SlackAudit - User login after deactivated

let lbperiod_max_d = 14d;
let lbperiod_min_d = 1d;
let lb_time_max_h = 24h;
SlackAudit
| where TimeGenerated between (ago(lbperiod_max_d) .. (lbperiod_min_d))
| where Action =~ 'user_deactivated'
| summarize deactivation_time = max(TimeGenerated) by EntityUserEmail, EntityUserId
| project deactivation_time, EntityUserEmail, EntityUserId
| join (SlackAudit
      | where TimeGenerated > ago(lb_time_max_h)
      | where Action =~ 'user_login'
      | summarize new_login_time = max(TimeGenerated) by SrcUserEmail, SrcUserIdentity
      | project new_login_time, SrcUserEmail, EntityUserId = SrcUserIdentity) on EntityUserId
| where EntityUserEmail == SrcUserEmail
| where deactivation_time < new_login_time
| extend AccountCustomEntity = SrcUserEmail

entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
query: |
  let lbperiod_max_d = 14d;
  let lbperiod_min_d = 1d;
  let lb_time_max_h = 24h;
  SlackAudit
  | where TimeGenerated between (ago(lbperiod_max_d) .. (lbperiod_min_d))
  | where Action =~ 'user_deactivated'
  | summarize deactivation_time = max(TimeGenerated) by EntityUserEmail, EntityUserId
  | project deactivation_time, EntityUserEmail, EntityUserId
  | join (SlackAudit
        | where TimeGenerated > ago(lb_time_max_h)
        | where Action =~ 'user_login'
        | summarize new_login_time = max(TimeGenerated) by SrcUserEmail, SrcUserIdentity
        | project new_login_time, SrcUserEmail, EntityUserId = SrcUserIdentity) on EntityUserId
  | where EntityUserEmail == SrcUserEmail
  | where deactivation_time < new_login_time
  | extend AccountCustomEntity = SrcUserEmail
id: e6e99dcb-4dff-48d2-8012-206ca166b36b
queryFrequency: 1h
alertDetailsOverride:
  alertDisplayNameFormat: 'Slack user login after deactivation: {{AccountCustomEntity}}'
  alertDescriptionFormat: User {{AccountCustomEntity}} logged in after deactivation; review deactivation_time {{deactivation_time}} and new_login_time {{new_login_time}}.
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SlackAudit/Analytic%20Rules/SlackAuditUserLoginAfterDeactivated.yaml
version: 1.0.1
severity: Medium
relevantTechniques:
- T1078
- T1078.004
name: SlackAudit - User login after deactivated.
kind: Scheduled
tactics:
- InitialAccess
- Persistence
- PrivilegeEscalation
requiredDataConnectors:
- dataTypes:
  - SlackAudit_CL
  connectorId: SlackAuditAPI
description: |
  'Detects when a Slack user account was deactivated and the same user identity later authenticated again within
  the detection window, which may indicate account reactivation, unauthorized access, or use of a deactivated account. Analyst
  triage should review the deactivation time, subsequent login time, EntityUserEmail, and EntityUserId to determine whether
  the login was expected. This rule uses the SlackAuditAPI connector and SlackAudit_CL data type.'
customDetails:
  NewLoginTime: new_login_time
  SlackUserEmail: EntityUserEmail
  DeactivationTime: deactivation_time
  SlackUserId: EntityUserId
triggerOperator: gt
triggerThreshold: 0
queryPeriod: 14d

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/e6e99dcb-4dff-48d2-8012-206ca166b36b')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/e6e99dcb-4dff-48d2-8012-206ca166b36b')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "User {{AccountCustomEntity}} logged in after deactivation; review deactivation_time {{deactivation_time}} and new_login_time {{new_login_time}}.",
          "alertDisplayNameFormat": "Slack user login after deactivation: {{AccountCustomEntity}}"
        },
        "alertRuleTemplateName": "e6e99dcb-4dff-48d2-8012-206ca166b36b",
        "customDetails": {
          "DeactivationTime": "deactivation_time",
          "NewLoginTime": "new_login_time",
          "SlackUserEmail": "EntityUserEmail",
          "SlackUserId": "EntityUserId"
        },
        "description": "'Detects when a Slack user account was deactivated and the same user identity later authenticated again within\nthe detection window, which may indicate account reactivation, unauthorized access, or use of a deactivated account. Analyst\ntriage should review the deactivation time, subsequent login time, EntityUserEmail, and EntityUserId to determine whether\nthe login was expected. This rule uses the SlackAuditAPI connector and SlackAudit_CL data type.'\n",
        "displayName": "SlackAudit - User login after deactivated.",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "FullName"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SlackAudit/Analytic%20Rules/SlackAuditUserLoginAfterDeactivated.yaml",
        "query": "let lbperiod_max_d = 14d;\nlet lbperiod_min_d = 1d;\nlet lb_time_max_h = 24h;\nSlackAudit\n| where TimeGenerated between (ago(lbperiod_max_d) .. (lbperiod_min_d))\n| where Action =~ 'user_deactivated'\n| summarize deactivation_time = max(TimeGenerated) by EntityUserEmail, EntityUserId\n| project deactivation_time, EntityUserEmail, EntityUserId\n| join (SlackAudit\n      | where TimeGenerated > ago(lb_time_max_h)\n      | where Action =~ 'user_login'\n      | summarize new_login_time = max(TimeGenerated) by SrcUserEmail, SrcUserIdentity\n      | project new_login_time, SrcUserEmail, EntityUserId = SrcUserIdentity) on EntityUserId\n| where EntityUserEmail == SrcUserEmail\n| where deactivation_time < new_login_time\n| extend AccountCustomEntity = SrcUserEmail\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P14D",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [
          "T1078.004"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess",
          "Persistence",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1078"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}