Third party integrated apps

Back


Id	BFA7EE22-B5A9-42C8-BD50-2E95885640BB
Rulename	Third party integrated apps
Description	This query searches for your services by regulating the access of third-party integrated apps. Only allow access to necessary apps that support robust security controls. Third-party applications are not created by Microsoft, so there is a possibility they could be used for malicious purposes like exfiltrating data from your tenancy. Attackers can maintain persistent access to your services through these integrated apps, without relying on compromised accounts.
Severity	High
Tactics	Exfiltration
Techniques	T1020
Required data connectors	SenservaPro
Kind	Scheduled
Query frequency	6h
Query period	6h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/ThirdPartyIntegratedApps.yaml
Version	1.0.1
Arm template	BFA7EE22-B5A9-42C8-BD50-2E95885640BB.json

KQL

SenservaPro_CL
| where ControlName_s == 'AzureSecureScoreIntegratedApps'

YAML

name: Third party integrated apps
kind: Scheduled
tactics:
- Exfiltration
triggerThreshold: 0
triggerOperator: gt
version: 1.0.1
status: Available
queryFrequency: 6h
id: BFA7EE22-B5A9-42C8-BD50-2E95885640BB
requiredDataConnectors:
- connectorId: SenservaPro
  dataTypes:
  - SenservaPro_CL
relevantTechniques:
- T1020
description: |
  'This query searches for your services by regulating the access of third-party integrated apps. 
   Only allow access to necessary apps that support robust security controls. 
   Third-party applications are not created by Microsoft, so there is a possibility they could be used for malicious purposes like exfiltrating data from your tenancy.
   Attackers can maintain persistent access to your services through these integrated apps, without relying on compromised accounts.'  
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: ControlName_s
    identifier: Name
  - columnName: TenantId
    identifier: AadTenantId
  - columnName: TenantDisplayName_s
    identifier: DisplayName
- entityType: SecurityGroup
  fieldMappings:
  - columnName: Group_s
    identifier: DistinguishedName
- entityType: AzureResource
  fieldMappings:
  - columnName: SourceSystem
    identifier: ResourceId
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/ThirdPartyIntegratedApps.yaml
queryPeriod: 6h
severity: High
query: |
  SenservaPro_CL
  | where ControlName_s == 'AzureSecureScoreIntegratedApps'

ARM