Box - User logged in as admin

Back


Id	b2197d7f-4731-483c-89de-d48606b872da
Rulename	Box - User logged in as admin
Description	Detects when user logged in as admin.
Severity	Medium
Tactics	PrivilegeEscalation
Techniques	T1078
Required data connectors	BoxDataConnector
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Box/Analytic Rules/BoxUserLoginAsAdmin.yaml
Version	1.0.1
Arm template	b2197d7f-4731-483c-89de-d48606b872da.json

KQL

let lbperiod_start = 14d;
let lbperiod_end = 1d;
let admins = BoxEvents
| where EventEndTime between (ago(lbperiod_start) .. ago(lbperiod_end))
| where EventType =~ 'ADMIN_LOGIN'
| summarize makeset(SourceLogin);
BoxEvents
| where EventType =~ 'ADMIN_LOGIN'
| where SourceLogin !in (admins)
| extend AccountCustomEntity = SourceLogin
| extend IPCustomEntity = SrcIpAddr

YAML

id: b2197d7f-4731-483c-89de-d48606b872da
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Box/Analytic Rules/BoxUserLoginAsAdmin.yaml
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
  entityType: Account
- fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
  entityType: IP
requiredDataConnectors:
- dataTypes:
  - BoxEvents_CL
  connectorId: BoxDataConnector
queryFrequency: 1h
queryPeriod: 14d
status: Available
query: |
  let lbperiod_start = 14d;
  let lbperiod_end = 1d;
  let admins = BoxEvents
  | where EventEndTime between (ago(lbperiod_start) .. ago(lbperiod_end))
  | where EventType =~ 'ADMIN_LOGIN'
  | summarize makeset(SourceLogin);
  BoxEvents
  | where EventType =~ 'ADMIN_LOGIN'
  | where SourceLogin !in (admins)
  | extend AccountCustomEntity = SourceLogin
  | extend IPCustomEntity = SrcIpAddr  
name: Box - User logged in as admin
kind: Scheduled
tactics:
- PrivilegeEscalation
severity: Medium
relevantTechniques:
- T1078
triggerThreshold: 0
version: 1.0.1
description: |
    'Detects when user logged in as admin.'

ARM