Pathlock TDnR - Authorization Role Changes | Microsoft Sentinel Analytic Rules

Back


Id	2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c46
Rulename	Pathlock TDnR - Authorization Role Changes
Description	Detects changes to SAP authorization roles (PFCG), forwarded by Pathlock Threat Detection and Response. Unauthorized role modifications are one of the most common SAP privilege escalation vectors and may be used to grant unauthorized access to sensitive transactions or data.
Severity	High
Tactics	PrivilegeEscalation Persistence
Techniques	T1548 T1098
Required data connectors	Pathlock_TDnR
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Pathlock_TDnR/Analytic%20Rules/Pathlock_TDnR_ROLE_CHANGES.yaml
Version	1.0.0
Arm template	2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c46.json

KQL

Pathlock_TDnR_CL
| where DataSource == "ROLE_CHANGES"
| project TimeGenerated, Sysid, DataSource, Eventid, Instance, Hostname, Bname,
          Tcode, Report, Area, Subid, SrcIp, DestIp, AffectedUser, LogLine,
          MsgType, MsgId, MsgNo, MessageV1, MessageV2, MessageV3, MessageV4, CentralTs

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: Bname
    identifier: Name
- entityType: Host
  fieldMappings:
  - columnName: Hostname
    identifier: HostName
- entityType: IP
  fieldMappings:
  - columnName: SrcIp
    identifier: Address
tactics:
- PrivilegeEscalation
- Persistence
status: Available
queryPeriod: 1h
queryFrequency: 1h
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    groupByAlertDetails: []
    matchingMethod: AnyAlert
    reopenClosedIncident: false
    groupByCustomDetails: []
    lookbackDuration: 5h
    groupByEntities: []
requiredDataConnectors:
- connectorId: Pathlock_TDnR
  dataTypes:
  - Pathlock_TDnR_CL
severity: High
relevantTechniques:
- T1548
- T1098
name: Pathlock TDnR - Authorization Role Changes
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Pathlock_TDnR/Analytic%20Rules/Pathlock_TDnR_ROLE_CHANGES.yaml
eventGroupingSettings:
  aggregationKind: SingleAlert
description: Detects changes to SAP authorization roles (PFCG), forwarded by Pathlock Threat Detection and Response. Unauthorized role modifications are one of the most common SAP privilege escalation vectors and may be used to grant unauthorized access to sensitive transactions or data.
triggerOperator: gt
suppressionDuration: 5h
id: 2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c46
version: 1.0.0
triggerThreshold: 0
suppressionEnabled: false
query: |
  Pathlock_TDnR_CL
  | where DataSource == "ROLE_CHANGES"
  | project TimeGenerated, Sysid, DataSource, Eventid, Instance, Hostname, Bname,
            Tcode, Report, Area, Subid, SrcIp, DestIp, AffectedUser, LogLine,
            MsgType, MsgId, MsgNo, MessageV1, MessageV2, MessageV3, MessageV4, CentralTs

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c46')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c46')]",
      "properties": {
        "alertRuleTemplateName": "2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c46",
        "customDetails": null,
        "description": "Detects changes to SAP authorization roles (PFCG), forwarded by Pathlock Threat Detection and Response. Unauthorized role modifications are one of the most common SAP privilege escalation vectors and may be used to grant unauthorized access to sensitive transactions or data.",
        "displayName": "Pathlock TDnR - Authorization Role Changes",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "Bname",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "Hostname",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SrcIp",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByAlertDetails": [],
            "groupByCustomDetails": [],
            "groupByEntities": [],
            "lookbackDuration": "PT5H",
            "matchingMethod": "AnyAlert",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Pathlock_TDnR/Analytic%20Rules/Pathlock_TDnR_ROLE_CHANGES.yaml",
        "query": "Pathlock_TDnR_CL\n| where DataSource == \"ROLE_CHANGES\"\n| project TimeGenerated, Sysid, DataSource, Eventid, Instance, Hostname, Bname,\n          Tcode, Report, Area, Subid, SrcIp, DestIp, AffectedUser, LogLine,\n          MsgType, MsgId, MsgNo, MessageV1, MessageV2, MessageV3, MessageV4, CentralTs\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "Persistence",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1098",
          "T1548"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}