VIP Mailbox manipulation

Back


Id	5170c3c4-b8c9-485c-910d-a21d965ee181
Rulename	VIP Mailbox manipulation
Description	Alert if a cmdlet that can be translated to data exfiltration or mailbox access is executed on a VIP Mailbox.
Severity	Medium
Tactics	Exfiltration Persistence Collection
Techniques	T1020 T1098 T1114
Required data connectors	ESI-ExchangeAdminAuditLogEvents
Kind	Scheduled
Query frequency	30m
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Exchange Security - Exchange On-Premises/Analytic Rules/CriticalCmdletsUsageDetection.yaml
Version	1.2.0
Arm template	5170c3c4-b8c9-485c-910d-a21d965ee181.json

KQL

let VIPRestriction = "on";
ExchangeAdminAuditLogs
| where IsVIP or VIPRestriction =~ "off"
| where UserOriented =~ 'Yes' and IsSensitive and ((IsRestrictedCmdLet and IsSenstiveCmdletParameters) or IsRestrictedCmdLet == false)
| extend Level = iif (Status == "Failure", "Medium", "High")

YAML

queryPeriod: 1h
query: |
  let VIPRestriction = "on";
  ExchangeAdminAuditLogs
  | where IsVIP or VIPRestriction =~ "off"
  | where UserOriented =~ 'Yes' and IsSensitive and ((IsRestrictedCmdLet and IsSenstiveCmdletParameters) or IsRestrictedCmdLet == false)
  | extend Level = iif (Status == "Failure", "Medium", "High")  
name: VIP Mailbox manipulation
entityMappings:
- fieldMappings:
  - columnName: TargetObject
    identifier: MailboxPrimaryAddress
  entityType: Mailbox
- fieldMappings:
  - columnName: Computer
    identifier: FullName
  entityType: Host
- fieldMappings:
  - columnName: TargetObject
    identifier: Sid
  - columnName: TargetObject
    identifier: ObjectGuid
  - columnName: TargetObject
    identifier: FullName
  entityType: Account
- fieldMappings:
  - columnName: Caller
    identifier: Name
  entityType: Account
queryFrequency: 30m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Exchange Security - Exchange On-Premises/Analytic Rules/CriticalCmdletsUsageDetection.yaml
alertDetailsOverride:
  alertDisplayNameFormat: '{{CmdletName}} executed on {{TargetObject}}'
  alertDescriptionFormat: Alert from Microsoft Exchange Security as {{CmdletName}} with parameters {{CmdletParameters}} was executed on {{TargetObject}}
  alertSeverityColumnName: Level
requiredDataConnectors:
- connectorId: ESI-ExchangeAdminAuditLogEvents
  dataTypes:
  - Event
description: |
    'Alert if a cmdlet that can be translated to data exfiltration or mailbox access is executed on a VIP Mailbox.'
kind: Scheduled
version: 1.2.0
status: Available
severity: Medium
relevantTechniques:
- T1020
- T1098
- T1114
triggerOperator: gt
triggerThreshold: 0
tactics:
- Exfiltration
- Persistence
- Collection
id: 5170c3c4-b8c9-485c-910d-a21d965ee181

ARM