Dataverse - Hierarchy security manipulation
| Id | 2df0adf5-92a8-4ee0-a123-3eb5be1eed02 |
| Rulename | Dataverse - Hierarchy security manipulation |
| Description | Identifies suspicious behaviors in hierarchy security including: - Hierarchy security disabled. - User assigns themselves as a manager. - User assigns themselves to a monitored position. |
| Severity | Medium |
| Tactics | PrivilegeEscalation |
| Techniques | T1548 T1078 |
| Required data connectors | Dataverse |
| Kind | Scheduled |
| Query frequency | 1h |
| Query period | 1d |
| Trigger threshold | 0 |
| Trigger operator | gt |
| Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Hierarchy security manipulation.yaml |
| Version | 3.2.0 |
| Arm template | 2df0adf5-92a8-4ee0-a123-3eb5be1eed02.json |
let monitored_position_ids = dynamic([
// Enter a list of monitored position ID (guids)
//"79380ac5-da2a-ed11-9db1-000d3a58d546"
]);
let query_frequency = 1h;
let security_disabled_events = DataverseActivity
| where TimeGenerated >= ago(query_frequency)
| where Message == "Update" and EntityName == "organization"
| mv-expand Fields
| where Fields.Name == "ishierarchicalsecuritymodelenabled"
| where Fields.Value == "False"
| extend Message = "Hierarchy security has been disabled"
| project TimeGenerated, UserId, ClientIp, InstanceUrl, Message;
let assign_self_as_manager_events = DataverseActivity
| where TimeGenerated >= ago(query_frequency)
| where Message == "Update" and EntityName == "systemuser"
| mv-expand Fields
| where Fields.Name == "parentsystemuserid"
| extend ModifiedManager = tostring(Fields.Value)
| where SystemUserId == ModifiedManager
| extend Message = "User added self as manager of another user";
let assign_self_to_position_events = DataverseActivity
| where TimeGenerated >= ago(query_frequency)
| where Message == "Update" and EntityName == "systemuser"
| mv-expand Position = Fields
| where Position.Name == "positionid" and tostring(Position.Value) in (monitored_position_ids)
| mv-expand Target = Fields
| where Target.Name == "systemuserid"
| extend UserAssigned = tostring(Target.Value)
| where SystemUserId == UserAssigned
| extend
Message = "User assigned self to a monitored position",
PositionId = tostring(Position.Value);
union
security_disabled_events,
assign_self_as_manager_events,
assign_self_to_position_events
| extend
CloudAppId = int(32780),
AccountName = tostring(split(UserId, '@')[0]),
UPNSuffix = tostring(split(UserId, '@')[1])
| project
TimeGenerated,
UserId,
ClientIp,
InstanceUrl,
Message,
PositionId,
CloudAppId,
AccountName,
UPNSuffix
relevantTechniques:
- T1548
- T1078
name: Dataverse - Hierarchy security manipulation
queryPeriod: 1d
triggerThreshold: 0
alertDetailsOverride:
alertDescriptionFormat: '{{Message}}. Events detected for user {{UserId}}.'
alertDisplayNameFormat: 'Dataverse - Suspicious hierarchy security modifications in {{InstanceUrl}} '
id: 2df0adf5-92a8-4ee0-a123-3eb5be1eed02
eventGroupingSettings:
aggregationKind: AlertPerResult
severity: Medium
requiredDataConnectors:
- dataTypes:
- DataverseActivity
connectorId: Dataverse
description: |
Identifies suspicious behaviors in hierarchy security including:
- Hierarchy security disabled.
- User assigns themselves as a manager.
- User assigns themselves to a monitored position.
version: 3.2.0
status: Available
entityMappings:
- entityType: Account
fieldMappings:
- columnName: AccountName
identifier: Name
- columnName: UPNSuffix
identifier: UPNSuffix
- entityType: IP
fieldMappings:
- columnName: ClientIp
identifier: Address
- entityType: CloudApplication
fieldMappings:
- columnName: CloudAppId
identifier: AppId
- columnName: InstanceUrl
identifier: InstanceName
tactics:
- PrivilegeEscalation
query: |
let monitored_position_ids = dynamic([
// Enter a list of monitored position ID (guids)
//"79380ac5-da2a-ed11-9db1-000d3a58d546"
]);
let query_frequency = 1h;
let security_disabled_events = DataverseActivity
| where TimeGenerated >= ago(query_frequency)
| where Message == "Update" and EntityName == "organization"
| mv-expand Fields
| where Fields.Name == "ishierarchicalsecuritymodelenabled"
| where Fields.Value == "False"
| extend Message = "Hierarchy security has been disabled"
| project TimeGenerated, UserId, ClientIp, InstanceUrl, Message;
let assign_self_as_manager_events = DataverseActivity
| where TimeGenerated >= ago(query_frequency)
| where Message == "Update" and EntityName == "systemuser"
| mv-expand Fields
| where Fields.Name == "parentsystemuserid"
| extend ModifiedManager = tostring(Fields.Value)
| where SystemUserId == ModifiedManager
| extend Message = "User added self as manager of another user";
let assign_self_to_position_events = DataverseActivity
| where TimeGenerated >= ago(query_frequency)
| where Message == "Update" and EntityName == "systemuser"
| mv-expand Position = Fields
| where Position.Name == "positionid" and tostring(Position.Value) in (monitored_position_ids)
| mv-expand Target = Fields
| where Target.Name == "systemuserid"
| extend UserAssigned = tostring(Target.Value)
| where SystemUserId == UserAssigned
| extend
Message = "User assigned self to a monitored position",
PositionId = tostring(Position.Value);
union
security_disabled_events,
assign_self_as_manager_events,
assign_self_to_position_events
| extend
CloudAppId = int(32780),
AccountName = tostring(split(UserId, '@')[0]),
UPNSuffix = tostring(split(UserId, '@')[1])
| project
TimeGenerated,
UserId,
ClientIp,
InstanceUrl,
Message,
PositionId,
CloudAppId,
AccountName,
UPNSuffix
kind: Scheduled
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Hierarchy security manipulation.yaml
queryFrequency: 1h
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/2df0adf5-92a8-4ee0-a123-3eb5be1eed02')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/2df0adf5-92a8-4ee0-a123-3eb5be1eed02')]",
"properties": {
"alertDetailsOverride": {
"alertDescriptionFormat": "{{Message}}. Events detected for user {{UserId}}.",
"alertDisplayNameFormat": "Dataverse - Suspicious hierarchy security modifications in {{InstanceUrl}} "
},
"alertRuleTemplateName": "2df0adf5-92a8-4ee0-a123-3eb5be1eed02",
"customDetails": null,
"description": "Identifies suspicious behaviors in hierarchy security including:\n- Hierarchy security disabled.\n- User assigns themselves as a manager.\n- User assigns themselves to a monitored position.\n",
"displayName": "Dataverse - Hierarchy security manipulation",
"enabled": true,
"entityMappings": [
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "AccountName",
"identifier": "Name"
},
{
"columnName": "UPNSuffix",
"identifier": "UPNSuffix"
}
]
},
{
"entityType": "IP",
"fieldMappings": [
{
"columnName": "ClientIp",
"identifier": "Address"
}
]
},
{
"entityType": "CloudApplication",
"fieldMappings": [
{
"columnName": "CloudAppId",
"identifier": "AppId"
},
{
"columnName": "InstanceUrl",
"identifier": "InstanceName"
}
]
}
],
"eventGroupingSettings": {
"aggregationKind": "AlertPerResult"
},
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Hierarchy security manipulation.yaml",
"query": "let monitored_position_ids = dynamic([\n // Enter a list of monitored position ID (guids)\n //\"79380ac5-da2a-ed11-9db1-000d3a58d546\"\n ]);\nlet query_frequency = 1h;\nlet security_disabled_events = DataverseActivity\n | where TimeGenerated >= ago(query_frequency)\n | where Message == \"Update\" and EntityName == \"organization\"\n | mv-expand Fields\n | where Fields.Name == \"ishierarchicalsecuritymodelenabled\"\n | where Fields.Value == \"False\"\n | extend Message = \"Hierarchy security has been disabled\"\n | project TimeGenerated, UserId, ClientIp, InstanceUrl, Message;\nlet assign_self_as_manager_events = DataverseActivity\n | where TimeGenerated >= ago(query_frequency)\n | where Message == \"Update\" and EntityName == \"systemuser\"\n | mv-expand Fields\n | where Fields.Name == \"parentsystemuserid\"\n | extend ModifiedManager = tostring(Fields.Value)\n | where SystemUserId == ModifiedManager\n | extend Message = \"User added self as manager of another user\";\nlet assign_self_to_position_events = DataverseActivity\n | where TimeGenerated >= ago(query_frequency)\n | where Message == \"Update\" and EntityName == \"systemuser\"\n | mv-expand Position = Fields\n | where Position.Name == \"positionid\" and tostring(Position.Value) in (monitored_position_ids)\n | mv-expand Target = Fields\n | where Target.Name == \"systemuserid\"\n | extend UserAssigned = tostring(Target.Value)\n | where SystemUserId == UserAssigned\n | extend\n Message = \"User assigned self to a monitored position\",\n PositionId = tostring(Position.Value);\nunion\n security_disabled_events,\n assign_self_as_manager_events,\n assign_self_to_position_events\n| extend\n CloudAppId = int(32780),\n AccountName = tostring(split(UserId, '@')[0]),\n UPNSuffix = tostring(split(UserId, '@')[1])\n| project\n TimeGenerated,\n UserId,\n ClientIp,\n InstanceUrl,\n Message,\n PositionId,\n CloudAppId,\n AccountName,\n UPNSuffix\n",
"queryFrequency": "PT1H",
"queryPeriod": "P1D",
"severity": "Medium",
"status": "Available",
"subTechniques": [],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"PrivilegeEscalation"
],
"techniques": [
"T1078",
"T1548"
],
"templateVersion": "3.2.0",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}