SAP BTP - Cloud Integration tampering with security material

let securityMaterialTypes = dynamic(["Credential", "X.509 Certificate", "X.509 Key-Pair", "PGP Public Keys", "PGP Secret Keys"]);
let keystoreActions = dynamic(["Create", "Update", "Change", "Delete"]);
SAPBTPAuditLog_CL
| where Category == "audit.security-events"
| extend data_s = tostring(Message.data),
         ipAddress = tostring(Message.ip)
| extend parsedData = parse_json(data_s)
| extend action = tostring(parsedData.action),
         objectType = tostring(parsedData.objectType),
         objectId = tostring(parsedData.objectId),
         keystoreName = tostring(parsedData.attributes["Keystore Name"])
| where objectType in (securityMaterialTypes)
| where 
    (objectType == "Credential" and action in ("PasswordStore", "PasswordUpdate", "PasswordDelete"))
    or 
    (objectType != "Credential" and action in (keystoreActions))
| extend normalizedAction = case(
    action == "PasswordStore", "created",
    action == "PasswordUpdate", "updated",
    action == "PasswordDelete", "deleted",
    action == "Create", "created",
    action == "Update", "updated",
    action == "Change", "changed",
    action == "Delete", "deleted",
    action
)
| extend MessageText = case(
    objectType == "Credential", strcat("Security credential '", objectId, "' was ", normalizedAction),
    isnotempty(keystoreName), strcat(objectType, " '", objectId, "' was ", normalizedAction, " in keystore '", keystoreName, "'"),
    strcat(objectType, " '", objectId, "' was ", normalizedAction)
)
| project
    UpdatedOn,
    UserName,
    MessageText,
    ObjectType = objectType,
    ObjectId = objectId,
    Action = action,
    NormalizedAction = normalizedAction,
    KeystoreName = keystoreName,
    Tenant,
    ipAddress,
    CloudApp = "SAP Cloud Integration"
| extend AccountName = split(UserName, "@")[0], UPNSuffix = split(UserName, "@")[1]

queryPeriod: 15m
status: Available
version: 1.0.1
description: |
  Identifies operations on security material (credentials, certificates, and keys) within SAP Cloud Integration.
  This includes credentials (passwords/secrets), X.509 certificates and key pairs, and PGP keys.
  Unauthorized manipulation of security material could indicate an attacker attempting to:
  - Gain access to external systems using stored credentials
  - Intercept or tamper with encrypted communications
  - Establish persistence through certificate manipulation
  - Cover tracks by deleting security artifacts
queryFrequency: 15m
customDetails:
  SourceIP: ipAddress
  ObjectType: ObjectType
  ObjectId: ObjectId
  Action: Action
  KeystoreName: KeystoreName
severity: Medium
id: 8d5f3a1b-9c2e-4f7d-b8a6-1e4c7f9d2b5a
entityMappings:
- fieldMappings:
  - columnName: AccountName
    identifier: Name
  - columnName: UPNSuffix
    identifier: UPNSuffix
  entityType: Account
- fieldMappings:
  - columnName: ipAddress
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: CloudApp
    identifier: Name
  entityType: CloudApplication
relevantTechniques:
- T1552
- T1070
triggerThreshold: 0
tactics:
- CredentialAccess
- DefenseEvasion
requiredDataConnectors:
- connectorId: SAPBTPAuditEvents
  dataTypes:
  - SAPBTPAuditLog_CL
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP%20BTP/Analytic%20Rules/BTP%20-%20Cloud%20Integration%20tampering%20with%20security%20material.yaml
query: |
  let securityMaterialTypes = dynamic(["Credential", "X.509 Certificate", "X.509 Key-Pair", "PGP Public Keys", "PGP Secret Keys"]);
  let keystoreActions = dynamic(["Create", "Update", "Change", "Delete"]);
  SAPBTPAuditLog_CL
  | where Category == "audit.security-events"
  | extend data_s = tostring(Message.data),
           ipAddress = tostring(Message.ip)
  | extend parsedData = parse_json(data_s)
  | extend action = tostring(parsedData.action),
           objectType = tostring(parsedData.objectType),
           objectId = tostring(parsedData.objectId),
           keystoreName = tostring(parsedData.attributes["Keystore Name"])
  | where objectType in (securityMaterialTypes)
  | where 
      (objectType == "Credential" and action in ("PasswordStore", "PasswordUpdate", "PasswordDelete"))
      or 
      (objectType != "Credential" and action in (keystoreActions))
  | extend normalizedAction = case(
      action == "PasswordStore", "created",
      action == "PasswordUpdate", "updated",
      action == "PasswordDelete", "deleted",
      action == "Create", "created",
      action == "Update", "updated",
      action == "Change", "changed",
      action == "Delete", "deleted",
      action
  )
  | extend MessageText = case(
      objectType == "Credential", strcat("Security credential '", objectId, "' was ", normalizedAction),
      isnotempty(keystoreName), strcat(objectType, " '", objectId, "' was ", normalizedAction, " in keystore '", keystoreName, "'"),
      strcat(objectType, " '", objectId, "' was ", normalizedAction)
  )
  | project
      UpdatedOn,
      UserName,
      MessageText,
      ObjectType = objectType,
      ObjectId = objectId,
      Action = action,
      NormalizedAction = normalizedAction,
      KeystoreName = keystoreName,
      Tenant,
      ipAddress,
      CloudApp = "SAP Cloud Integration"
  | extend AccountName = split(UserName, "@")[0], UPNSuffix = split(UserName, "@")[1]
alertDetailsOverride:
  alertDescriptionFormat: "{{MessageText}} by {{UserName}} from IP {{ipAddress}}.\n    \nThis could indicate:\n- Legitimate security material management\n- Unauthorized credential or certificate manipulation\n- Attacker tampering with security artifacts to gain access or cover tracks\n"
  alertDisplayNameFormat: 'SAP Cloud Integration: {{MessageText}}'
kind: Scheduled
triggerOperator: gt
name: SAP BTP - Cloud Integration tampering with security material
eventGroupingSettings:
  aggregationKind: SingleAlert

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/8d5f3a1b-9c2e-4f7d-b8a6-1e4c7f9d2b5a')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/8d5f3a1b-9c2e-4f7d-b8a6-1e4c7f9d2b5a')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "{{MessageText}} by {{UserName}} from IP {{ipAddress}}.\n    \nThis could indicate:\n- Legitimate security material management\n- Unauthorized credential or certificate manipulation\n- Attacker tampering with security artifacts to gain access or cover tracks\n",
          "alertDisplayNameFormat": "SAP Cloud Integration: {{MessageText}}"
        },
        "alertRuleTemplateName": "8d5f3a1b-9c2e-4f7d-b8a6-1e4c7f9d2b5a",
        "customDetails": {
          "Action": "Action",
          "KeystoreName": "KeystoreName",
          "ObjectId": "ObjectId",
          "ObjectType": "ObjectType",
          "SourceIP": "ipAddress"
        },
        "description": "Identifies operations on security material (credentials, certificates, and keys) within SAP Cloud Integration.\nThis includes credentials (passwords/secrets), X.509 certificates and key pairs, and PGP keys.\nUnauthorized manipulation of security material could indicate an attacker attempting to:\n- Gain access to external systems using stored credentials\n- Intercept or tamper with encrypted communications\n- Establish persistence through certificate manipulation\n- Cover tracks by deleting security artifacts\n",
        "displayName": "SAP BTP - Cloud Integration tampering with security material",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountName",
                "identifier": "Name"
              },
              {
                "columnName": "UPNSuffix",
                "identifier": "UPNSuffix"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "ipAddress",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "CloudApp",
                "identifier": "Name"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP%20BTP/Analytic%20Rules/BTP%20-%20Cloud%20Integration%20tampering%20with%20security%20material.yaml",
        "query": "let securityMaterialTypes = dynamic([\"Credential\", \"X.509 Certificate\", \"X.509 Key-Pair\", \"PGP Public Keys\", \"PGP Secret Keys\"]);\nlet keystoreActions = dynamic([\"Create\", \"Update\", \"Change\", \"Delete\"]);\nSAPBTPAuditLog_CL\n| where Category == \"audit.security-events\"\n| extend data_s = tostring(Message.data),\n         ipAddress = tostring(Message.ip)\n| extend parsedData = parse_json(data_s)\n| extend action = tostring(parsedData.action),\n         objectType = tostring(parsedData.objectType),\n         objectId = tostring(parsedData.objectId),\n         keystoreName = tostring(parsedData.attributes[\"Keystore Name\"])\n| where objectType in (securityMaterialTypes)\n| where \n    (objectType == \"Credential\" and action in (\"PasswordStore\", \"PasswordUpdate\", \"PasswordDelete\"))\n    or \n    (objectType != \"Credential\" and action in (keystoreActions))\n| extend normalizedAction = case(\n    action == \"PasswordStore\", \"created\",\n    action == \"PasswordUpdate\", \"updated\",\n    action == \"PasswordDelete\", \"deleted\",\n    action == \"Create\", \"created\",\n    action == \"Update\", \"updated\",\n    action == \"Change\", \"changed\",\n    action == \"Delete\", \"deleted\",\n    action\n)\n| extend MessageText = case(\n    objectType == \"Credential\", strcat(\"Security credential '\", objectId, \"' was \", normalizedAction),\n    isnotempty(keystoreName), strcat(objectType, \" '\", objectId, \"' was \", normalizedAction, \" in keystore '\", keystoreName, \"'\"),\n    strcat(objectType, \" '\", objectId, \"' was \", normalizedAction)\n)\n| project\n    UpdatedOn,\n    UserName,\n    MessageText,\n    ObjectType = objectType,\n    ObjectId = objectId,\n    Action = action,\n    NormalizedAction = normalizedAction,\n    KeystoreName = keystoreName,\n    Tenant,\n    ipAddress,\n    CloudApp = \"SAP Cloud Integration\"\n| extend AccountName = split(UserName, \"@\")[0], UPNSuffix = split(UserName, \"@\")[1]\n",
        "queryFrequency": "PT15M",
        "queryPeriod": "PT15M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "DefenseEvasion"
        ],
        "techniques": [
          "T1070",
          "T1552"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}