Box - Inactive user login

Back


Id	edbf38d7-e170-4af2-ad50-1a05b374611b
Rulename	Box - Inactive user login
Description	Detects user login after long inactivity period.
Severity	Medium
Tactics	InitialAccess
Techniques	T1078
Required data connectors	BoxDataConnector
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Box/Analytic Rules/BoxInactiveUserLogin.yaml
Version	1.0.1
Arm template	edbf38d7-e170-4af2-ad50-1a05b374611b.json

KQL

let lbperiod_start = 14d;
let lbperiod_end = 7d;
let lbtime = 1h;
let active_users = BoxEvents
| where EventEndTime between (ago(lbperiod_end) .. ago(lbtime))
| where EventType =~ 'LOGIN'
| summarize makeset(SourceName);
let inactive_users = BoxEvents
| where EventEndTime between (ago(lbperiod_start) .. ago(lbperiod_end))
| where EventType =~ 'LOGIN'
| where SourceName !in (active_users)
| summarize makeset(SourceName);
BoxEvents
| where EventType == 'LOGIN'
| where SourceName in (inactive_users)
| extend AccountCustomEntity = SourceName

YAML

relevantTechniques:
- T1078
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
  entityType: Account
triggerThreshold: 0
description: |
    'Detects user login after long inactivity period.'
requiredDataConnectors:
- connectorId: BoxDataConnector
  dataTypes:
  - BoxEvents_CL
triggerOperator: gt
version: 1.0.1
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Box/Analytic Rules/BoxInactiveUserLogin.yaml
id: edbf38d7-e170-4af2-ad50-1a05b374611b
queryFrequency: 1h
query: |
  let lbperiod_start = 14d;
  let lbperiod_end = 7d;
  let lbtime = 1h;
  let active_users = BoxEvents
  | where EventEndTime between (ago(lbperiod_end) .. ago(lbtime))
  | where EventType =~ 'LOGIN'
  | summarize makeset(SourceName);
  let inactive_users = BoxEvents
  | where EventEndTime between (ago(lbperiod_start) .. ago(lbperiod_end))
  | where EventType =~ 'LOGIN'
  | where SourceName !in (active_users)
  | summarize makeset(SourceName);
  BoxEvents
  | where EventType == 'LOGIN'
  | where SourceName in (inactive_users)
  | extend AccountCustomEntity = SourceName  
severity: Medium
status: Available
queryPeriod: 14d
name: Box - Inactive user login
tactics:
- InitialAccess
kind: Scheduled

ARM