Uniqkey - Data export activity | Microsoft Sentinel Analytic Rules

Back


Id	f3125212-6871-4adc-8335-98c9a920639b
Rulename	Uniqkey - Data export activity
Description	Detects export of credential or vault data from the Uniqkey organization. Exports are legitimate for backup and migration scenarios, but they move secrets outside the platform’s protection and are the primary exfiltration vector for a password manager, so each occurrence is raised as its own alert for review. If scheduled exports by known administrative or service accounts create noise, exclude those actors in the query.
Severity	Medium
Tactics	CredentialAccess Exfiltration
Techniques	T1555
Required data connectors	UniqkeyEventsConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Uniqkey/Analytic%20Rules/Uniqkey%20-%20Data%20export%20activity.yaml
Version	1.0.0
Arm template	f3125212-6871-4adc-8335-98c9a920639b.json

KQL

UniqkeyEvents_CL
| where Category == "data_export"
| project TimeGenerated, ActorEmail, ActorType, Action, ActionId, TargetType, TargetName, ClientSystem, SrcIpAddr

YAML

incidentConfiguration:
  groupingConfiguration:
    matchingMethod: AllEntities
    enabled: true
    lookbackDuration: 5h
    reopenClosedIncident: false
  createIncident: true
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Uniqkey/Analytic%20Rules/Uniqkey%20-%20Data%20export%20activity.yaml
triggerThreshold: 0
id: f3125212-6871-4adc-8335-98c9a920639b
suppressionEnabled: false
kind: Scheduled
queryPeriod: 1h
eventGroupingSettings:
  aggregationKind: AlertPerResult
tactics:
- CredentialAccess
- Exfiltration
queryFrequency: 1h
severity: Medium
name: Uniqkey - Data export activity
requiredDataConnectors:
- connectorId: UniqkeyEventsConnector
  dataTypes:
  - UniqkeyEvents_CL
version: 1.0.0
relevantTechniques:
- T1555
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: ActorEmail
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SrcIpAddr
query: |-
  UniqkeyEvents_CL
  | where Category == "data_export"
  | project TimeGenerated, ActorEmail, ActorType, Action, ActionId, TargetType, TargetName, ClientSystem, SrcIpAddr
suppressionDuration: 5h
description: Detects export of credential or vault data from the Uniqkey organization. Exports are legitimate for backup and migration scenarios, but they move secrets outside the platform's protection and are the primary exfiltration vector for a password manager, so each occurrence is raised as its own alert for review. If scheduled exports by known administrative or service accounts create noise, exclude those actors in the query.

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/f3125212-6871-4adc-8335-98c9a920639b')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/f3125212-6871-4adc-8335-98c9a920639b')]",
      "properties": {
        "alertRuleTemplateName": "f3125212-6871-4adc-8335-98c9a920639b",
        "customDetails": null,
        "description": "Detects export of credential or vault data from the Uniqkey organization. Exports are legitimate for backup and migration scenarios, but they move secrets outside the platform's protection and are the primary exfiltration vector for a password manager, so each occurrence is raised as its own alert for review. If scheduled exports by known administrative or service accounts create noise, exclude those actors in the query.",
        "displayName": "Uniqkey - Data export activity",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "ActorEmail",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SrcIpAddr",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Uniqkey/Analytic%20Rules/Uniqkey%20-%20Data%20export%20activity.yaml",
        "query": "UniqkeyEvents_CL\n| where Category == \"data_export\"\n| project TimeGenerated, ActorEmail, ActorType, Action, ActionId, TargetType, TargetName, ClientSystem, SrcIpAddr",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "Exfiltration"
        ],
        "techniques": [
          "T1555"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}