Azure DevOps Retention Reduced

Back


Id	71d374e0-1cf8-4e50-aecd-ab6c519795c2
Rulename	Azure DevOps Retention Reduced
Description	AzureDevOps retains items such as run records and produced artifacts for a configurable amount of time. An attacker looking to reduce the footprint left by their malicious activity may look to reduce the retention time for artifacts and runs. This query will look for where retention has been reduced to the minimum level - 1, or reduced by more than half.
Severity	Low
Tactics	DefenseEvasion
Techniques	T1564
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AzureDevOpsAuditing/Analytic Rules/ADORetentionReduced.yaml
Version	1.0.5
Arm template	71d374e0-1cf8-4e50-aecd-ab6c519795c2.json

KQL

ADOAuditLogs
| where OperationName =~ "Pipelines.PipelineRetentionSettingChanged"
| where Data.SettingName in ("PurgeArtifacts", "PurgeRuns")
| where Data.NewValue == 1 or Data.NewValue < Data.OldValue/2
| project-reorder TimeGenerated, OperationName, ActorUPN, IpAddress, UserAgent, Data
| extend timestamp = TimeGenerated
| extend AccountName = tostring(split(ActorUPN, "@")[0]), AccountUPNSuffix = tostring(split(ActorUPN, "@")[1])

YAML

triggerOperator: gt
queryFrequency: 1d
requiredDataConnectors: []
relevantTechniques:
- T1564
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: ActorUPN
  - identifier: Name
    columnName: AccountName
  - identifier: UPNSuffix
    columnName: AccountUPNSuffix
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IpAddress
query: |
  ADOAuditLogs
  | where OperationName =~ "Pipelines.PipelineRetentionSettingChanged"
  | where Data.SettingName in ("PurgeArtifacts", "PurgeRuns")
  | where Data.NewValue == 1 or Data.NewValue < Data.OldValue/2
  | project-reorder TimeGenerated, OperationName, ActorUPN, IpAddress, UserAgent, Data
  | extend timestamp = TimeGenerated
  | extend AccountName = tostring(split(ActorUPN, "@")[0]), AccountUPNSuffix = tostring(split(ActorUPN, "@")[1])  
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AzureDevOpsAuditing/Analytic Rules/ADORetentionReduced.yaml
queryPeriod: 1d
name: Azure DevOps Retention Reduced
status: Available
kind: Scheduled
description: |
  'AzureDevOps retains items such as run records and produced artifacts for a configurable amount of time. An attacker looking to reduce the footprint left by their malicious activity may look to reduce the retention time for artifacts and runs.
  This query will look for where retention has been reduced to the minimum level - 1, or reduced by more than half.'  
id: 71d374e0-1cf8-4e50-aecd-ab6c519795c2
version: 1.0.5
tactics:
- DefenseEvasion
severity: Low

ARM