SAP BTP - Build Work Zone unauthorized access and role tampering

SAPBTPAuditLog_CL
| extend LogMessage = coalesce(tostring(Message.message), tostring(Message.data), tostring(Message))
| where LogMessage has_any ("Unauthorized access to the oData service", 
                            "All roles for providerId", 
                            "All users for providerId",
                            "were deleted successfully",
                            "were removed successfully")
| extend EventCategory = case(
    LogMessage contains "Unauthorized access", "Unauthorized Access",
    LogMessage contains "All roles" or LogMessage contains "All users", "Mass Deletion",
    "Role Tampering"
)
| extend MessageText = case(
    LogMessage contains "Unauthorized access to the oData service", "Unauthorized OData service access attempt",
    LogMessage contains "All roles for providerId" and LogMessage contains "deleted", "Mass role deletion detected",
    LogMessage contains "All users for providerId" and LogMessage contains "deleted", "Mass user deletion detected",
    LogMessage contains "assignments were removed", "User/role assignments removed",
    "Suspicious access control modification"
)
| extend ProviderId = extract(@"providerId\s+(\S+)", 1, LogMessage)
| project
    TimeGenerated,
    UserName,
    MessageText,
    EventCategory,
    ProviderId,
    Tenant,
    CloudApp = "SAP Build Work Zone Standard Edition"
| extend AccountName = split(UserName, "@")[0], UPNSuffix = split(UserName, "@")[1]

name: SAP BTP - Build Work Zone unauthorized access and role tampering
triggerOperator: gt
kind: Scheduled
queryFrequency: 15m
description: |
  Identifies unauthorized OData access attempts and mass role/user deletions in SAP Build Work Zone 
  Standard Edition. These events may indicate an attacker accessing restricted resources or 
  removing access controls to cover their tracks.
id: 8e5f3a2c-9d1b-4c6e-a7f8-3b2d1e0c9a5f
triggerThreshold: 0
queryPeriod: 15m
query: |
  SAPBTPAuditLog_CL
  | extend LogMessage = coalesce(tostring(Message.message), tostring(Message.data), tostring(Message))
  | where LogMessage has_any ("Unauthorized access to the oData service", 
                              "All roles for providerId", 
                              "All users for providerId",
                              "were deleted successfully",
                              "were removed successfully")
  | extend EventCategory = case(
      LogMessage contains "Unauthorized access", "Unauthorized Access",
      LogMessage contains "All roles" or LogMessage contains "All users", "Mass Deletion",
      "Role Tampering"
  )
  | extend MessageText = case(
      LogMessage contains "Unauthorized access to the oData service", "Unauthorized OData service access attempt",
      LogMessage contains "All roles for providerId" and LogMessage contains "deleted", "Mass role deletion detected",
      LogMessage contains "All users for providerId" and LogMessage contains "deleted", "Mass user deletion detected",
      LogMessage contains "assignments were removed", "User/role assignments removed",
      "Suspicious access control modification"
  )
  | extend ProviderId = extract(@"providerId\s+(\S+)", 1, LogMessage)
  | project
      TimeGenerated,
      UserName,
      MessageText,
      EventCategory,
      ProviderId,
      Tenant,
      CloudApp = "SAP Build Work Zone Standard Edition"
  | extend AccountName = split(UserName, "@")[0], UPNSuffix = split(UserName, "@")[1]
version: 1.0.1
customDetails:
  ProviderId: ProviderId
  EventCategory: EventCategory
status: Available
eventGroupingSettings:
  aggregationKind: AlertPerResult
severity: High
requiredDataConnectors:
- connectorId: SAPBTPAuditEvents
  dataTypes:
  - SAPBTPAuditLog_CL
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP%20BTP/Analytic%20Rules/BTP%20-%20Build%20Work%20Zone%20unauthorized%20access%20and%20role%20tampering.yaml
alertDetailsOverride:
  alertDescriptionFormat: |
    {{MessageText}} by {{UserName}} in tenant {{Tenant}}.

    This could indicate unauthorized access attempts or malicious removal of access controls.
  alertDisplayNameFormat: 'SAP Build Work Zone: {{MessageText}}'
relevantTechniques:
- T1078
- T1531
- T1070
tactics:
- InitialAccess
- Persistence
- DefenseEvasion
- Impact
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: AccountName
  - identifier: UPNSuffix
    columnName: UPNSuffix
  entityType: Account
- fieldMappings:
  - identifier: Name
    columnName: CloudApp
  entityType: CloudApplication

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/8e5f3a2c-9d1b-4c6e-a7f8-3b2d1e0c9a5f')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/8e5f3a2c-9d1b-4c6e-a7f8-3b2d1e0c9a5f')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "{{MessageText}} by {{UserName}} in tenant {{Tenant}}.\n\nThis could indicate unauthorized access attempts or malicious removal of access controls.\n",
          "alertDisplayNameFormat": "SAP Build Work Zone: {{MessageText}}"
        },
        "alertRuleTemplateName": "8e5f3a2c-9d1b-4c6e-a7f8-3b2d1e0c9a5f",
        "customDetails": {
          "EventCategory": "EventCategory",
          "ProviderId": "ProviderId"
        },
        "description": "Identifies unauthorized OData access attempts and mass role/user deletions in SAP Build Work Zone \nStandard Edition. These events may indicate an attacker accessing restricted resources or \nremoving access controls to cover their tracks.\n",
        "displayName": "SAP BTP - Build Work Zone unauthorized access and role tampering",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountName",
                "identifier": "Name"
              },
              {
                "columnName": "UPNSuffix",
                "identifier": "UPNSuffix"
              }
            ]
          },
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "CloudApp",
                "identifier": "Name"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP%20BTP/Analytic%20Rules/BTP%20-%20Build%20Work%20Zone%20unauthorized%20access%20and%20role%20tampering.yaml",
        "query": "SAPBTPAuditLog_CL\n| extend LogMessage = coalesce(tostring(Message.message), tostring(Message.data), tostring(Message))\n| where LogMessage has_any (\"Unauthorized access to the oData service\", \n                            \"All roles for providerId\", \n                            \"All users for providerId\",\n                            \"were deleted successfully\",\n                            \"were removed successfully\")\n| extend EventCategory = case(\n    LogMessage contains \"Unauthorized access\", \"Unauthorized Access\",\n    LogMessage contains \"All roles\" or LogMessage contains \"All users\", \"Mass Deletion\",\n    \"Role Tampering\"\n)\n| extend MessageText = case(\n    LogMessage contains \"Unauthorized access to the oData service\", \"Unauthorized OData service access attempt\",\n    LogMessage contains \"All roles for providerId\" and LogMessage contains \"deleted\", \"Mass role deletion detected\",\n    LogMessage contains \"All users for providerId\" and LogMessage contains \"deleted\", \"Mass user deletion detected\",\n    LogMessage contains \"assignments were removed\", \"User/role assignments removed\",\n    \"Suspicious access control modification\"\n)\n| extend ProviderId = extract(@\"providerId\\s+(\\S+)\", 1, LogMessage)\n| project\n    TimeGenerated,\n    UserName,\n    MessageText,\n    EventCategory,\n    ProviderId,\n    Tenant,\n    CloudApp = \"SAP Build Work Zone Standard Edition\"\n| extend AccountName = split(UserName, \"@\")[0], UPNSuffix = split(UserName, \"@\")[1]\n",
        "queryFrequency": "PT15M",
        "queryPeriod": "PT15M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion",
          "Impact",
          "InitialAccess",
          "Persistence"
        ],
        "techniques": [
          "T1070",
          "T1078",
          "T1531"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}