BTP - User added to sensitive privileged role collection

Back


Id	5acbe4cb-a379-4acc-9ad3-28dc48ad33d3
Rulename	BTP - User added to sensitive privileged role collection
Description	Identifies identity management actions whereby a user is added to a set of monitored privileged role collections.
Severity	Low
Tactics	LateralMovement PrivilegeEscalation
Techniques	T0859 T1078
Required data connectors	SAPBTPAuditEvents
Kind	Scheduled
Query frequency	15m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP BTP/Analytic Rules/BTP - User added to sensitive privileged role collection.yaml
Version	3.0.5
Arm template	5acbe4cb-a379-4acc-9ad3-28dc48ad33d3.json

KQL

let monitored_rolecollections = dynamic(["Subaccount Service Administrator", "Subaccount Administrator", "Connectivity and Destination Administrator", "Destination Administrator", "Cloud Connector Administrator"]);
SAPBTPAuditLog_CL
| where Message.object has "xs_rolecollection2user"
| extend ObjectId = parse_json((Message.object).id)
| where ObjectId.crudType == "CREATE"
| extend RoleCollection = ObjectId.rolecollection_name, TargetUserId = ObjectId.user_id
| where RoleCollection in (monitored_rolecollections)
| project UpdatedOn, UserName, RoleCollection, TargetUserId, Tenant, SpaceId, CloudApp = "SAP BTP"
| extend AccountName = split(UserName, "@")[0], UPNSuffix = split(UserName, "@")[1]

YAML

name: BTP - User added to sensitive privileged role collection
id: 5acbe4cb-a379-4acc-9ad3-28dc48ad33d3
description: Identifies identity management actions whereby a user is added to a set of monitored privileged role collections.
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - columnName: AccountName
    identifier: Name
  - columnName: UPNSuffix
    identifier: UPNSuffix
  entityType: Account
- fieldMappings:
  - columnName: CloudApp
    identifier: Name
  entityType: CloudApplication
version: 3.0.5
triggerOperator: gt
query: |
  let monitored_rolecollections = dynamic(["Subaccount Service Administrator", "Subaccount Administrator", "Connectivity and Destination Administrator", "Destination Administrator", "Cloud Connector Administrator"]);
  SAPBTPAuditLog_CL
  | where Message.object has "xs_rolecollection2user"
  | extend ObjectId = parse_json((Message.object).id)
  | where ObjectId.crudType == "CREATE"
  | extend RoleCollection = ObjectId.rolecollection_name, TargetUserId = ObjectId.user_id
  | where RoleCollection in (monitored_rolecollections)
  | project UpdatedOn, UserName, RoleCollection, TargetUserId, Tenant, SpaceId, CloudApp = "SAP BTP"
  | extend AccountName = split(UserName, "@")[0], UPNSuffix = split(UserName, "@")[1]  
tactics:
- LateralMovement
- PrivilegeEscalation
kind: Scheduled
queryFrequency: 15m
severity: Low
queryPeriod: 15m
requiredDataConnectors:
- dataTypes:
  - SAPBTPAuditLog_CL
  connectorId: SAPBTPAuditEvents
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP BTP/Analytic Rules/BTP - User added to sensitive privileged role collection.yaml
eventGroupingSettings:
  aggregationKind: SingleAlert
relevantTechniques:
- T0859
- T1078

ARM