FO - Non-interactive account mapped to self or sensitive privileged user

Back


Id	5b7cc7f9-fe54-4138-9fb0-d650807345d3
Rulename	F&O - Non-interactive account mapped to self or sensitive privileged user
Description	Identifies changes to Microsoft Entra client apps registered for Finance & Operations, specifically when a new client is mapped to a predefined list of sensitive privileged user accounts, or when a user associates a client app with their own account.
Severity	Medium
Tactics	CredentialAccess Persistence PrivilegeEscalation
Techniques	T1556 T1098 T1136 T1078 T0859
Required data connectors	Dynamics365Finance
Kind	Scheduled
Query frequency	15m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/F&O - Non-interactive account mapped to self or sensitive privileged user.yaml
Version	3.2.0
Arm template	5b7cc7f9-fe54-4138-9fb0-d650807345d3.json

KQL

// Add sensitive privilege accounts to the privileged_user_accounts variable.
// Example: let privileged_user_accounts = dynamic(["Admin1", "Admin"]);
let privileged_user_accounts = dynamic([]);
FinanceOperationsActivity_CL
| where TableName == "SysAADClientTable" and LogType in ("Insert", "Update")
| extend ClientId = tostring(parse_json(tostring(FormattedData.["03::AADClientId"])).NewData)
| extend User = parse_json(tostring(FormattedData.UserId))
| extend
    MappedUser = tostring(User.NewData),
    PreviousUserId = tostring(User.OldData),
    TargetAppName = tostring(parse_json(tostring(FormattedData.Name)).NewData),
    FinOpsAppId = 32780
| where MappedUser in (privileged_user_accounts) or LogCreatedBy == MappedUser
| project
    LogCreatedDateTime,
    LogCreatedBy,
    LogType,
    TargetAppName,
    MappedUser,
    PreviousUserId,
    ClientId,
    FinOpsAppId

YAML

relevantTechniques:
- T1556
- T1098
- T1136
- T1078
- T0859
name: F&O - Non-interactive account mapped to self or sensitive privileged user
queryPeriod: 15m
triggerThreshold: 0
alertDetailsOverride:
  alertDescriptionFormat: User account {{LogCreatedBy}} mapped an Azure AD App to senstitive privileged user account {{MappedUser}}. The associated Azure AD client ID is {{ClientId}}
  alertDisplayNameFormat: F&O - Sensitive non-interactive user mapping detected
id: 5b7cc7f9-fe54-4138-9fb0-d650807345d3
eventGroupingSettings:
  aggregationKind: AlertPerResult
severity: Medium
requiredDataConnectors:
- dataTypes:
  - FinanceOperationsActivity_CL
  connectorId: Dynamics365Finance
description: Identifies changes to Microsoft Entra client apps registered for Finance & Operations, specifically when a new client is mapped to a predefined list of sensitive privileged user accounts, or when a user associates a client app with their own account.
version: 3.2.0
status: Available
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: LogCreatedBy
    identifier: FullName
- entityType: Account
  fieldMappings:
  - columnName: ClientId
    identifier: AadUserId
- entityType: CloudApplication
  fieldMappings:
  - columnName: FinOpsAppId
    identifier: AppId
- entityType: Account
  fieldMappings:
  - columnName: MappedUser
    identifier: FullName
tactics:
- CredentialAccess
- Persistence
- PrivilegeEscalation
query: |
  // Add sensitive privilege accounts to the privileged_user_accounts variable.
  // Example: let privileged_user_accounts = dynamic(["Admin1", "Admin"]);
  let privileged_user_accounts = dynamic([]);
  FinanceOperationsActivity_CL
  | where TableName == "SysAADClientTable" and LogType in ("Insert", "Update")
  | extend ClientId = tostring(parse_json(tostring(FormattedData.["03::AADClientId"])).NewData)
  | extend User = parse_json(tostring(FormattedData.UserId))
  | extend
      MappedUser = tostring(User.NewData),
      PreviousUserId = tostring(User.OldData),
      TargetAppName = tostring(parse_json(tostring(FormattedData.Name)).NewData),
      FinOpsAppId = 32780
  | where MappedUser in (privileged_user_accounts) or LogCreatedBy == MappedUser
  | project
      LogCreatedDateTime,
      LogCreatedBy,
      LogType,
      TargetAppName,
      MappedUser,
      PreviousUserId,
      ClientId,
      FinOpsAppId  
kind: Scheduled
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/F&O - Non-interactive account mapped to self or sensitive privileged user.yaml
queryFrequency: 15m

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/5b7cc7f9-fe54-4138-9fb0-d650807345d3')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/5b7cc7f9-fe54-4138-9fb0-d650807345d3')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "User account {{LogCreatedBy}} mapped an Azure AD App to senstitive privileged user account {{MappedUser}}. The associated Azure AD client ID is {{ClientId}}",
          "alertDisplayNameFormat": "F&O - Sensitive non-interactive user mapping detected"
        },
        "alertRuleTemplateName": "5b7cc7f9-fe54-4138-9fb0-d650807345d3",
        "customDetails": null,
        "description": "Identifies changes to Microsoft Entra client apps registered for Finance & Operations, specifically when a new client is mapped to a predefined list of sensitive privileged user accounts, or when a user associates a client app with their own account.",
        "displayName": "F&O - Non-interactive account mapped to self or sensitive privileged user",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "LogCreatedBy",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "ClientId",
                "identifier": "AadUserId"
              }
            ]
          },
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "FinOpsAppId",
                "identifier": "AppId"
              }
            ]
          },
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "MappedUser",
                "identifier": "FullName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/F&O - Non-interactive account mapped to self or sensitive privileged user.yaml",
        "query": "// Add sensitive privilege accounts to the privileged_user_accounts variable.\n// Example: let privileged_user_accounts = dynamic([\"Admin1\", \"Admin\"]);\nlet privileged_user_accounts = dynamic([]);\nFinanceOperationsActivity_CL\n| where TableName == \"SysAADClientTable\" and LogType in (\"Insert\", \"Update\")\n| extend ClientId = tostring(parse_json(tostring(FormattedData.[\"03::AADClientId\"])).NewData)\n| extend User = parse_json(tostring(FormattedData.UserId))\n| extend\n    MappedUser = tostring(User.NewData),\n    PreviousUserId = tostring(User.OldData),\n    TargetAppName = tostring(parse_json(tostring(FormattedData.Name)).NewData),\n    FinOpsAppId = 32780\n| where MappedUser in (privileged_user_accounts) or LogCreatedBy == MappedUser\n| project\n    LogCreatedDateTime,\n    LogCreatedBy,\n    LogType,\n    TargetAppName,\n    MappedUser,\n    PreviousUserId,\n    ClientId,\n    FinOpsAppId\n",
        "queryFrequency": "PT15M",
        "queryPeriod": "PT15M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "Persistence",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1078",
          "T1098",
          "T1136",
          "T1556"
        ],
        "templateVersion": "3.2.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}