SlackAudit - User login after deactivated

Back


Id	e6e99dcb-4dff-48d2-8012-206ca166b36b
Rulename	SlackAudit - User login after deactivated.
Description	Detects when a Slack user account was deactivated and the same user identity later authenticated again within the detection window, which may indicate account reactivation, unauthorized access, or use of a deactivated account. Analyst triage should review the deactivation time, subsequent login time, EntityUserEmail, and EntityUserId to determine whether the login was expected. This rule uses the SlackAuditAPI connector and SlackAudit_CL data type.
Severity	Medium
Tactics	InitialAccess Persistence PrivilegeEscalation
Techniques	T1078 T1078.004
Required data connectors	SlackAuditAPI
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SlackAudit/Analytic Rules/SlackAuditUserLoginAfterDeactivated.yaml
Version	1.0.1
Arm template	e6e99dcb-4dff-48d2-8012-206ca166b36b.json

KQL

let lbperiod_max_d = 14d;
let lbperiod_min_d = 1d;
let lb_time_max_h = 24h;
SlackAudit
| where TimeGenerated between (ago(lbperiod_max_d) .. (lbperiod_min_d))
| where Action =~ 'user_deactivated'
| summarize deactivation_time = max(TimeGenerated) by EntityUserEmail, EntityUserId
| project deactivation_time, EntityUserEmail, EntityUserId
| join (SlackAudit
      | where TimeGenerated > ago(lb_time_max_h)
      | where Action =~ 'user_login'
      | summarize new_login_time = max(TimeGenerated) by SrcUserEmail, SrcUserIdentity
      | project new_login_time, SrcUserEmail, EntityUserId = SrcUserIdentity) on EntityUserId
| where EntityUserEmail == SrcUserEmail
| where deactivation_time < new_login_time
| extend AccountCustomEntity = SrcUserEmail

YAML

status: Available
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
query: |
  let lbperiod_max_d = 14d;
  let lbperiod_min_d = 1d;
  let lb_time_max_h = 24h;
  SlackAudit
  | where TimeGenerated between (ago(lbperiod_max_d) .. (lbperiod_min_d))
  | where Action =~ 'user_deactivated'
  | summarize deactivation_time = max(TimeGenerated) by EntityUserEmail, EntityUserId
  | project deactivation_time, EntityUserEmail, EntityUserId
  | join (SlackAudit
        | where TimeGenerated > ago(lb_time_max_h)
        | where Action =~ 'user_login'
        | summarize new_login_time = max(TimeGenerated) by SrcUserEmail, SrcUserIdentity
        | project new_login_time, SrcUserEmail, EntityUserId = SrcUserIdentity) on EntityUserId
  | where EntityUserEmail == SrcUserEmail
  | where deactivation_time < new_login_time
  | extend AccountCustomEntity = SrcUserEmail  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SlackAudit/Analytic Rules/SlackAuditUserLoginAfterDeactivated.yaml
tactics:
- InitialAccess
- Persistence
- PrivilegeEscalation
triggerThreshold: 0
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
requiredDataConnectors:
- connectorId: SlackAuditAPI
  dataTypes:
  - SlackAudit_CL
alertDetailsOverride:
  alertDescriptionFormat: User {{AccountCustomEntity}} logged in after deactivation; review deactivation_time {{deactivation_time}} and new_login_time {{new_login_time}}.
  alertDisplayNameFormat: 'Slack user login after deactivation: {{AccountCustomEntity}}'
relevantTechniques:
- T1078
- T1078.004
customDetails:
  SlackUserEmail: EntityUserEmail
  DeactivationTime: deactivation_time
  SlackUserId: EntityUserId
  NewLoginTime: new_login_time
description: |
  'Detects when a Slack user account was deactivated and the same user identity later authenticated again within
  the detection window, which may indicate account reactivation, unauthorized access, or use of a deactivated account. Analyst
  triage should review the deactivation time, subsequent login time, EntityUserEmail, and EntityUserId to determine whether
  the login was expected. This rule uses the SlackAuditAPI connector and SlackAudit_CL data type.'  
name: SlackAudit - User login after deactivated.
version: 1.0.1
kind: Scheduled
id: e6e99dcb-4dff-48d2-8012-206ca166b36b
severity: Medium

ARM