SlackAudit - Unknown User Agent

Back


Id	3b11f06e-4afd-4ae6-8477-c61136619ac8
Rulename	SlackAudit - Unknown User Agent
Description	This query helps to detect who trying to connect to the Slack Workspace with unknown User Agent.
Severity	Low
Tactics	CommandAndControl
Techniques	T1071
Required data connectors	SlackAuditAPI
Kind	Scheduled
Query frequency	24h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SlackAudit/Analytic Rules/SlackAuditUnknownUA.yaml
Version	1.0.1
Arm template	3b11f06e-4afd-4ae6-8477-c61136619ac8.json

KQL

let lbperiod = 14d;
let known_UAs = SlackAudit
| where TimeGenerated > ago(lbperiod)
| where isnotempty(UserAgentOriginal)
| summarize makeset(UserAgentOriginal);
SlackAudit
| where UserAgentOriginal !in (known_UAs)
| extend AccountCustomEntity = SrcUserName

YAML

query: |
  let lbperiod = 14d;
  let known_UAs = SlackAudit
  | where TimeGenerated > ago(lbperiod)
  | where isnotempty(UserAgentOriginal)
  | summarize makeset(UserAgentOriginal);
  SlackAudit
  | where UserAgentOriginal !in (known_UAs)
  | extend AccountCustomEntity = SrcUserName  
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
triggerThreshold: 0
name: SlackAudit - Unknown User Agent
severity: Low
relevantTechniques:
- T1071
queryPeriod: 14d
tactics:
- CommandAndControl
requiredDataConnectors:
- connectorId: SlackAuditAPI
  dataTypes:
  - SlackAudit_CL
queryFrequency: 24h
version: 1.0.1
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SlackAudit/Analytic Rules/SlackAuditUnknownUA.yaml
id: 3b11f06e-4afd-4ae6-8477-c61136619ac8
kind: Scheduled
description: |
    'This query helps to detect who trying to connect to the Slack Workspace with unknown User Agent.'
status: Available
triggerOperator: gt

ARM