Employee account deleted

Back


Id	8a2cc466-342d-4ebb-8871-f9e1d83a24a5
Rulename	Employee account deleted
Description	This rule will monitor for any employee accounts being deleted. Deleting an employee account can have a big potential impact as all of the data for that user will be removed.
Severity	Medium
Tactics	Impact
Techniques	T1485
Required data connectors	LastPass
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/LastPass/Analytic Rules/EmployeeAccountDeleted.yaml
Version	1.0.0
Arm template	8a2cc466-342d-4ebb-8871-f9e1d83a24a5.json

KQL

LastPassNativePoller_CL
| where Action_s == "Employee Account Deleted" or Action_s == "Remove User From Company"
| extend AccountCustomEntity = Username_s, IPCustomEntity = IP_Address_s

YAML

queryPeriod: 1h
query: |
  LastPassNativePoller_CL
  | where Action_s == "Employee Account Deleted" or Action_s == "Remove User From Company"
  | extend AccountCustomEntity = Username_s, IPCustomEntity = IP_Address_s  
name: Employee account deleted
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: Name
  entityType: Account
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
eventGroupingSettings:
  aggregationKind: AlertPerResult
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/LastPass/Analytic Rules/EmployeeAccountDeleted.yaml
description: |
  'This rule will monitor for any employee accounts being deleted.
  Deleting an employee account can have a big potential impact as all of the data for that user will be removed.'  
kind: Scheduled
version: 1.0.0
status: Available
severity: Medium
requiredDataConnectors:
- connectorId: LastPass
  dataTypes:
  - LastPassNativePoller_CL
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
id: 8a2cc466-342d-4ebb-8871-f9e1d83a24a5
relevantTechniques:
- T1485

ARM