NordPass - User deletes items in bulk

Back


Id	f72f630f-c890-49fe-b747-80f4fb3b6348
Rulename	NordPass - User deletes items in bulk
Description	This will alert you if a user deletes items in bulk, namely, more than 10 items or in the span of 10 minutes. If a mix of bulk and one-off deletions were performed, this will group all actions and report the total number of items deleted.
Severity	High
Tactics	Impact Collection
Techniques	T1485 T1074
Required data connectors	NordPass
Kind	Scheduled
Query frequency	5m
Query period	10m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_items_bulk_delete.yaml
Version	1.0.0
Arm template	f72f630f-c890-49fe-b747-80f4fb3b6348.json

KQL

NordPassEventLogs_CL
| where action == "items_deleted" and event_type == "item_delete"
| extend item_count = array_length(todynamic(metadata).items)
| summarize total_items = sum(item_count) by user_email
| where total_items >= 10

YAML

query: |
  NordPassEventLogs_CL
  | where action == "items_deleted" and event_type == "item_delete"
  | extend item_count = array_length(todynamic(metadata).items)
  | summarize total_items = sum(item_count) by user_email
  | where total_items >= 10  
queryFrequency: 5m
queryPeriod: 10m
displayName: User deletes items in bulk
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_items_bulk_delete.yaml
description: |
  This will alert you if a user deletes items in bulk, namely, more than 10 items or in the span of 10 minutes. 
  If a mix of bulk and one-off deletions were performed, this will group all actions and report the total number of items deleted.  
tactics:
- Impact
- Collection
triggerThreshold: 0
entityMappings:
- entityType: Mailbox
  fieldMappings:
  - identifier: MailboxPrimaryAddress
    columnName: user_email
id: f72f630f-c890-49fe-b747-80f4fb3b6348
requiredDataConnectors:
- connectorId: NordPass
  dataTypes:
  - NordPassEventLogs_CL
kind: Scheduled
relevantTechniques:
- T1485
- T1074
customDetails:
  ItemCount: total_items
  User: user_email
version: 1.0.0
incidentConfiguration:
  createIncident: false
name: NordPass - User deletes items in bulk
triggerOperator: gt
severity: High

ARM