NordPass - Activity token revocation

Back


Id	800314a6-759a-4575-93e2-1e080b1d33f9
Rulename	NordPass - Activity token revocation
Description	This will alert you when the event reporting token is revoked, posing the risk of active integration being blocked.
Severity	Medium
Tactics	DefenseEvasion
Techniques	T1134
Required data connectors	NordPass
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_token_revoked.yaml
Version	1.0.0
Arm template	800314a6-759a-4575-93e2-1e080b1d33f9.json

KQL

NordPassEventLogs_CL
| where event_type == "integrations"
| where action == "activities_token_revoked"
| extend TargetEmail = user_email

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_token_revoked.yaml
kind: Scheduled
incidentConfiguration:
  createIncident: false
tactics:
- DefenseEvasion
triggerThreshold: 0
relevantTechniques:
- T1134
version: 1.0.0
entityMappings:
- entityType: Mailbox
  fieldMappings:
  - columnName: TargetEmail
    identifier: MailboxPrimaryAddress
queryFrequency: 1h
name: NordPass - Activity token revocation
description: This will alert you when the event reporting token is revoked, posing the risk of active integration being blocked.
query: |
  NordPassEventLogs_CL
  | where event_type == "integrations"
  | where action == "activities_token_revoked"
  | extend TargetEmail = user_email  
queryPeriod: 1h
triggerOperator: gt
id: 800314a6-759a-4575-93e2-1e080b1d33f9
displayName: Activity token revocation
severity: Medium
requiredDataConnectors:
- dataTypes:
  - NordPassEventLogs_CL
  connectorId: NordPass

ARM