PaloAlto - User privileges was changed

Back


Id	38f9e010-51ca-11ec-bf63-0242ac130002
Rulename	PaloAlto - User privileges was changed
Description	Detects changing of user privileges.
Severity	Medium
Tactics	InitialAccess
Techniques	T1190 T1133
Required data connectors	PaloAltoCDL PaloAltoCDLAma
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPrivilegesWasChanged.yaml
Version	1.0.2
Arm template	38f9e010-51ca-11ec-bf63-0242ac130002.json

KQL

let q_period = 14d;
let dt_lookBack = 24h;
let p = PaloAltoCDLEvent
| where TimeGenerated between (ago(q_period)..ago(dt_lookBack))
| summarize OldPrivileges = make_set(DestinationUserPrivileges) by DstUsername;
PaloAltoCDLEvent
| where TimeGenerated > ago(dt_lookBack)
| summarize NewPrivileges = make_set(DestinationUserPrivileges) by DstUsername
| join kind=innerunique (p) on DstUsername
| where tostring(OldPrivileges) != tostring(NewPrivileges)
| extend AccountCustomEntity = DstUsername

YAML

severity: Medium
triggerThreshold: 0
requiredDataConnectors:
- connectorId: PaloAltoCDL
  dataTypes:
  - PaloAltoCDLEvent
- connectorId: PaloAltoCDLAma
  dataTypes:
  - PaloAltoCDLEvent
kind: Scheduled
id: 38f9e010-51ca-11ec-bf63-0242ac130002
triggerOperator: gt
tactics:
- InitialAccess
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPrivilegesWasChanged.yaml
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
relevantTechniques:
- T1190
- T1133
version: 1.0.2
queryPeriod: 14d
name: PaloAlto - User privileges was changed
status: Available
description: |
    'Detects changing of user privileges.'
query: |
  let q_period = 14d;
  let dt_lookBack = 24h;
  let p = PaloAltoCDLEvent
  | where TimeGenerated between (ago(q_period)..ago(dt_lookBack))
  | summarize OldPrivileges = make_set(DestinationUserPrivileges) by DstUsername;
  PaloAltoCDLEvent
  | where TimeGenerated > ago(dt_lookBack)
  | summarize NewPrivileges = make_set(DestinationUserPrivileges) by DstUsername
  | join kind=innerunique (p) on DstUsername
  | where tostring(OldPrivileges) != tostring(NewPrivileges)
  | extend AccountCustomEntity = DstUsername

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2023-02-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/38f9e010-51ca-11ec-bf63-0242ac130002')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/38f9e010-51ca-11ec-bf63-0242ac130002')]",
      "properties": {
        "alertRuleTemplateName": "38f9e010-51ca-11ec-bf63-0242ac130002",
        "customDetails": null,
        "description": "'Detects changing of user privileges.'\n",
        "displayName": "PaloAlto - User privileges was changed",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "Name"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPrivilegesWasChanged.yaml",
        "query": "let q_period = 14d;\nlet dt_lookBack = 24h;\nlet p = PaloAltoCDLEvent\n| where TimeGenerated between (ago(q_period)..ago(dt_lookBack))\n| summarize OldPrivileges = make_set(DestinationUserPrivileges) by DstUsername;\nPaloAltoCDLEvent\n| where TimeGenerated > ago(dt_lookBack)\n| summarize NewPrivileges = make_set(DestinationUserPrivileges) by DstUsername\n| join kind=innerunique (p) on DstUsername\n| where tostring(OldPrivileges) != tostring(NewPrivileges)\n| extend AccountCustomEntity = DstUsername\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P14D",
        "severity": "Medium",
        "status": "Available",
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1133",
          "T1190"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}