Uniqkey - Data export activity | Microsoft Sentinel Analytic Rules

Back


Id	f3125212-6871-4adc-8335-98c9a920639b
Rulename	Uniqkey - Data export activity
Description	Detects export of credential or vault data from the Uniqkey organization. Exports are legitimate for backup and migration scenarios, but they move secrets outside the platform’s protection and are the primary exfiltration vector for a password manager, so each occurrence is raised as its own alert for review. If scheduled exports by known administrative or service accounts create noise, exclude those actors in the query.
Severity	Medium
Tactics	CredentialAccess Exfiltration
Techniques	T1555
Required data connectors	UniqkeyEventsConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Uniqkey/Analytic%20Rules/Uniqkey%20-%20Data%20export%20activity.yaml
Version	1.0.0
Arm template	f3125212-6871-4adc-8335-98c9a920639b.json

KQL

UniqkeyEvents_CL
| where Category == "data_export"
| project TimeGenerated, ActorEmail, ActorType, Action, ActionId, TargetType, TargetName, ClientSystem, SrcIpAddr

YAML

tactics:
- CredentialAccess
- Exfiltration
name: Uniqkey - Data export activity
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Uniqkey/Analytic%20Rules/Uniqkey%20-%20Data%20export%20activity.yaml
version: 1.0.0
queryFrequency: 1h
requiredDataConnectors:
- connectorId: UniqkeyEventsConnector
  dataTypes:
  - UniqkeyEvents_CL
id: f3125212-6871-4adc-8335-98c9a920639b
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: ActorEmail
  entityType: Account
- fieldMappings:
  - identifier: Address
    columnName: SrcIpAddr
  entityType: IP
queryPeriod: 1h
severity: Medium
relevantTechniques:
- T1555
eventGroupingSettings:
  aggregationKind: AlertPerResult
suppressionEnabled: false
description: Detects export of credential or vault data from the Uniqkey organization. Exports are legitimate for backup and migration scenarios, but they move secrets outside the platform's protection and are the primary exfiltration vector for a password manager, so each occurrence is raised as its own alert for review. If scheduled exports by known administrative or service accounts create noise, exclude those actors in the query.
triggerOperator: gt
suppressionDuration: 5h
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    reopenClosedIncident: false
    enabled: true
    matchingMethod: AllEntities
    lookbackDuration: 5h
kind: Scheduled
query: |-
  UniqkeyEvents_CL
  | where Category == "data_export"
  | project TimeGenerated, ActorEmail, ActorType, Action, ActionId, TargetType, TargetName, ClientSystem, SrcIpAddr

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/f3125212-6871-4adc-8335-98c9a920639b')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/f3125212-6871-4adc-8335-98c9a920639b')]",
      "properties": {
        "alertRuleTemplateName": "f3125212-6871-4adc-8335-98c9a920639b",
        "customDetails": null,
        "description": "Detects export of credential or vault data from the Uniqkey organization. Exports are legitimate for backup and migration scenarios, but they move secrets outside the platform's protection and are the primary exfiltration vector for a password manager, so each occurrence is raised as its own alert for review. If scheduled exports by known administrative or service accounts create noise, exclude those actors in the query.",
        "displayName": "Uniqkey - Data export activity",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "ActorEmail",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SrcIpAddr",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Uniqkey/Analytic%20Rules/Uniqkey%20-%20Data%20export%20activity.yaml",
        "query": "UniqkeyEvents_CL\n| where Category == \"data_export\"\n| project TimeGenerated, ActorEmail, ActorType, Action, ActionId, TargetType, TargetName, ClientSystem, SrcIpAddr",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "Exfiltration"
        ],
        "techniques": [
          "T1555"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}