let query_frequency = 1h;
let default_attachments = split('ade;adp;app;asa;ashx;asmx;asp;bas;bat;cdx;cer;chm;class;cmd;com;config;cpl;crt;csh;dll;exe;fxp;hlp;hta;htr;htw;ida;idc;idq;inf;ins;isp;its;jar;js;jse;ksh;lnk;mad;maf;mag;mam;maq;mar;mas;mat;mau;mav;maw;mda;mdb;mde;mdt;mdw;mdz;msc;msh;msh1;msh1xml;msh2;msh2xml;mshxml;msi;msp;mst;ops;pcd;pif;prf;prg;printer;pst;reg;rem;scf;scr;sct;shb;shs;shtm;shtml;soap;stm;tmp;url;vb;vbe;vbs;vsmacros;vss;vst;vsw;ws;wsc;wsf;wsh', ";");
DataverseActivity
| where TimeGenerated >= ago(query_frequency)
| where Message == "Update" and EntityName =~ 'organization'
| mv-expand Fields
| where Fields.Name == "blockedattachments"
| extend
UpdatedAttachments = split(tostring(Fields.Value), ";"),
CloudAppId = int(32780),
AccountName = tostring(split(UserId, '@')[0]),
UPNSuffix = tostring(split(UserId, '@')[1])
| extend RemovedAttachments = set_difference(default_attachments, UpdatedAttachments)
| project
TimeGenerated,
UserId,
ClientIp,
InstanceUrl,
RemovedAttachments,
CloudAppId,
AccountName,
UPNSuffix
description: Identifies modifications to an environment's blocked file extensions and extracts the removed extension.
entityMappings:
- fieldMappings:
- columnName: AccountName
identifier: Name
- columnName: UPNSuffix
identifier: UPNSuffix
entityType: Account
- fieldMappings:
- columnName: ClientIp
identifier: Address
entityType: IP
- fieldMappings:
- columnName: CloudAppId
identifier: AppId
- columnName: InstanceUrl
identifier: InstanceName
entityType: CloudApplication
kind: Scheduled
tactics:
- DefenseEvasion
severity: Medium
triggerThreshold: 0
queryFrequency: 1h
status: Available
queryPeriod: 1d
relevantTechniques:
- T1629
version: 3.2.0
id: 1b1061be-2595-4492-af6d-1c8a5fc9576d
name: Dataverse - Removal of blocked file extensions
query: |
let query_frequency = 1h;
let default_attachments = split('ade;adp;app;asa;ashx;asmx;asp;bas;bat;cdx;cer;chm;class;cmd;com;config;cpl;crt;csh;dll;exe;fxp;hlp;hta;htr;htw;ida;idc;idq;inf;ins;isp;its;jar;js;jse;ksh;lnk;mad;maf;mag;mam;maq;mar;mas;mat;mau;mav;maw;mda;mdb;mde;mdt;mdw;mdz;msc;msh;msh1;msh1xml;msh2;msh2xml;mshxml;msi;msp;mst;ops;pcd;pif;prf;prg;printer;pst;reg;rem;scf;scr;sct;shb;shs;shtm;shtml;soap;stm;tmp;url;vb;vbe;vbs;vsmacros;vss;vst;vsw;ws;wsc;wsf;wsh', ";");
DataverseActivity
| where TimeGenerated >= ago(query_frequency)
| where Message == "Update" and EntityName =~ 'organization'
| mv-expand Fields
| where Fields.Name == "blockedattachments"
| extend
UpdatedAttachments = split(tostring(Fields.Value), ";"),
CloudAppId = int(32780),
AccountName = tostring(split(UserId, '@')[0]),
UPNSuffix = tostring(split(UserId, '@')[1])
| extend RemovedAttachments = set_difference(default_attachments, UpdatedAttachments)
| project
TimeGenerated,
UserId,
ClientIp,
InstanceUrl,
RemovedAttachments,
CloudAppId,
AccountName,
UPNSuffix
triggerOperator: gt
eventGroupingSettings:
aggregationKind: AlertPerResult
alertDetailsOverride:
alertDescriptionFormat: '{{UserId}} modified environment blocked extensions list. {{UserId}} removed the following extensions {{RemovedAttachments}}.'
alertDisplayNameFormat: 'Dataverse - Blocked file extension removed in {{InstanceUrl}} '
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Removal of blocked file extensions.yaml
requiredDataConnectors:
- dataTypes:
- DataverseActivity
connectorId: Dataverse
