Multiple Teams deleted by a single user

Back


Id	173f8699-6af5-484a-8b06-8c47ba89b380
Rulename	Multiple Teams deleted by a single user
Description	This detection flags the occurrences of deleting multiple teams within an hour. This data is a part of Office 365 Connector in Microsoft Sentinel.
Severity	Low
Tactics	Impact
Techniques	T1485 T1489
Required data connectors	Office365
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft 365/Analytic Rules/MultipleTeamsDeletes.yaml
Version	2.0.4
Arm template	173f8699-6af5-484a-8b06-8c47ba89b380.json

KQL

// Adjust this value to change how many Teams should be deleted before including
let max_delete_count = 3;
// Adjust this value to change the timewindow the query runs over
  OfficeActivity
| where OfficeWorkload =~ "MicrosoftTeams"
| where Operation =~ "TeamDeleted"
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DeletedTeams = make_set(TeamName, 1000) by UserId
| where array_length(DeletedTeams) > max_delete_count
| extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])

YAML

queryPeriod: 1d
severity: Low
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft 365/Analytic Rules/MultipleTeamsDeletes.yaml
status: Available
description: |
  'This detection flags the occurrences of deleting multiple teams within an hour.
  This data is a part of Office 365 Connector in Microsoft Sentinel.'  
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: UserId
  - identifier: Name
    columnName: AccountName
  - identifier: UPNSuffix
    columnName: AccountUPNSuffix
  entityType: Account
requiredDataConnectors:
- dataTypes:
  - OfficeActivity (Teams)
  connectorId: Office365
name: Multiple Teams deleted by a single user
triggerThreshold: 0
query: |
  // Adjust this value to change how many Teams should be deleted before including
  let max_delete_count = 3;
  // Adjust this value to change the timewindow the query runs over
    OfficeActivity
  | where OfficeWorkload =~ "MicrosoftTeams"
  | where Operation =~ "TeamDeleted"
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DeletedTeams = make_set(TeamName, 1000) by UserId
  | where array_length(DeletedTeams) > max_delete_count
  | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])  
relevantTechniques:
- T1485
- T1489
triggerOperator: gt
tactics:
- Impact
id: 173f8699-6af5-484a-8b06-8c47ba89b380
version: 2.0.4
kind: Scheduled
queryFrequency: 1d

ARM