FO - Non-interactive account mapped to self or sensitive privileged user

Back


Id	5b7cc7f9-fe54-4138-9fb0-d650807345d3
Rulename	F&O - Non-interactive account mapped to self or sensitive privileged user
Description	Identifies changes to Microsoft Entra client apps registered for Finance & Operations, specifically when a new client is mapped to a predefined list of sensitive privileged user accounts, or when a user associates a client app with their own account.
Severity	Medium
Tactics	CredentialAccess Persistence PrivilegeEscalation
Techniques	T1556 T1098 T1136 T1078 T0859
Required data connectors	Dynamics365Finance
Kind	Scheduled
Query frequency	15m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/F&O - Non-interactive account mapped to self or sensitive privileged user.yaml
Version	3.2.0
Arm template	5b7cc7f9-fe54-4138-9fb0-d650807345d3.json

KQL

// Add sensitive privilege accounts to the privileged_user_accounts variable.
// Example: let privileged_user_accounts = dynamic(["Admin1", "Admin"]);
let privileged_user_accounts = dynamic([]);
FinanceOperationsActivity_CL
| where TableName == "SysAADClientTable" and LogType in ("Insert", "Update")
| extend ClientId = tostring(parse_json(tostring(FormattedData.["03::AADClientId"])).NewData)
| extend User = parse_json(tostring(FormattedData.UserId))
| extend
    MappedUser = tostring(User.NewData),
    PreviousUserId = tostring(User.OldData),
    TargetAppName = tostring(parse_json(tostring(FormattedData.Name)).NewData),
    FinOpsAppId = 32780
| where MappedUser in (privileged_user_accounts) or LogCreatedBy == MappedUser
| project
    LogCreatedDateTime,
    LogCreatedBy,
    LogType,
    TargetAppName,
    MappedUser,
    PreviousUserId,
    ClientId,
    FinOpsAppId

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: LogCreatedBy
- entityType: Account
  fieldMappings:
  - identifier: AadUserId
    columnName: ClientId
- entityType: CloudApplication
  fieldMappings:
  - identifier: AppId
    columnName: FinOpsAppId
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: MappedUser
queryFrequency: 15m
name: F&O - Non-interactive account mapped to self or sensitive privileged user
alertDetailsOverride:
  alertDisplayNameFormat: F&O - Sensitive non-interactive user mapping detected
  alertDescriptionFormat: User account {{LogCreatedBy}} mapped an Azure AD App to senstitive privileged user account {{MappedUser}}. The associated Azure AD client ID is {{ClientId}}
kind: Scheduled
tactics:
- CredentialAccess
- Persistence
- PrivilegeEscalation
triggerThreshold: 0
query: |
  // Add sensitive privilege accounts to the privileged_user_accounts variable.
  // Example: let privileged_user_accounts = dynamic(["Admin1", "Admin"]);
  let privileged_user_accounts = dynamic([]);
  FinanceOperationsActivity_CL
  | where TableName == "SysAADClientTable" and LogType in ("Insert", "Update")
  | extend ClientId = tostring(parse_json(tostring(FormattedData.["03::AADClientId"])).NewData)
  | extend User = parse_json(tostring(FormattedData.UserId))
  | extend
      MappedUser = tostring(User.NewData),
      PreviousUserId = tostring(User.OldData),
      TargetAppName = tostring(parse_json(tostring(FormattedData.Name)).NewData),
      FinOpsAppId = 32780
  | where MappedUser in (privileged_user_accounts) or LogCreatedBy == MappedUser
  | project
      LogCreatedDateTime,
      LogCreatedBy,
      LogType,
      TargetAppName,
      MappedUser,
      PreviousUserId,
      ClientId,
      FinOpsAppId  
relevantTechniques:
- T1556
- T1098
- T1136
- T1078
- T0859
triggerOperator: gt
queryPeriod: 15m
eventGroupingSettings:
  aggregationKind: AlertPerResult
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/F&O - Non-interactive account mapped to self or sensitive privileged user.yaml
severity: Medium
status: Available
id: 5b7cc7f9-fe54-4138-9fb0-d650807345d3
requiredDataConnectors:
- connectorId: Dynamics365Finance
  dataTypes:
  - FinanceOperationsActivity_CL
version: 3.2.0
description: Identifies changes to Microsoft Entra client apps registered for Finance & Operations, specifically when a new client is mapped to a predefined list of sensitive privileged user accounts, or when a user associates a client app with their own account.

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/5b7cc7f9-fe54-4138-9fb0-d650807345d3')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/5b7cc7f9-fe54-4138-9fb0-d650807345d3')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "User account {{LogCreatedBy}} mapped an Azure AD App to senstitive privileged user account {{MappedUser}}. The associated Azure AD client ID is {{ClientId}}",
          "alertDisplayNameFormat": "F&O - Sensitive non-interactive user mapping detected"
        },
        "alertRuleTemplateName": "5b7cc7f9-fe54-4138-9fb0-d650807345d3",
        "customDetails": null,
        "description": "Identifies changes to Microsoft Entra client apps registered for Finance & Operations, specifically when a new client is mapped to a predefined list of sensitive privileged user accounts, or when a user associates a client app with their own account.",
        "displayName": "F&O - Non-interactive account mapped to self or sensitive privileged user",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "LogCreatedBy",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "ClientId",
                "identifier": "AadUserId"
              }
            ]
          },
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "FinOpsAppId",
                "identifier": "AppId"
              }
            ]
          },
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "MappedUser",
                "identifier": "FullName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/F&O - Non-interactive account mapped to self or sensitive privileged user.yaml",
        "query": "// Add sensitive privilege accounts to the privileged_user_accounts variable.\n// Example: let privileged_user_accounts = dynamic([\"Admin1\", \"Admin\"]);\nlet privileged_user_accounts = dynamic([]);\nFinanceOperationsActivity_CL\n| where TableName == \"SysAADClientTable\" and LogType in (\"Insert\", \"Update\")\n| extend ClientId = tostring(parse_json(tostring(FormattedData.[\"03::AADClientId\"])).NewData)\n| extend User = parse_json(tostring(FormattedData.UserId))\n| extend\n    MappedUser = tostring(User.NewData),\n    PreviousUserId = tostring(User.OldData),\n    TargetAppName = tostring(parse_json(tostring(FormattedData.Name)).NewData),\n    FinOpsAppId = 32780\n| where MappedUser in (privileged_user_accounts) or LogCreatedBy == MappedUser\n| project\n    LogCreatedDateTime,\n    LogCreatedBy,\n    LogType,\n    TargetAppName,\n    MappedUser,\n    PreviousUserId,\n    ClientId,\n    FinOpsAppId\n",
        "queryFrequency": "PT15M",
        "queryPeriod": "PT15M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "Persistence",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1078",
          "T1098",
          "T1136",
          "T1556"
        ],
        "templateVersion": "3.2.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}