let threshold = 1;
TMApexOneEvent
| where EventMessage has "Device access"
| extend DeviceCustomNumber3 = coalesce(
column_ifexists("FieldDeviceCustomNumber3", long(null)),
DeviceCustomNumber3,
long(null)
)
| extend Permission = case(
DeviceCustomNumber3 == "0", "Modify",
DeviceCustomNumber3 == "1", "Read and execute",
DeviceCustomNumber3 == "2", "Read",
DeviceCustomNumber3 == "3", "List device content only",
DeviceCustomNumber3 == "4", "Block",
"unknown"
)
| summarize Permissions = make_set(Permission) by DstUserName
| extend PermissionCount = array_length(Permissions)
| where PermissionCount > threshold
| extend AccountCustomEntity = DstUserName
id: b463b952-67b8-11ec-90d6-0242ac120003
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneDvcAccessPermissionWasChanged.yaml
queryPeriod: 1h
status: Available
name: ApexOne - Device access permissions was changed
triggerThreshold: 0
relevantTechniques:
- T1078
kind: Scheduled
requiredDataConnectors:
- connectorId: CefAma
dataTypes:
- CommonSecurityLog
severity: Medium
query: |
let threshold = 1;
TMApexOneEvent
| where EventMessage has "Device access"
| extend DeviceCustomNumber3 = coalesce(
column_ifexists("FieldDeviceCustomNumber3", long(null)),
DeviceCustomNumber3,
long(null)
)
| extend Permission = case(
DeviceCustomNumber3 == "0", "Modify",
DeviceCustomNumber3 == "1", "Read and execute",
DeviceCustomNumber3 == "2", "Read",
DeviceCustomNumber3 == "3", "List device content only",
DeviceCustomNumber3 == "4", "Block",
"unknown"
)
| summarize Permissions = make_set(Permission) by DstUserName
| extend PermissionCount = array_length(Permissions)
| where PermissionCount > threshold
| extend AccountCustomEntity = DstUserName
entityMappings:
- fieldMappings:
- identifier: Name
columnName: AccountCustomEntity
entityType: Account
tactics:
- PrivilegeEscalation
version: 1.0.4
triggerOperator: gt
description: |
'Query shows device access permissions was changed.'
