VIP Mailbox manipulation

Back


Id	5170c3c4-b8c9-485c-910d-a21d965ee181
Rulename	VIP Mailbox manipulation
Description	Alert if a cmdlet that can be translated to data exfiltration or mailbox access is executed on a VIP Mailbox.
Severity	Medium
Tactics	Exfiltration Persistence Collection
Techniques	T1020 T1098 T1114
Required data connectors	ESI-ExchangeAdminAuditLogEvents
Kind	Scheduled
Query frequency	30m
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Exchange Security - Exchange On-Premises/Analytic Rules/CriticalCmdletsUsageDetection.yaml
Version	1.2.0
Arm template	5170c3c4-b8c9-485c-910d-a21d965ee181.json

KQL

let VIPRestriction = "on";
ExchangeAdminAuditLogs
| where IsVIP or VIPRestriction =~ "off"
| where UserOriented =~ 'Yes' and IsSensitive and ((IsRestrictedCmdLet and IsSenstiveCmdletParameters) or IsRestrictedCmdLet == false)
| extend Level = iif (Status == "Failure", "Medium", "High")

YAML

triggerOperator: gt
queryFrequency: 30m
requiredDataConnectors:
- connectorId: ESI-ExchangeAdminAuditLogEvents
  dataTypes:
  - Event
relevantTechniques:
- T1020
- T1098
- T1114
entityMappings:
- entityType: Mailbox
  fieldMappings:
  - identifier: MailboxPrimaryAddress
    columnName: TargetObject
- entityType: Host
  fieldMappings:
  - identifier: FullName
    columnName: Computer
- entityType: Account
  fieldMappings:
  - identifier: Sid
    columnName: TargetObject
  - identifier: ObjectGuid
    columnName: TargetObject
  - identifier: FullName
    columnName: TargetObject
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: Caller
query: |
  let VIPRestriction = "on";
  ExchangeAdminAuditLogs
  | where IsVIP or VIPRestriction =~ "off"
  | where UserOriented =~ 'Yes' and IsSensitive and ((IsRestrictedCmdLet and IsSenstiveCmdletParameters) or IsRestrictedCmdLet == false)
  | extend Level = iif (Status == "Failure", "Medium", "High")  
triggerThreshold: 0
alertDetailsOverride:
  alertDisplayNameFormat: '{{CmdletName}} executed on {{TargetObject}}'
  alertSeverityColumnName: Level
  alertDescriptionFormat: Alert from Microsoft Exchange Security as {{CmdletName}} with parameters {{CmdletParameters}} was executed on {{TargetObject}}
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Exchange Security - Exchange On-Premises/Analytic Rules/CriticalCmdletsUsageDetection.yaml
queryPeriod: 1h
name: VIP Mailbox manipulation
status: Available
kind: Scheduled
description: |
    'Alert if a cmdlet that can be translated to data exfiltration or mailbox access is executed on a VIP Mailbox.'
id: 5170c3c4-b8c9-485c-910d-a21d965ee181
version: 1.2.0
tactics:
- Exfiltration
- Persistence
- Collection
severity: Medium

ARM