FO - Non-interactive account mapped to self or sensitive privileged user

Back


Id	5b7cc7f9-fe54-4138-9fb0-d650807345d3
Rulename	F&O - Non-interactive account mapped to self or sensitive privileged user
Description	Identifies changes to Microsoft Entra client apps registered for Finance & Operations, specifically when a new client is mapped to a predefined list of sensitive privileged user accounts, or when a user associates a client app with their own account.
Severity	Medium
Tactics	CredentialAccess Persistence PrivilegeEscalation
Techniques	T1556 T1098 T1136 T1078 T0859
Required data connectors	Dynamics365Finance
Kind	Scheduled
Query frequency	15m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/F&O - Non-interactive account mapped to self or sensitive privileged user.yaml
Version	3.2.0
Arm template	5b7cc7f9-fe54-4138-9fb0-d650807345d3.json

KQL

// Add sensitive privilege accounts to the privileged_user_accounts variable.
// Example: let privileged_user_accounts = dynamic(["Admin1", "Admin"]);
let privileged_user_accounts = dynamic([]);
FinanceOperationsActivity_CL
| where TableName == "SysAADClientTable" and LogType in ("Insert", "Update")
| extend ClientId = tostring(parse_json(tostring(FormattedData.["03::AADClientId"])).NewData)
| extend User = parse_json(tostring(FormattedData.UserId))
| extend
    MappedUser = tostring(User.NewData),
    PreviousUserId = tostring(User.OldData),
    TargetAppName = tostring(parse_json(tostring(FormattedData.Name)).NewData),
    FinOpsAppId = 32780
| where MappedUser in (privileged_user_accounts) or LogCreatedBy == MappedUser
| project
    LogCreatedDateTime,
    LogCreatedBy,
    LogType,
    TargetAppName,
    MappedUser,
    PreviousUserId,
    ClientId,
    FinOpsAppId

YAML

relevantTechniques:
- T1556
- T1098
- T1136
- T1078
- T0859
name: F&O - Non-interactive account mapped to self or sensitive privileged user
triggerThreshold: 0
tactics:
- CredentialAccess
- Persistence
- PrivilegeEscalation
alertDetailsOverride:
  alertDisplayNameFormat: F&O - Sensitive non-interactive user mapping detected
  alertDescriptionFormat: User account {{LogCreatedBy}} mapped an Azure AD App to senstitive privileged user account {{MappedUser}}. The associated Azure AD client ID is {{ClientId}}
severity: Medium
id: 5b7cc7f9-fe54-4138-9fb0-d650807345d3
status: Available
requiredDataConnectors:
- dataTypes:
  - FinanceOperationsActivity_CL
  connectorId: Dynamics365Finance
kind: Scheduled
query: |
  // Add sensitive privilege accounts to the privileged_user_accounts variable.
  // Example: let privileged_user_accounts = dynamic(["Admin1", "Admin"]);
  let privileged_user_accounts = dynamic([]);
  FinanceOperationsActivity_CL
  | where TableName == "SysAADClientTable" and LogType in ("Insert", "Update")
  | extend ClientId = tostring(parse_json(tostring(FormattedData.["03::AADClientId"])).NewData)
  | extend User = parse_json(tostring(FormattedData.UserId))
  | extend
      MappedUser = tostring(User.NewData),
      PreviousUserId = tostring(User.OldData),
      TargetAppName = tostring(parse_json(tostring(FormattedData.Name)).NewData),
      FinOpsAppId = 32780
  | where MappedUser in (privileged_user_accounts) or LogCreatedBy == MappedUser
  | project
      LogCreatedDateTime,
      LogCreatedBy,
      LogType,
      TargetAppName,
      MappedUser,
      PreviousUserId,
      ClientId,
      FinOpsAppId  
description: Identifies changes to Microsoft Entra client apps registered for Finance & Operations, specifically when a new client is mapped to a predefined list of sensitive privileged user accounts, or when a user associates a client app with their own account.
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/F&O - Non-interactive account mapped to self or sensitive privileged user.yaml
triggerOperator: gt
queryPeriod: 15m
queryFrequency: 15m
eventGroupingSettings:
  aggregationKind: AlertPerResult
version: 3.2.0
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: LogCreatedBy
    identifier: FullName
- entityType: Account
  fieldMappings:
  - columnName: ClientId
    identifier: AadUserId
- entityType: CloudApplication
  fieldMappings:
  - columnName: FinOpsAppId
    identifier: AppId
- entityType: Account
  fieldMappings:
  - columnName: MappedUser
    identifier: FullName

ARM