SAP BTP - Cloud Integration tampering with security material

let securityMaterialTypes = dynamic(["Credential", "X.509 Certificate", "X.509 Key-Pair", "PGP Public Keys", "PGP Secret Keys"]);
let keystoreActions = dynamic(["Create", "Update", "Change", "Delete"]);
SAPBTPAuditLog_CL
| where Category == "audit.security-events"
| extend data_s = tostring(Message.data),
         ipAddress = tostring(Message.ip)
| extend parsedData = parse_json(data_s)
| extend action = tostring(parsedData.action),
         objectType = tostring(parsedData.objectType),
         objectId = tostring(parsedData.objectId),
         keystoreName = tostring(parsedData.attributes["Keystore Name"])
| where objectType in (securityMaterialTypes)
| where 
    (objectType == "Credential" and action in ("PasswordStore", "PasswordUpdate", "PasswordDelete"))
    or 
    (objectType != "Credential" and action in (keystoreActions))
| extend normalizedAction = case(
    action == "PasswordStore", "created",
    action == "PasswordUpdate", "updated",
    action == "PasswordDelete", "deleted",
    action == "Create", "created",
    action == "Update", "updated",
    action == "Change", "changed",
    action == "Delete", "deleted",
    action
)
| extend MessageText = case(
    objectType == "Credential", strcat("Security credential '", objectId, "' was ", normalizedAction),
    isnotempty(keystoreName), strcat(objectType, " '", objectId, "' was ", normalizedAction, " in keystore '", keystoreName, "'"),
    strcat(objectType, " '", objectId, "' was ", normalizedAction)
)
| project
    UpdatedOn,
    UserName,
    MessageText,
    ObjectType = objectType,
    ObjectId = objectId,
    Action = action,
    NormalizedAction = normalizedAction,
    KeystoreName = keystoreName,
    Tenant,
    ipAddress,
    CloudApp = "SAP Cloud Integration"
| extend AccountName = split(UserName, "@")[0], UPNSuffix = split(UserName, "@")[1]

triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP%20BTP/Analytic%20Rules/BTP%20-%20Cloud%20Integration%20tampering%20with%20security%20material.yaml
triggerThreshold: 0
id: 8d5f3a1b-9c2e-4f7d-b8a6-1e4c7f9d2b5a
kind: Scheduled
queryPeriod: 15m
version: 1.0.1
eventGroupingSettings:
  aggregationKind: SingleAlert
tactics:
- CredentialAccess
- DefenseEvasion
queryFrequency: 15m
alertDetailsOverride:
  alertDescriptionFormat: "{{MessageText}} by {{UserName}} from IP {{ipAddress}}.\n    \nThis could indicate:\n- Legitimate security material management\n- Unauthorized credential or certificate manipulation\n- Attacker tampering with security artifacts to gain access or cover tracks\n"
  alertDisplayNameFormat: 'SAP Cloud Integration: {{MessageText}}'
severity: Medium
name: SAP BTP - Cloud Integration tampering with security material
customDetails:
  Action: Action
  ObjectId: ObjectId
  SourceIP: ipAddress
  ObjectType: ObjectType
  KeystoreName: KeystoreName
requiredDataConnectors:
- connectorId: SAPBTPAuditEvents
  dataTypes:
  - SAPBTPAuditLog_CL
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountName
  - identifier: UPNSuffix
    columnName: UPNSuffix
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: ipAddress
- entityType: CloudApplication
  fieldMappings:
  - identifier: Name
    columnName: CloudApp
description: |
  Identifies operations on security material (credentials, certificates, and keys) within SAP Cloud Integration.
  This includes credentials (passwords/secrets), X.509 certificates and key pairs, and PGP keys.
  Unauthorized manipulation of security material could indicate an attacker attempting to:
  - Gain access to external systems using stored credentials
  - Intercept or tamper with encrypted communications
  - Establish persistence through certificate manipulation
  - Cover tracks by deleting security artifacts
relevantTechniques:
- T1552
- T1070
status: Available
query: |
  let securityMaterialTypes = dynamic(["Credential", "X.509 Certificate", "X.509 Key-Pair", "PGP Public Keys", "PGP Secret Keys"]);
  let keystoreActions = dynamic(["Create", "Update", "Change", "Delete"]);
  SAPBTPAuditLog_CL
  | where Category == "audit.security-events"
  | extend data_s = tostring(Message.data),
           ipAddress = tostring(Message.ip)
  | extend parsedData = parse_json(data_s)
  | extend action = tostring(parsedData.action),
           objectType = tostring(parsedData.objectType),
           objectId = tostring(parsedData.objectId),
           keystoreName = tostring(parsedData.attributes["Keystore Name"])
  | where objectType in (securityMaterialTypes)
  | where 
      (objectType == "Credential" and action in ("PasswordStore", "PasswordUpdate", "PasswordDelete"))
      or 
      (objectType != "Credential" and action in (keystoreActions))
  | extend normalizedAction = case(
      action == "PasswordStore", "created",
      action == "PasswordUpdate", "updated",
      action == "PasswordDelete", "deleted",
      action == "Create", "created",
      action == "Update", "updated",
      action == "Change", "changed",
      action == "Delete", "deleted",
      action
  )
  | extend MessageText = case(
      objectType == "Credential", strcat("Security credential '", objectId, "' was ", normalizedAction),
      isnotempty(keystoreName), strcat(objectType, " '", objectId, "' was ", normalizedAction, " in keystore '", keystoreName, "'"),
      strcat(objectType, " '", objectId, "' was ", normalizedAction)
  )
  | project
      UpdatedOn,
      UserName,
      MessageText,
      ObjectType = objectType,
      ObjectId = objectId,
      Action = action,
      NormalizedAction = normalizedAction,
      KeystoreName = keystoreName,
      Tenant,
      ipAddress,
      CloudApp = "SAP Cloud Integration"
  | extend AccountName = split(UserName, "@")[0], UPNSuffix = split(UserName, "@")[1]

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/8d5f3a1b-9c2e-4f7d-b8a6-1e4c7f9d2b5a')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/8d5f3a1b-9c2e-4f7d-b8a6-1e4c7f9d2b5a')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "{{MessageText}} by {{UserName}} from IP {{ipAddress}}.\n    \nThis could indicate:\n- Legitimate security material management\n- Unauthorized credential or certificate manipulation\n- Attacker tampering with security artifacts to gain access or cover tracks\n",
          "alertDisplayNameFormat": "SAP Cloud Integration: {{MessageText}}"
        },
        "alertRuleTemplateName": "8d5f3a1b-9c2e-4f7d-b8a6-1e4c7f9d2b5a",
        "customDetails": {
          "Action": "Action",
          "KeystoreName": "KeystoreName",
          "ObjectId": "ObjectId",
          "ObjectType": "ObjectType",
          "SourceIP": "ipAddress"
        },
        "description": "Identifies operations on security material (credentials, certificates, and keys) within SAP Cloud Integration.\nThis includes credentials (passwords/secrets), X.509 certificates and key pairs, and PGP keys.\nUnauthorized manipulation of security material could indicate an attacker attempting to:\n- Gain access to external systems using stored credentials\n- Intercept or tamper with encrypted communications\n- Establish persistence through certificate manipulation\n- Cover tracks by deleting security artifacts\n",
        "displayName": "SAP BTP - Cloud Integration tampering with security material",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountName",
                "identifier": "Name"
              },
              {
                "columnName": "UPNSuffix",
                "identifier": "UPNSuffix"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "ipAddress",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "CloudApp",
                "identifier": "Name"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP%20BTP/Analytic%20Rules/BTP%20-%20Cloud%20Integration%20tampering%20with%20security%20material.yaml",
        "query": "let securityMaterialTypes = dynamic([\"Credential\", \"X.509 Certificate\", \"X.509 Key-Pair\", \"PGP Public Keys\", \"PGP Secret Keys\"]);\nlet keystoreActions = dynamic([\"Create\", \"Update\", \"Change\", \"Delete\"]);\nSAPBTPAuditLog_CL\n| where Category == \"audit.security-events\"\n| extend data_s = tostring(Message.data),\n         ipAddress = tostring(Message.ip)\n| extend parsedData = parse_json(data_s)\n| extend action = tostring(parsedData.action),\n         objectType = tostring(parsedData.objectType),\n         objectId = tostring(parsedData.objectId),\n         keystoreName = tostring(parsedData.attributes[\"Keystore Name\"])\n| where objectType in (securityMaterialTypes)\n| where \n    (objectType == \"Credential\" and action in (\"PasswordStore\", \"PasswordUpdate\", \"PasswordDelete\"))\n    or \n    (objectType != \"Credential\" and action in (keystoreActions))\n| extend normalizedAction = case(\n    action == \"PasswordStore\", \"created\",\n    action == \"PasswordUpdate\", \"updated\",\n    action == \"PasswordDelete\", \"deleted\",\n    action == \"Create\", \"created\",\n    action == \"Update\", \"updated\",\n    action == \"Change\", \"changed\",\n    action == \"Delete\", \"deleted\",\n    action\n)\n| extend MessageText = case(\n    objectType == \"Credential\", strcat(\"Security credential '\", objectId, \"' was \", normalizedAction),\n    isnotempty(keystoreName), strcat(objectType, \" '\", objectId, \"' was \", normalizedAction, \" in keystore '\", keystoreName, \"'\"),\n    strcat(objectType, \" '\", objectId, \"' was \", normalizedAction)\n)\n| project\n    UpdatedOn,\n    UserName,\n    MessageText,\n    ObjectType = objectType,\n    ObjectId = objectId,\n    Action = action,\n    NormalizedAction = normalizedAction,\n    KeystoreName = keystoreName,\n    Tenant,\n    ipAddress,\n    CloudApp = \"SAP Cloud Integration\"\n| extend AccountName = split(UserName, \"@\")[0], UPNSuffix = split(UserName, \"@\")[1]\n",
        "queryFrequency": "PT15M",
        "queryPeriod": "PT15M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "DefenseEvasion"
        ],
        "techniques": [
          "T1070",
          "T1552"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}