NordPass - Manual invitation suspension or deletion

Back


Id	693c5217-e840-427f-9661-3fa0ef266040
Rulename	NordPass - Manual invitation, suspension, or deletion
Description	This will alert you when the user is manually invited, suspended, or deleted. !This rule should be enabled only by organizations that have User and Group Provisioning enabled.
Severity	Medium
Tactics	Persistence
Techniques	T1098
Required data connectors	NordPass
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_manual_user_manipulation.yaml
Version	1.0.0
Arm template	693c5217-e840-427f-9661-3fa0ef266040.json

KQL

NordPassEventLogs_CL  
| extend metadataParsed = parse_json(metadata)  
| where (event_type == "invites" and action == "user_invited") or (event_type == "access" and action == "user_status_updated" and (metadataParsed.status == "suspended" or metadataParsed.status == "deleted"))  
| extend TargetEmail = user_email

YAML

tactics:
- Persistence
triggerOperator: gt
version: 1.0.0
incidentConfiguration:
  createIncident: false
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_manual_user_manipulation.yaml
displayName: Manual invitation, suspension, or deletion
triggerThreshold: 0
relevantTechniques:
- T1098
queryPeriod: 1h
query: |
  NordPassEventLogs_CL  
  | extend metadataParsed = parse_json(metadata)  
  | where (event_type == "invites" and action == "user_invited") or (event_type == "access" and action == "user_status_updated" and (metadataParsed.status == "suspended" or metadataParsed.status == "deleted"))  
  | extend TargetEmail = user_email  
severity: Medium
kind: Scheduled
name: NordPass - Manual invitation, suspension, or deletion
queryFrequency: 1h
id: 693c5217-e840-427f-9661-3fa0ef266040
description: |
  This will alert you when the user is manually invited, suspended, or deleted.

  !This rule should be enabled only by organizations that have User and Group Provisioning enabled.  
requiredDataConnectors:
- dataTypes:
  - NordPassEventLogs_CL
  connectorId: NordPass
entityMappings:
- fieldMappings:
  - columnName: TargetEmail
    identifier: MailboxPrimaryAddress
  entityType: Mailbox

ARM