GWorkspace - Unexpected OS update

Back


Id	c02b0c8e-5da6-11ec-bf63-0242ac130002
Rulename	GWorkspace - Unexpected OS update
Description	Detects unexpected OS update.
Severity	Medium
Tactics	DefenseEvasion Persistence
Techniques	T1036 T1554
Required data connectors	GoogleWorkspaceReportsAPI
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleWorkspaceReports/Analytic Rules/GWorkspaceUnexpectedOSUpdate.yaml
Version	1.0.2
Arm template	c02b0c8e-5da6-11ec-bf63-0242ac130002.json

KQL

GWorkspaceActivityReports
| where EventMessage has "os_updated"
| where isnotempty(NeqValue) and isnotempty(OldValue)
| extend NewVersion1 = extract(@'([0-9]+)\.([0-9]+)\.?([0-9])?', 1, NeqValue)
| extend NewVersion2 = extract(@'([0-9]+)\.([0-9]+)\.?([0-9])?', 2, NeqValue)
| extend NewVersion3 = extract(@'([0-9]+)\.([0-9]+)\.?([0-9])?', 3, NeqValue)
| extend OldVersion1 = extract(@'([0-9]+)\.([0-9]+)\.?([0-9])?', 1, OldValue)
| extend OldVersion2 = extract(@'([0-9]+)\.([0-9]+)\.?([0-9])?', 2, OldValue)
| extend OldVersion3 = extract(@'([0-9]+)\.([0-9]+)\.?([0-9])?', 3, OldValue)
| extend NewVersion3Comparision = iff(isempty(NewVersion3), 0, tolong(NewVersion3))
| extend OldVersion3Comparision = iff(isempty(OldVersion3), 0, tolong(OldVersion3))
| extend Comparision1 = iff(tolong(NewVersion3Comparision) > tolong(OldVersion3Comparision), 'Expected version', 'Unexpected version')
| extend Comparision2 = iff(tolong(NewVersion2) > tolong(OldVersion2), 'Expected version', Comparision1)
| extend VersionCheck = iff(tolong(NewVersion1) > tolong(OldVersion1), 'Expected version', Comparision2)
| project-away NewVersion1, NewVersion2, NewVersion3, NewVersion3Comparision, OldVersion1, OldVersion2, OldVersion3, OldVersion3Comparision, Comparision1, Comparision2
| extend AccountCustomEntity = ActorEmail

YAML

description: |
    'Detects unexpected OS update.'
kind: Scheduled
tactics:
- DefenseEvasion
- Persistence
requiredDataConnectors:
- connectorId: GoogleWorkspaceReportsAPI
  dataTypes:
  - GWorkspaceActivityReports
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleWorkspaceReports/Analytic Rules/GWorkspaceUnexpectedOSUpdate.yaml
severity: Medium
name: GWorkspace - Unexpected OS update
triggerThreshold: 0
queryPeriod: 1h
query: |
  GWorkspaceActivityReports
  | where EventMessage has "os_updated"
  | where isnotempty(NeqValue) and isnotempty(OldValue)
  | extend NewVersion1 = extract(@'([0-9]+)\.([0-9]+)\.?([0-9])?', 1, NeqValue)
  | extend NewVersion2 = extract(@'([0-9]+)\.([0-9]+)\.?([0-9])?', 2, NeqValue)
  | extend NewVersion3 = extract(@'([0-9]+)\.([0-9]+)\.?([0-9])?', 3, NeqValue)
  | extend OldVersion1 = extract(@'([0-9]+)\.([0-9]+)\.?([0-9])?', 1, OldValue)
  | extend OldVersion2 = extract(@'([0-9]+)\.([0-9]+)\.?([0-9])?', 2, OldValue)
  | extend OldVersion3 = extract(@'([0-9]+)\.([0-9]+)\.?([0-9])?', 3, OldValue)
  | extend NewVersion3Comparision = iff(isempty(NewVersion3), 0, tolong(NewVersion3))
  | extend OldVersion3Comparision = iff(isempty(OldVersion3), 0, tolong(OldVersion3))
  | extend Comparision1 = iff(tolong(NewVersion3Comparision) > tolong(OldVersion3Comparision), 'Expected version', 'Unexpected version')
  | extend Comparision2 = iff(tolong(NewVersion2) > tolong(OldVersion2), 'Expected version', Comparision1)
  | extend VersionCheck = iff(tolong(NewVersion1) > tolong(OldVersion1), 'Expected version', Comparision2)
  | project-away NewVersion1, NewVersion2, NewVersion3, NewVersion3Comparision, OldVersion1, OldVersion2, OldVersion3, OldVersion3Comparision, Comparision1, Comparision2
  | extend AccountCustomEntity = ActorEmail  
relevantTechniques:
- T1036
- T1554
id: c02b0c8e-5da6-11ec-bf63-0242ac130002
queryFrequency: 1h
status: Available
triggerOperator: gt
version: 1.0.2
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountCustomEntity
    identifier: Name

ARM