FO - Mass update or deletion of user records

Back


Id	5ab00fbb-ba2c-44dc-b02e-f119639b9a11
Rulename	F&O - Mass update or deletion of user records
Description	Identifies large delete or update operations on Finance & Operations user records based on predefined thresholds.
Severity	Medium
Tactics	Impact
Techniques	T1485 T1565 T1491
Required data connectors	Dynamics365Finance
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/F&O - Mass update or deletion of user records.yaml
Version	3.2.0
Arm template	5ab00fbb-ba2c-44dc-b02e-f119639b9a11.json

KQL

// Set threshold for number of updated or deleted records
let update_detection_threshold = 50;
let deleted_detection_threshold = 10;
FinanceOperationsActivity_CL
| where TableName == "UserInfo" and LogType in ("Update", "Delete")
| summarize
    TotalEvents = count(),
    StartTime = min(LogCreatedDateTime),
    EndTime = max(LogCreatedDateTime)
    by TableName, Username, LogType
| where (LogType == "Update" and TotalEvents > update_detection_threshold) or (LogType == "Delete" and TotalEvents > deleted_detection_threshold)
| extend FinOpsAppId = 32780
| project StartTime, EndTime, Username, LogType, TableName, TotalEvents, FinOpsAppId

YAML

alertDetailsOverride:
  alertDescriptionFormat: '{{TotalEvents}} user records deleted in F&O by user {{Username}}'
  alertDisplayNameFormat: F&O - many user account records deleted
description: Identifies large delete or update operations on Finance & Operations user records based on predefined thresholds.
kind: Scheduled
tactics:
- Impact
requiredDataConnectors:
- connectorId: Dynamics365Finance
  dataTypes:
  - FinanceOperationsActivity_CL
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/F&O - Mass update or deletion of user records.yaml
severity: Medium
name: F&O - Mass update or deletion of user records
triggerThreshold: 0
queryPeriod: 1h
query: |
  // Set threshold for number of updated or deleted records
  let update_detection_threshold = 50;
  let deleted_detection_threshold = 10;
  FinanceOperationsActivity_CL
  | where TableName == "UserInfo" and LogType in ("Update", "Delete")
  | summarize
      TotalEvents = count(),
      StartTime = min(LogCreatedDateTime),
      EndTime = max(LogCreatedDateTime)
      by TableName, Username, LogType
  | where (LogType == "Update" and TotalEvents > update_detection_threshold) or (LogType == "Delete" and TotalEvents > deleted_detection_threshold)
  | extend FinOpsAppId = 32780
  | project StartTime, EndTime, Username, LogType, TableName, TotalEvents, FinOpsAppId  
relevantTechniques:
- T1485
- T1565
- T1491
id: 5ab00fbb-ba2c-44dc-b02e-f119639b9a11
queryFrequency: 1h
status: Available
version: 3.2.0
triggerOperator: gt
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: Username
    identifier: FullName
- entityType: CloudApplication
  fieldMappings:
  - columnName: FinOpsAppId
    identifier: AppId

ARM