Bitglass - User Agent string has changed for user

Back


Id	4dd61530-859f-49e7-bd27-a173cb1a4589
Rulename	Bitglass - User Agent string has changed for user
Description	Detects when User Agent string has changed for user.
Severity	Medium
Tactics	InitialAccess
Techniques	T1078
Required data connectors	Bitglass
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Bitglass/Analytic Rules/BitglassUserUAChanged.yaml
Version	1.0.0
Arm template	4dd61530-859f-49e7-bd27-a173cb1a4589.json

KQL

Bitglass
| where EventType =~ 'access'
| where EventMessage =~ 'Login'
| summarize ua = makeset(HttpUserAgent) by User
| join (Bitglass
        | where EventType =~ 'access'
        | where EventMessage =~ 'Login') on User
| where ua !contains HttpUserAgent
| extend AccountCustomEntity = User

YAML

name: Bitglass - User Agent string has changed for user
query: |
  Bitglass
  | where EventType =~ 'access'
  | where EventMessage =~ 'Login'
  | summarize ua = makeset(HttpUserAgent) by User
  | join (Bitglass
          | where EventType =~ 'access'
          | where EventMessage =~ 'Login') on User
  | where ua !contains HttpUserAgent
  | extend AccountCustomEntity = User  
queryFrequency: 1h
triggerOperator: gt
requiredDataConnectors:
- dataTypes:
  - Bitglass
  connectorId: Bitglass
status: Available
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Bitglass/Analytic Rules/BitglassUserUAChanged.yaml
description: |
    'Detects when User Agent string has changed for user.'
version: 1.0.0
id: 4dd61530-859f-49e7-bd27-a173cb1a4589
kind: Scheduled
relevantTechniques:
- T1078
severity: Medium
tactics:
- InitialAccess
queryPeriod: 14d

ARM