Honeytoken activity detected in {{InstanceUrl}} ",
          "alertSeverityColumnName": "Severity"
        },
        "alertRuleTemplateName": "11650b85-d8cc-49c4-8c04-a8a739635983",
        "customDetails": null,
        "description": "Identifies activities in a predefined Honeypot Dataverse instance. Alerts when either sign-in to the Honeypot is detected or when monitored Dataverse tables in the Honeypot are accessed.\n\nNote: Requires a dedicated Honeypot Dataverse instance in Power Platform with auditing enabled.\n",
        "displayName": "Dataverse - Honeypot instance activity",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountName",
                "identifier": "Name"
              },
              {
                "columnName": "UPNSuffix",
                "identifier": "UPNSuffix"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "ClientIp",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "CloudAppId",
                "identifier": "AppId"
              },
              {
                "columnName": "InstanceUrl",
                "identifier": "InstanceName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Honeypot instance activity.yaml",
        "query": "let honeypot_dataverse_instances = dynamic([\"https://myinstance.crm.dynamics.com/\"]);\nlet honeypot_authorized_users = dynamic([\"scanner@mydomain.com\"]);\nlet monitored_dataverse_entities = dynamic([\"contact\", \"account\", \"opportunity\", \"lead\", \"competitor\"]);\nlet query_frequency = 1h;\nDataverseActivity\n| where TimeGenerated >= ago(query_frequency)\n| where InstanceUrl in (honeypot_dataverse_instances)\n| where UserId !in (honeypot_authorized_users)\n| where UserId !endswith \"@onmicrosoft.com\"\n    and UserId != \"Unknown\"\n    and isnotempty(ClientIp)\n| where Message in (\"UserSignIn\") or EntityName in (monitored_dataverse_entities)\n| summarize\n    TimeStart = min(TimeGenerated),\n    TimeEnd = max(TimeGenerated),\n    Entities = make_set(EntityName, 10),\n    Messages = make_set(Message, 10)\n    by UserId, ClientIp, InstanceUrl\n| extend Severity = iif(array_length(set_difference(Messages, dynamic([\"UserSignIn\"]))) > 0, \"Medium\", \"Low\")\n| extend CloudAppId = int(32780)\n| extend AccountName = tostring(split(UserId, '@')[0])\n| extend UPNSuffix = tostring(split(UserId, '@')[1])\n| project\n    TimeStart,\n    TimeEnd,\n    UserId,\n    ClientIp,\n    InstanceUrl,\n    Messages,\n    Entities,\n    Severity,\n    CloudAppId,\n    AccountName,\n    UPNSuffix\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P1D",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Discovery",
          "Exfiltration"
        ],
        "techniques": [
          "T1526",
          "T1538",
          "T1567"
        ],
        "templateVersion": "3.2.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}