CyberArk - High-Risk Actions Outside Business Hours

let risky = dynamic(["Delete","Remove","Rotate","Elevate","Disable","Grant","Policy","Safe","Vault","Key"]);
CyberArk_AuditEvents_CL
| where isnotempty(action) or isnotempty(actionType) or isnotempty(auditType) or isnotempty(message)
| where hourofday(TimeGenerated) < 7 or hourofday(TimeGenerated) > 20
| where action has_any (risky) or actionType has_any (risky) or auditType has_any (risky) or message has_any (risky)
| extend cd = parse_json(customData)
| extend cd_username = tostring(cd.username),
         cd_auth_method = tostring(cd.authentication_method),
         cd_client_ip = tostring(cd.client_ip_address),
         cd_source_ip = tostring(cd.source_ip_address),
         cd_device_os = tostring(cd.device_os),
         cd_browser = tostring(cd.browser_name),
         cd_geo_city = tostring(cd.geoip_city_name),
         cd_geo_country = tostring(cd.geoip_country_name),
         cd_target = coalesce(tostring(cd.target), tostring(cd.target_resource), tostring(cd.new_target))
| project TimeGenerated, CyberArkTenantId, username, cd_username, identityType, action, actionType, auditType,
          target, targetAccount, safe, source, cd_source_ip, cd_client_ip, cd_auth_method, cd_device_os,
          cd_browser, cd_geo_city, cd_geo_country, cd_target, component, serviceName, message

version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CyberArkAudit/Analytics%20Rules/CyberArkAuditHighRiskActions.yaml
triggerThreshold: 0
tactics:
- DefenseEvasion
kind: Scheduled
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: username
  entityType: Account
- fieldMappings:
  - identifier: HostName
    columnName: target
  entityType: Host
- fieldMappings:
  - identifier: Address
    columnName: source
  entityType: IP
description: |
  Detects privileged or destructive actions (delete/disable/rotate/elevate/etc.) occurring outside standard business hours. Useful for insider misuse or compromised admin detection.
triggerOperator: GreaterThan
suppressionEnabled: false
queryFrequency: 10M
id: 3733e1ac-991b-4504-99e8-24ff4fbaf6e4
name: CyberArk - High-Risk Actions Outside Business Hours
severity: High
query: |
  let risky = dynamic(["Delete","Remove","Rotate","Elevate","Disable","Grant","Policy","Safe","Vault","Key"]);
  CyberArk_AuditEvents_CL
  | where isnotempty(action) or isnotempty(actionType) or isnotempty(auditType) or isnotempty(message)
  | where hourofday(TimeGenerated) < 7 or hourofday(TimeGenerated) > 20
  | where action has_any (risky) or actionType has_any (risky) or auditType has_any (risky) or message has_any (risky)
  | extend cd = parse_json(customData)
  | extend cd_username = tostring(cd.username),
           cd_auth_method = tostring(cd.authentication_method),
           cd_client_ip = tostring(cd.client_ip_address),
           cd_source_ip = tostring(cd.source_ip_address),
           cd_device_os = tostring(cd.device_os),
           cd_browser = tostring(cd.browser_name),
           cd_geo_city = tostring(cd.geoip_city_name),
           cd_geo_country = tostring(cd.geoip_country_name),
           cd_target = coalesce(tostring(cd.target), tostring(cd.target_resource), tostring(cd.new_target))
  | project TimeGenerated, CyberArkTenantId, username, cd_username, identityType, action, actionType, auditType,
            target, targetAccount, safe, source, cd_source_ip, cd_client_ip, cd_auth_method, cd_device_os,
            cd_browser, cd_geo_city, cd_geo_country, cd_target, component, serviceName, message
queryPeriod: 1D

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/3733e1ac-991b-4504-99e8-24ff4fbaf6e4')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/3733e1ac-991b-4504-99e8-24ff4fbaf6e4')]",
      "properties": {
        "alertRuleTemplateName": "3733e1ac-991b-4504-99e8-24ff4fbaf6e4",
        "customDetails": null,
        "description": "Detects privileged or destructive actions (delete/disable/rotate/elevate/etc.) occurring outside standard business hours. Useful for insider misuse or compromised admin detection.\n",
        "displayName": "CyberArk - High-Risk Actions Outside Business Hours",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "username",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "target",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "source",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CyberArkAudit/Analytics%20Rules/CyberArkAuditHighRiskActions.yaml",
        "query": "let risky = dynamic([\"Delete\",\"Remove\",\"Rotate\",\"Elevate\",\"Disable\",\"Grant\",\"Policy\",\"Safe\",\"Vault\",\"Key\"]);\nCyberArk_AuditEvents_CL\n| where isnotempty(action) or isnotempty(actionType) or isnotempty(auditType) or isnotempty(message)\n| where hourofday(TimeGenerated) < 7 or hourofday(TimeGenerated) > 20\n| where action has_any (risky) or actionType has_any (risky) or auditType has_any (risky) or message has_any (risky)\n| extend cd = parse_json(customData)\n| extend cd_username = tostring(cd.username),\n         cd_auth_method = tostring(cd.authentication_method),\n         cd_client_ip = tostring(cd.client_ip_address),\n         cd_source_ip = tostring(cd.source_ip_address),\n         cd_device_os = tostring(cd.device_os),\n         cd_browser = tostring(cd.browser_name),\n         cd_geo_city = tostring(cd.geoip_city_name),\n         cd_geo_country = tostring(cd.geoip_country_name),\n         cd_target = coalesce(tostring(cd.target), tostring(cd.target_resource), tostring(cd.new_target))\n| project TimeGenerated, CyberArkTenantId, username, cd_username, identityType, action, actionType, auditType,\n          target, targetAccount, safe, source, cd_source_ip, cd_client_ip, cd_auth_method, cd_device_os,\n          cd_browser, cd_geo_city, cd_geo_country, cd_target, component, serviceName, message\n",
        "queryFrequency": "PT10M",
        "queryPeriod": "P1D",
        "severity": "High",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}