Azure DevOps Retention Reduced

Back


Id	71d374e0-1cf8-4e50-aecd-ab6c519795c2
Rulename	Azure DevOps Retention Reduced
Description	AzureDevOps retains items such as run records and produced artifacts for a configurable amount of time. An attacker looking to reduce the footprint left by their malicious activity may look to reduce the retention time for artifacts and runs. This query will look for where retention has been reduced to the minimum level - 1, or reduced by more than half.
Severity	Low
Tactics	DefenseEvasion
Techniques	T1564
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AzureDevOpsAuditing/Analytic Rules/ADORetentionReduced.yaml
Version	1.0.5
Arm template	71d374e0-1cf8-4e50-aecd-ab6c519795c2.json

KQL

ADOAuditLogs
| where OperationName =~ "Pipelines.PipelineRetentionSettingChanged"
| where Data.SettingName in ("PurgeArtifacts", "PurgeRuns")
| where Data.NewValue == 1 or Data.NewValue < Data.OldValue/2
| project-reorder TimeGenerated, OperationName, ActorUPN, IpAddress, UserAgent, Data
| extend timestamp = TimeGenerated
| extend AccountName = tostring(split(ActorUPN, "@")[0]), AccountUPNSuffix = tostring(split(ActorUPN, "@")[1])

YAML

description: |
  'AzureDevOps retains items such as run records and produced artifacts for a configurable amount of time. An attacker looking to reduce the footprint left by their malicious activity may look to reduce the retention time for artifacts and runs.
  This query will look for where retention has been reduced to the minimum level - 1, or reduced by more than half.'  
requiredDataConnectors: []
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AzureDevOpsAuditing/Analytic Rules/ADORetentionReduced.yaml
id: 71d374e0-1cf8-4e50-aecd-ab6c519795c2
name: Azure DevOps Retention Reduced
relevantTechniques:
- T1564
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: ActorUPN
  - identifier: Name
    columnName: AccountName
  - identifier: UPNSuffix
    columnName: AccountUPNSuffix
  entityType: Account
- fieldMappings:
  - identifier: Address
    columnName: IpAddress
  entityType: IP
kind: Scheduled
version: 1.0.5
triggerOperator: gt
query: |
  ADOAuditLogs
  | where OperationName =~ "Pipelines.PipelineRetentionSettingChanged"
  | where Data.SettingName in ("PurgeArtifacts", "PurgeRuns")
  | where Data.NewValue == 1 or Data.NewValue < Data.OldValue/2
  | project-reorder TimeGenerated, OperationName, ActorUPN, IpAddress, UserAgent, Data
  | extend timestamp = TimeGenerated
  | extend AccountName = tostring(split(ActorUPN, "@")[0]), AccountUPNSuffix = tostring(split(ActorUPN, "@")[1])  
status: Available
tactics:
- DefenseEvasion
queryPeriod: 1d
severity: Low
queryFrequency: 1d

ARM