Dynamics 365 - User Bulk Retrieval Outside Normal Activity

Back


Id	93a25f10-593d-4c57-a752-a8a75f031425
Rulename	Dynamics 365 - User Bulk Retrieval Outside Normal Activity
Description	This query detects users retrieving significantly more records from Dynamics 365 than they have in the past 2 weeks. This could indicate potentially unauthorized access to data within Dynamics 365.
Severity	Medium
Tactics	Collection
Techniques	T1530
Required data connectors	Dynamics365
Kind	Scheduled
Query frequency	1d
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Detections/Dynamics365Activity/UserBulkRetreivalOutsideNormalActivity.yaml
Version	1.0.1
Arm template	93a25f10-593d-4c57-a752-a8a75f031425.json

KQL

let baseline_time = 14d;
let detection_time = 1d;
Dynamics365Activity
| where TimeGenerated between(ago(baseline_time)..ago(detection_time-1d))
| extend Message = tostring(split(OriginalObjectId, ' ')[0])
| where Message =~ "RetrieveMultiple"
| extend numQueryCount = todouble(QueryResults)
| extend QueryCount = iif(QueryResults contains ",", todouble(countof(tostring(QueryResults), ',') + 1), numQueryCount)
| extend QueryCount = iif(isnotempty(QueryCount), QueryCount, double(1))
| summarize sum(QueryCount) by UserId
| extend HistoricalBaseline = sum_QueryCount
| join (Dynamics365Activity
| where TimeGenerated > ago(detection_time)
| extend Message = tostring(split(OriginalObjectId, ' ')[0])
| where Message =~ "RetrieveMultiple"
| extend numQueryCount = todouble(QueryResults)
| extend QueryCount = iif(QueryResults contains ",", todouble(countof(tostring(QueryResults), ',') + 1), numQueryCount)
| extend QueryCount = iif(isnotempty(QueryCount), QueryCount, double(1))
| summarize sum(QueryCount) by UserId
| extend CurrentExportRate = sum_QueryCount) on UserId
| where CurrentExportRate > HistoricalBaseline
| project UserId, HistoricalBaseline, CurrentExportRate
| join kind=inner(Dynamics365Activity
| where TimeGenerated > ago(detection_time)
| extend Message = tostring(split(OriginalObjectId, ' ')[0])
| where Message =~ "RetrieveMultiple"
| extend numQueryCount = todouble(QueryResults)
| extend QueryCount = iif(QueryResults contains ",", todouble(countof(tostring(QueryResults), ',') + 1), numQueryCount)
| extend QueryCount = iif(isnotempty(QueryCount), QueryCount, double(1))) on UserId
| project TimeGenerated, UserId, QueryCount, UserAgent, Message, ClientIP, HistoricalBaseline, CurrentExportRate, CorrelationId, CrmOrganizationUniqueName, Query
| summarize QuerySizes = make_set(QueryCount), MostRecentQuery = max(TimeGenerated), IPs = make_set(ClientIP), UserAgents = make_set(UserAgent), make_set(Query) by UserId, CrmOrganizationUniqueName, HistoricalBaseline, CurrentExportRate
| extend timestamp = MostRecentQuery, AccountCustomEntity = UserId

YAML

severity: Medium
triggerThreshold: 0
metadata:
  source:
    kind: Community
  support:
    tier: Microsoft
  categories:
    domains:
    - Cloud Provider
    - IT Operations
    - Storage
  author:
    name: Microsoft
query: |
  let baseline_time = 14d;
  let detection_time = 1d;
  Dynamics365Activity
  | where TimeGenerated between(ago(baseline_time)..ago(detection_time-1d))
  | extend Message = tostring(split(OriginalObjectId, ' ')[0])
  | where Message =~ "RetrieveMultiple"
  | extend numQueryCount = todouble(QueryResults)
  | extend QueryCount = iif(QueryResults contains ",", todouble(countof(tostring(QueryResults), ',') + 1), numQueryCount)
  | extend QueryCount = iif(isnotempty(QueryCount), QueryCount, double(1))
  | summarize sum(QueryCount) by UserId
  | extend HistoricalBaseline = sum_QueryCount
  | join (Dynamics365Activity
  | where TimeGenerated > ago(detection_time)
  | extend Message = tostring(split(OriginalObjectId, ' ')[0])
  | where Message =~ "RetrieveMultiple"
  | extend numQueryCount = todouble(QueryResults)
  | extend QueryCount = iif(QueryResults contains ",", todouble(countof(tostring(QueryResults), ',') + 1), numQueryCount)
  | extend QueryCount = iif(isnotempty(QueryCount), QueryCount, double(1))
  | summarize sum(QueryCount) by UserId
  | extend CurrentExportRate = sum_QueryCount) on UserId
  | where CurrentExportRate > HistoricalBaseline
  | project UserId, HistoricalBaseline, CurrentExportRate
  | join kind=inner(Dynamics365Activity
  | where TimeGenerated > ago(detection_time)
  | extend Message = tostring(split(OriginalObjectId, ' ')[0])
  | where Message =~ "RetrieveMultiple"
  | extend numQueryCount = todouble(QueryResults)
  | extend QueryCount = iif(QueryResults contains ",", todouble(countof(tostring(QueryResults), ',') + 1), numQueryCount)
  | extend QueryCount = iif(isnotempty(QueryCount), QueryCount, double(1))) on UserId
  | project TimeGenerated, UserId, QueryCount, UserAgent, Message, ClientIP, HistoricalBaseline, CurrentExportRate, CorrelationId, CrmOrganizationUniqueName, Query
  | summarize QuerySizes = make_set(QueryCount), MostRecentQuery = max(TimeGenerated), IPs = make_set(ClientIP), UserAgents = make_set(UserAgent), make_set(Query) by UserId, CrmOrganizationUniqueName, HistoricalBaseline, CurrentExportRate
  | extend timestamp = MostRecentQuery, AccountCustomEntity = UserId  
queryFrequency: 1d
requiredDataConnectors:
- connectorId: Dynamics365
  dataTypes:
  - Dynamics365Activity
id: 93a25f10-593d-4c57-a752-a8a75f031425
version: 1.0.1
name: Dynamics 365 - User Bulk Retrieval Outside Normal Activity
kind: Scheduled
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/Dynamics365Activity/UserBulkRetreivalOutsideNormalActivity.yaml
queryPeriod: 14d
relevantTechniques:
- T1530
triggerOperator: gt
tactics:
- Collection
description: |
    'This query detects users retrieving significantly more records from Dynamics 365 than they have in the past 2 weeks. This could indicate potentially unauthorized access to data within Dynamics 365.'
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/93a25f10-593d-4c57-a752-a8a75f031425')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/93a25f10-593d-4c57-a752-a8a75f031425')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01",
      "properties": {
        "displayName": "Dynamics 365 - User Bulk Retrieval Outside Normal Activity",
        "description": "'This query detects users retrieving significantly more records from Dynamics 365 than they have in the past 2 weeks. This could indicate potentially unauthorized access to data within Dynamics 365.'\n",
        "severity": "Medium",
        "enabled": true,
        "query": "let baseline_time = 14d;\nlet detection_time = 1d;\nDynamics365Activity\n| where TimeGenerated between(ago(baseline_time)..ago(detection_time-1d))\n| extend Message = tostring(split(OriginalObjectId, ' ')[0])\n| where Message =~ \"RetrieveMultiple\"\n| extend numQueryCount = todouble(QueryResults)\n| extend QueryCount = iif(QueryResults contains \",\", todouble(countof(tostring(QueryResults), ',') + 1), numQueryCount)\n| extend QueryCount = iif(isnotempty(QueryCount), QueryCount, double(1))\n| summarize sum(QueryCount) by UserId\n| extend HistoricalBaseline = sum_QueryCount\n| join (Dynamics365Activity\n| where TimeGenerated > ago(detection_time)\n| extend Message = tostring(split(OriginalObjectId, ' ')[0])\n| where Message =~ \"RetrieveMultiple\"\n| extend numQueryCount = todouble(QueryResults)\n| extend QueryCount = iif(QueryResults contains \",\", todouble(countof(tostring(QueryResults), ',') + 1), numQueryCount)\n| extend QueryCount = iif(isnotempty(QueryCount), QueryCount, double(1))\n| summarize sum(QueryCount) by UserId\n| extend CurrentExportRate = sum_QueryCount) on UserId\n| where CurrentExportRate > HistoricalBaseline\n| project UserId, HistoricalBaseline, CurrentExportRate\n| join kind=inner(Dynamics365Activity\n| where TimeGenerated > ago(detection_time)\n| extend Message = tostring(split(OriginalObjectId, ' ')[0])\n| where Message =~ \"RetrieveMultiple\"\n| extend numQueryCount = todouble(QueryResults)\n| extend QueryCount = iif(QueryResults contains \",\", todouble(countof(tostring(QueryResults), ',') + 1), numQueryCount)\n| extend QueryCount = iif(isnotempty(QueryCount), QueryCount, double(1))) on UserId\n| project TimeGenerated, UserId, QueryCount, UserAgent, Message, ClientIP, HistoricalBaseline, CurrentExportRate, CorrelationId, CrmOrganizationUniqueName, Query\n| summarize QuerySizes = make_set(QueryCount), MostRecentQuery = max(TimeGenerated), IPs = make_set(ClientIP), UserAgents = make_set(UserAgent), make_set(Query) by UserId, CrmOrganizationUniqueName, HistoricalBaseline, CurrentExportRate\n| extend timestamp = MostRecentQuery, AccountCustomEntity = UserId\n",
        "queryFrequency": "P1D",
        "queryPeriod": "P14D",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Collection"
        ],
        "techniques": [
          "T1530"
        ],
        "alertRuleTemplateName": "93a25f10-593d-4c57-a752-a8a75f031425",
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "FullName"
              }
            ],
            "entityType": "Account"
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Detections/Dynamics365Activity/UserBulkRetreivalOutsideNormalActivity.yaml",
        "status": "Available",
        "templateVersion": "1.0.1"
      }
    }
  ]
}