NordPass - Manual invitation suspension or deletion

Back


Id	693c5217-e840-427f-9661-3fa0ef266040
Rulename	NordPass - Manual invitation, suspension, or deletion
Description	This will alert you when the user is manually invited, suspended, or deleted. !This rule should be enabled only by organizations that have User and Group Provisioning enabled.
Severity	Medium
Tactics	Persistence
Techniques	T1098
Required data connectors	NordPass
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_manual_user_manipulation.yaml
Version	1.0.0
Arm template	693c5217-e840-427f-9661-3fa0ef266040.json

KQL

NordPassEventLogs_CL  
| extend metadataParsed = parse_json(metadata)  
| where (event_type == "invites" and action == "user_invited") or (event_type == "access" and action == "user_status_updated" and (metadataParsed.status == "suspended" or metadataParsed.status == "deleted"))  
| extend TargetEmail = user_email

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_manual_user_manipulation.yaml
queryPeriod: 1h
description: |
  This will alert you when the user is manually invited, suspended, or deleted.

  !This rule should be enabled only by organizations that have User and Group Provisioning enabled.  
displayName: Manual invitation, suspension, or deletion
name: NordPass - Manual invitation, suspension, or deletion
triggerOperator: gt
incidentConfiguration:
  createIncident: false
kind: Scheduled
requiredDataConnectors:
- connectorId: NordPass
  dataTypes:
  - NordPassEventLogs_CL
triggerThreshold: 0
queryFrequency: 1h
tactics:
- Persistence
id: 693c5217-e840-427f-9661-3fa0ef266040
version: 1.0.0
query: |
  NordPassEventLogs_CL  
  | extend metadataParsed = parse_json(metadata)  
  | where (event_type == "invites" and action == "user_invited") or (event_type == "access" and action == "user_status_updated" and (metadataParsed.status == "suspended" or metadataParsed.status == "deleted"))  
  | extend TargetEmail = user_email  
entityMappings:
- entityType: Mailbox
  fieldMappings:
  - identifier: MailboxPrimaryAddress
    columnName: TargetEmail
severity: Medium
relevantTechniques:
- T1098

ARM