Zscaler - Unexpected update operation

Back


Id	672e2846-4226-11ec-81d3-0242ac130003
Rulename	Zscaler - Unexpected update operation
Description	Detects unexpected version of update operation.
Severity	Medium
Tactics	InitialAccess
Techniques	T1190 T1133
Required data connectors	CustomLogsAma ZscalerPrivateAccess
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Zscaler Private Access (ZPA)/Analytic Rules/ZscalerUnexpectedUpdateOperation.yaml
Version	1.0.1
Arm template	672e2846-4226-11ec-81d3-0242ac130003.json

KQL

ZPAEvent
| where isnotempty(AuditOperationType)
| extend ExpectedVersion1 = extract(@'(expectedVersion":")([0-9]+)\.([0-9]+\.[0-9]+)', 2, AuditOldValue)
| extend ExpectedVersion2 = extract(@'(expectedVersion":")([0-9]+)\.([0-9]+\.[0-9]+)', 3, AuditOldValue)
| extend NewVersion1 = extract(@'("currentVersion":")([0-9]+)\.([0-9]+\.[0-9]+)', 2, AuditNewValue)
| extend NewVersion2 = extract(@'("currentVersion":")([0-9]+)\.([0-9]+\.[0-9]+)', 3, AuditNewValue)
| extend Comparision1 = iff(tolong(ExpectedVersion2) > tolong(NewVersion2), 'Unexpected version', 'Expected version')
| extend VersionCheck = iff(tolong(ExpectedVersion1) > tolong(NewVersion1), 'Unexpected version', Comparision1)
| project-away ExpectedVersion1, ExpectedVersion2, NewVersion1, NewVersion2, Comparision1
| extend ProcessCustomEntity = AuditOperationType

YAML

relevantTechniques:
- T1190
- T1133
name: Zscaler - Unexpected update operation
requiredDataConnectors:
- dataTypes:
  - ZPAEvent
  connectorId: ZscalerPrivateAccess
- datatypes:
  - ZPA_CL
  connectorId: CustomLogsAma
entityMappings:
- fieldMappings:
  - identifier: ProcessId
    columnName: ProcessCustomEntity
  entityType: Process
triggerThreshold: 0
id: 672e2846-4226-11ec-81d3-0242ac130003
tactics:
- InitialAccess
version: 1.0.1
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Zscaler Private Access (ZPA)/Analytic Rules/ZscalerUnexpectedUpdateOperation.yaml
queryPeriod: 1h
kind: Scheduled
queryFrequency: 1h
severity: Medium
status: Available
description: |
    'Detects unexpected version of update operation.'
query: |
  ZPAEvent
  | where isnotempty(AuditOperationType)
  | extend ExpectedVersion1 = extract(@'(expectedVersion":")([0-9]+)\.([0-9]+\.[0-9]+)', 2, AuditOldValue)
  | extend ExpectedVersion2 = extract(@'(expectedVersion":")([0-9]+)\.([0-9]+\.[0-9]+)', 3, AuditOldValue)
  | extend NewVersion1 = extract(@'("currentVersion":")([0-9]+)\.([0-9]+\.[0-9]+)', 2, AuditNewValue)
  | extend NewVersion2 = extract(@'("currentVersion":")([0-9]+)\.([0-9]+\.[0-9]+)', 3, AuditNewValue)
  | extend Comparision1 = iff(tolong(ExpectedVersion2) > tolong(NewVersion2), 'Unexpected version', 'Expected version')
  | extend VersionCheck = iff(tolong(ExpectedVersion1) > tolong(NewVersion1), 'Unexpected version', Comparision1)
  | project-away ExpectedVersion1, ExpectedVersion2, NewVersion1, NewVersion2, Comparision1
  | extend ProcessCustomEntity = AuditOperationType  
triggerOperator: gt

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/672e2846-4226-11ec-81d3-0242ac130003')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/672e2846-4226-11ec-81d3-0242ac130003')]",
      "properties": {
        "alertRuleTemplateName": "672e2846-4226-11ec-81d3-0242ac130003",
        "customDetails": null,
        "description": "'Detects unexpected version of update operation.'\n",
        "displayName": "Zscaler - Unexpected update operation",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Process",
            "fieldMappings": [
              {
                "columnName": "ProcessCustomEntity",
                "identifier": "ProcessId"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Zscaler Private Access (ZPA)/Analytic Rules/ZscalerUnexpectedUpdateOperation.yaml",
        "query": "ZPAEvent\n| where isnotempty(AuditOperationType)\n| extend ExpectedVersion1 = extract(@'(expectedVersion\":\")([0-9]+)\\.([0-9]+\\.[0-9]+)', 2, AuditOldValue)\n| extend ExpectedVersion2 = extract(@'(expectedVersion\":\")([0-9]+)\\.([0-9]+\\.[0-9]+)', 3, AuditOldValue)\n| extend NewVersion1 = extract(@'(\"currentVersion\":\")([0-9]+)\\.([0-9]+\\.[0-9]+)', 2, AuditNewValue)\n| extend NewVersion2 = extract(@'(\"currentVersion\":\")([0-9]+)\\.([0-9]+\\.[0-9]+)', 3, AuditNewValue)\n| extend Comparision1 = iff(tolong(ExpectedVersion2) > tolong(NewVersion2), 'Unexpected version', 'Expected version')\n| extend VersionCheck = iff(tolong(ExpectedVersion1) > tolong(NewVersion1), 'Unexpected version', Comparision1)\n| project-away ExpectedVersion1, ExpectedVersion2, NewVersion1, NewVersion2, Comparision1\n| extend ProcessCustomEntity = AuditOperationType\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1133",
          "T1190"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}