Utimaco ESKM - Burst of KMIP DESTROY operations by a single user

Back


Id	9b1a3b3e-7e16-4a3b-8a8f-7f1f2b1c0a03
Rulename	Utimaco ESKM - Burst of KMIP DESTROY operations by a single user
Description	Identifies a single KMIP user issuing 20 or more DESTROY operations within 10 minutes on Utimaco ESKM. May indicate mass key/object deletion, insider sabotage, or ransomware-style cryptographic-material destruction.
Severity	High
Tactics	Impact
Techniques	T1485
Required data connectors	UtimacoESKMConnector
Kind	Scheduled
Query frequency	10m
Query period	10m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Utimaco Enterprise Secure Key Manager/Analytic Rules/UtimacoESKM_DestroyBurst.yaml
Version	1.0.0
Arm template	9b1a3b3e-7e16-4a3b-8a8f-7f1f2b1c0a03.json

KQL

UtimacoESKMKmipServerLogs_CL
| where TimeGenerated > ago(10m)
| where Operation == "DESTROY"
| where Result == "SUCCESS"
| where isnotempty(User)
| summarize DestroyCount = count(), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), ObjectTypes = make_set(ObjectType, 25), UUIDs = make_set(UUID, 100), SourceIPs = make_set(IP, 25) by User
| where DestroyCount >= 20
| extend AccountCustomEntity = User

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
tactics:
- Impact
requiredDataConnectors:
- dataTypes:
  - UtimacoESKMKmipServerLogs_CL
  connectorId: UtimacoESKMConnector
id: 9b1a3b3e-7e16-4a3b-8a8f-7f1f2b1c0a03
severity: High
status: Available
query: |
  UtimacoESKMKmipServerLogs_CL
  | where TimeGenerated > ago(10m)
  | where Operation == "DESTROY"
  | where Result == "SUCCESS"
  | where isnotempty(User)
  | summarize DestroyCount = count(), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), ObjectTypes = make_set(ObjectType, 25), UUIDs = make_set(UUID, 100), SourceIPs = make_set(IP, 25) by User
  | where DestroyCount >= 20
  | extend AccountCustomEntity = User  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Utimaco Enterprise Secure Key Manager/Analytic Rules/UtimacoESKM_DestroyBurst.yaml
kind: Scheduled
queryPeriod: 10m
version: 1.0.0
name: Utimaco ESKM - Burst of KMIP DESTROY operations by a single user
queryFrequency: 10m
triggerThreshold: 0
relevantTechniques:
- T1485
description: |
    Identifies a single KMIP user issuing 20 or more DESTROY operations within 10 minutes on Utimaco ESKM. May indicate mass key/object deletion, insider sabotage, or ransomware-style cryptographic-material destruction.
triggerOperator: gt

ARM