Zscaler - ZPA connections by new user

Back


Id	236a7ec1-0120-40f2-a157-c1a72dde8bcb
Rulename	Zscaler - ZPA connections by new user
Description	Detects ZPA connections by new user.
Severity	Medium
Tactics	Persistence
Techniques	T1078
Required data connectors	CustomLogsAma
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Zscaler Private Access (ZPA)/Analytic Rules/ZscalerZPAConnectionsByNewUser.yaml
Version	1.0.2
Arm template	236a7ec1-0120-40f2-a157-c1a72dde8bcb.json

KQL

let listUsers =
ZPAEvent 
| where TimeGenerated > ago(14d)
| where DvcAction == 'open'
| summarize ListofUsers = make_set(DstUserName) by DstUserName
| project ListofUsers;
ZPAEvent
| where DstUserName !in (listUsers)
| summarize EventCount = count() by DstUserName
| project-away EventCount
| extend AccountCustomEntity = DstUserName

YAML

version: 1.0.2
severity: Medium
relevantTechniques:
- T1078
triggerOperator: gt
requiredDataConnectors:
- datatypes:
  - ZPA_CL
  connectorId: CustomLogsAma
queryFrequency: 1h
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: Name
  entityType: Account
id: 236a7ec1-0120-40f2-a157-c1a72dde8bcb
status: Available
description: |
    'Detects ZPA connections by new user.'
name: Zscaler - ZPA connections by new user
query: |
  let listUsers =
  ZPAEvent 
  | where TimeGenerated > ago(14d)
  | where DvcAction == 'open'
  | summarize ListofUsers = make_set(DstUserName) by DstUserName
  | project ListofUsers;
  ZPAEvent
  | where DstUserName !in (listUsers)
  | summarize EventCount = count() by DstUserName
  | project-away EventCount
  | extend AccountCustomEntity = DstUserName  
queryPeriod: 14d
tactics:
- Persistence
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Zscaler Private Access (ZPA)/Analytic Rules/ZscalerZPAConnectionsByNewUser.yaml

ARM