BTP - Cloud Integration tampering with security material

let securityMaterialTypes = dynamic(["Credential", "X.509 Certificate", "X.509 Key-Pair", "PGP Public Keys", "PGP Secret Keys"]);
let keystoreActions = dynamic(["Create", "Update", "Change", "Delete"]);
SAPBTPAuditLog_CL
| where Category == "audit.security-events"
| extend data_s = tostring(Message.data),
         ipAddress = tostring(Message.ip)
| extend parsedData = parse_json(data_s)
| extend action = tostring(parsedData.action),
         objectType = tostring(parsedData.objectType),
         objectId = tostring(parsedData.objectId),
         keystoreName = tostring(parsedData.attributes["Keystore Name"])
| where objectType in (securityMaterialTypes)
| where 
    (objectType == "Credential" and action in ("PasswordStore", "PasswordUpdate", "PasswordDelete"))
    or 
    (objectType != "Credential" and action in (keystoreActions))
| extend normalizedAction = case(
    action == "PasswordStore", "created",
    action == "PasswordUpdate", "updated",
    action == "PasswordDelete", "deleted",
    action == "Create", "created",
    action == "Update", "updated",
    action == "Change", "changed",
    action == "Delete", "deleted",
    action
)
| extend MessageText = case(
    objectType == "Credential", strcat("Security credential '", objectId, "' was ", normalizedAction),
    isnotempty(keystoreName), strcat(objectType, " '", objectId, "' was ", normalizedAction, " in keystore '", keystoreName, "'"),
    strcat(objectType, " '", objectId, "' was ", normalizedAction)
)
| project
    UpdatedOn,
    UserName,
    MessageText,
    ObjectType = objectType,
    ObjectId = objectId,
    Action = action,
    NormalizedAction = normalizedAction,
    KeystoreName = keystoreName,
    Tenant,
    ipAddress,
    CloudApp = "SAP Cloud Integration"
| extend AccountName = split(UserName, "@")[0], UPNSuffix = split(UserName, "@")[1]

kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP%20BTP/Analytic%20Rules/BTP%20-%20Cloud%20Integration%20tampering%20with%20security%20material.yaml
version: 1.0.0
status: Available
requiredDataConnectors:
- dataTypes:
  - SAPBTPAuditLog_CL
  connectorId: SAPBTPAuditEvents
alertDetailsOverride:
  alertDescriptionFormat: "{{MessageText}} by {{UserName}} from IP {{ipAddress}}.\n    \nThis could indicate:\n- Legitimate security material management\n- Unauthorized credential or certificate manipulation\n- Attacker tampering with security artifacts to gain access or cover tracks\n"
  alertDisplayNameFormat: 'SAP Cloud Integration: {{MessageText}}'
relevantTechniques:
- T1552
- T1070
customDetails:
  Action: Action
  SourceIP: ipAddress
  ObjectId: ObjectId
  ObjectType: ObjectType
  KeystoreName: KeystoreName
query: |
  let securityMaterialTypes = dynamic(["Credential", "X.509 Certificate", "X.509 Key-Pair", "PGP Public Keys", "PGP Secret Keys"]);
  let keystoreActions = dynamic(["Create", "Update", "Change", "Delete"]);
  SAPBTPAuditLog_CL
  | where Category == "audit.security-events"
  | extend data_s = tostring(Message.data),
           ipAddress = tostring(Message.ip)
  | extend parsedData = parse_json(data_s)
  | extend action = tostring(parsedData.action),
           objectType = tostring(parsedData.objectType),
           objectId = tostring(parsedData.objectId),
           keystoreName = tostring(parsedData.attributes["Keystore Name"])
  | where objectType in (securityMaterialTypes)
  | where 
      (objectType == "Credential" and action in ("PasswordStore", "PasswordUpdate", "PasswordDelete"))
      or 
      (objectType != "Credential" and action in (keystoreActions))
  | extend normalizedAction = case(
      action == "PasswordStore", "created",
      action == "PasswordUpdate", "updated",
      action == "PasswordDelete", "deleted",
      action == "Create", "created",
      action == "Update", "updated",
      action == "Change", "changed",
      action == "Delete", "deleted",
      action
  )
  | extend MessageText = case(
      objectType == "Credential", strcat("Security credential '", objectId, "' was ", normalizedAction),
      isnotempty(keystoreName), strcat(objectType, " '", objectId, "' was ", normalizedAction, " in keystore '", keystoreName, "'"),
      strcat(objectType, " '", objectId, "' was ", normalizedAction)
  )
  | project
      UpdatedOn,
      UserName,
      MessageText,
      ObjectType = objectType,
      ObjectId = objectId,
      Action = action,
      NormalizedAction = normalizedAction,
      KeystoreName = keystoreName,
      Tenant,
      ipAddress,
      CloudApp = "SAP Cloud Integration"
  | extend AccountName = split(UserName, "@")[0], UPNSuffix = split(UserName, "@")[1]
tactics:
- CredentialAccess
- DefenseEvasion
queryFrequency: 15m
id: 8d5f3a1b-9c2e-4f7d-b8a6-1e4c7f9d2b5a
triggerThreshold: 0
triggerOperator: gt
name: BTP - Cloud Integration tampering with security material
queryPeriod: 15m
severity: Medium
entityMappings:
- fieldMappings:
  - columnName: AccountName
    identifier: Name
  - columnName: UPNSuffix
    identifier: UPNSuffix
  entityType: Account
- fieldMappings:
  - columnName: ipAddress
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: CloudApp
    identifier: Name
  entityType: CloudApplication
eventGroupingSettings:
  aggregationKind: SingleAlert
description: |
  Identifies operations on security material (credentials, certificates, and keys) within SAP Cloud Integration.
  This includes credentials (passwords/secrets), X.509 certificates and key pairs, and PGP keys.
  Unauthorized manipulation of security material could indicate an attacker attempting to:
  - Gain access to external systems using stored credentials
  - Intercept or tamper with encrypted communications
  - Establish persistence through certificate manipulation
  - Cover tracks by deleting security artifacts

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/8d5f3a1b-9c2e-4f7d-b8a6-1e4c7f9d2b5a')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/8d5f3a1b-9c2e-4f7d-b8a6-1e4c7f9d2b5a')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "{{MessageText}} by {{UserName}} from IP {{ipAddress}}.\n    \nThis could indicate:\n- Legitimate security material management\n- Unauthorized credential or certificate manipulation\n- Attacker tampering with security artifacts to gain access or cover tracks\n",
          "alertDisplayNameFormat": "SAP Cloud Integration: {{MessageText}}"
        },
        "alertRuleTemplateName": "8d5f3a1b-9c2e-4f7d-b8a6-1e4c7f9d2b5a",
        "customDetails": {
          "Action": "Action",
          "KeystoreName": "KeystoreName",
          "ObjectId": "ObjectId",
          "ObjectType": "ObjectType",
          "SourceIP": "ipAddress"
        },
        "description": "Identifies operations on security material (credentials, certificates, and keys) within SAP Cloud Integration.\nThis includes credentials (passwords/secrets), X.509 certificates and key pairs, and PGP keys.\nUnauthorized manipulation of security material could indicate an attacker attempting to:\n- Gain access to external systems using stored credentials\n- Intercept or tamper with encrypted communications\n- Establish persistence through certificate manipulation\n- Cover tracks by deleting security artifacts\n",
        "displayName": "BTP - Cloud Integration tampering with security material",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountName",
                "identifier": "Name"
              },
              {
                "columnName": "UPNSuffix",
                "identifier": "UPNSuffix"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "ipAddress",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "CloudApp",
                "identifier": "Name"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP%20BTP/Analytic%20Rules/BTP%20-%20Cloud%20Integration%20tampering%20with%20security%20material.yaml",
        "query": "let securityMaterialTypes = dynamic([\"Credential\", \"X.509 Certificate\", \"X.509 Key-Pair\", \"PGP Public Keys\", \"PGP Secret Keys\"]);\nlet keystoreActions = dynamic([\"Create\", \"Update\", \"Change\", \"Delete\"]);\nSAPBTPAuditLog_CL\n| where Category == \"audit.security-events\"\n| extend data_s = tostring(Message.data),\n         ipAddress = tostring(Message.ip)\n| extend parsedData = parse_json(data_s)\n| extend action = tostring(parsedData.action),\n         objectType = tostring(parsedData.objectType),\n         objectId = tostring(parsedData.objectId),\n         keystoreName = tostring(parsedData.attributes[\"Keystore Name\"])\n| where objectType in (securityMaterialTypes)\n| where \n    (objectType == \"Credential\" and action in (\"PasswordStore\", \"PasswordUpdate\", \"PasswordDelete\"))\n    or \n    (objectType != \"Credential\" and action in (keystoreActions))\n| extend normalizedAction = case(\n    action == \"PasswordStore\", \"created\",\n    action == \"PasswordUpdate\", \"updated\",\n    action == \"PasswordDelete\", \"deleted\",\n    action == \"Create\", \"created\",\n    action == \"Update\", \"updated\",\n    action == \"Change\", \"changed\",\n    action == \"Delete\", \"deleted\",\n    action\n)\n| extend MessageText = case(\n    objectType == \"Credential\", strcat(\"Security credential '\", objectId, \"' was \", normalizedAction),\n    isnotempty(keystoreName), strcat(objectType, \" '\", objectId, \"' was \", normalizedAction, \" in keystore '\", keystoreName, \"'\"),\n    strcat(objectType, \" '\", objectId, \"' was \", normalizedAction)\n)\n| project\n    UpdatedOn,\n    UserName,\n    MessageText,\n    ObjectType = objectType,\n    ObjectId = objectId,\n    Action = action,\n    NormalizedAction = normalizedAction,\n    KeystoreName = keystoreName,\n    Tenant,\n    ipAddress,\n    CloudApp = \"SAP Cloud Integration\"\n| extend AccountName = split(UserName, \"@\")[0], UPNSuffix = split(UserName, \"@\")[1]\n",
        "queryFrequency": "PT15M",
        "queryPeriod": "PT15M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "DefenseEvasion"
        ],
        "techniques": [
          "T1070",
          "T1552"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}