Zscaler - Connections by dormant user

Back


Id	66bc77ee-3e45-11ec-9bbc-0242ac130002
Rulename	Zscaler - Connections by dormant user
Description	Detects ZPA connections by dormant user.
Severity	High
Tactics	Persistence
Techniques	T1078
Required data connectors	CustomLogsAma
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Zscaler Private Access (ZPA)/Analytic Rules/ZscalerZPAConnectionsByDormantUser.yaml
Version	1.0.2
Arm template	66bc77ee-3e45-11ec-9bbc-0242ac130002.json

KQL

let dt_lastlogintime = 14d;
let activeUsers =
ZPAEvent 
| where TimeGenerated > ago(dt_lastlogintime)
| where DvcAction == 'open'
| summarize lastLoginTime = max(TimeGenerated) by DstUserName
| summarize makelist(DstUserName);
ZPAEvent
| where DstUserName !in~ (activeUsers)
| summarize EventCount = count() by DstUserName
| project-away EventCount
| extend AccountCustomEntity = DstUserName

YAML

relevantTechniques:
- T1078
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: Name
  entityType: Account
triggerThreshold: 0
description: |
    'Detects ZPA connections by dormant user.'
requiredDataConnectors:
- connectorId: CustomLogsAma
  datatypes:
  - ZPA_CL
triggerOperator: gt
version: 1.0.2
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Zscaler Private Access (ZPA)/Analytic Rules/ZscalerZPAConnectionsByDormantUser.yaml
id: 66bc77ee-3e45-11ec-9bbc-0242ac130002
queryFrequency: 1h
query: |
  let dt_lastlogintime = 14d;
  let activeUsers =
  ZPAEvent 
  | where TimeGenerated > ago(dt_lastlogintime)
  | where DvcAction == 'open'
  | summarize lastLoginTime = max(TimeGenerated) by DstUserName
  | summarize makelist(DstUserName);
  ZPAEvent
  | where DstUserName !in~ (activeUsers)
  | summarize EventCount = count() by DstUserName
  | project-away EventCount
  | extend AccountCustomEntity = DstUserName  
severity: High
status: Available
queryPeriod: 14d
name: Zscaler - Connections by dormant user
tactics:
- Persistence
kind: Scheduled

ARM