Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

NordPass - Vault export

Back
Idc7f14b43-7625-4516-b137-30b7fda65bcf
RulenameNordPass - Vault export
DescriptionThis will alert you if the vault has been exported, allowing you to review and evaluate the incident to mitigate potential risks.

NOTE: The organization can control whether it allows its members to export the vault, although we recommend that it always be disabled.
SeverityHigh
TacticsExfiltration
TechniquesT1020
Required data connectorsNordPass
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_vault_exported.yaml
Version1.0.0
Arm templatec7f14b43-7625-4516-b137-30b7fda65bcf.json
Deploy To Azure
NordPassEventLogs_CL
| where event_type == "item_access"
| where action == "vault_exported"
| extend TargetEmail = user_email
description: |
  This will alert you if the vault has been exported, allowing you to review and evaluate the incident to mitigate potential risks.
  NOTE: The organization can control whether it allows its members to export the vault, although we recommend that it always be disabled.  
queryPeriod: 5m
name: NordPass - Vault export
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_vault_exported.yaml
id: c7f14b43-7625-4516-b137-30b7fda65bcf
kind: Scheduled
requiredDataConnectors:
- connectorId: NordPass
  dataTypes:
  - NordPassEventLogs_CL
displayName: Vault export
tactics:
- Exfiltration
severity: High
triggerOperator: gt
version: 1.0.0
query: |
  NordPassEventLogs_CL
  | where event_type == "item_access"
  | where action == "vault_exported"
  | extend TargetEmail = user_email  
incidentConfiguration:
  createIncident: false
queryFrequency: 5m
triggerThreshold: 0
relevantTechniques:
- T1020
entityMappings:
- fieldMappings:
  - columnName: TargetEmail
    identifier: MailboxPrimaryAddress
  entityType: Mailbox
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/c7f14b43-7625-4516-b137-30b7fda65bcf')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/c7f14b43-7625-4516-b137-30b7fda65bcf')]",
      "properties": {
        "alertRuleTemplateName": "c7f14b43-7625-4516-b137-30b7fda65bcf",
        "customDetails": null,
        "description": "This will alert you if the vault has been exported, allowing you to review and evaluate the incident to mitigate potential risks.\nNOTE: The organization can control whether it allows its members to export the vault, although we recommend that it always be disabled.\n",
        "displayName": "NordPass - Vault export",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Mailbox",
            "fieldMappings": [
              {
                "columnName": "TargetEmail",
                "identifier": "MailboxPrimaryAddress"
              }
            ]
          }
        ],
        "incidentConfiguration": {
          "createIncident": false
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_vault_exported.yaml",
        "query": "NordPassEventLogs_CL\n| where event_type == \"item_access\"\n| where action == \"vault_exported\"\n| extend TargetEmail = user_email\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Exfiltration"
        ],
        "techniques": [
          "T1020"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}