NordPass - User deletes items in bulk

Back


Id	f72f630f-c890-49fe-b747-80f4fb3b6348
Rulename	NordPass - User deletes items in bulk
Description	This will alert you if a user deletes items in bulk, namely, more than 10 items or in the span of 10 minutes. If a mix of bulk and one-off deletions were performed, this will group all actions and report the total number of items deleted.
Severity	High
Tactics	Impact Collection
Techniques	T1485 T1074
Required data connectors	NordPass
Kind	Scheduled
Query frequency	5m
Query period	10m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_items_bulk_delete.yaml
Version	1.0.0
Arm template	f72f630f-c890-49fe-b747-80f4fb3b6348.json

KQL

NordPassEventLogs_CL
| where action == "items_deleted" and event_type == "item_delete"
| extend item_count = array_length(todynamic(metadata).items)
| summarize total_items = sum(item_count) by user_email
| where total_items >= 10

YAML

version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_items_bulk_delete.yaml
query: |
  NordPassEventLogs_CL
  | where action == "items_deleted" and event_type == "item_delete"
  | extend item_count = array_length(todynamic(metadata).items)
  | summarize total_items = sum(item_count) by user_email
  | where total_items >= 10  
requiredDataConnectors:
- dataTypes:
  - NordPassEventLogs_CL
  connectorId: NordPass
id: f72f630f-c890-49fe-b747-80f4fb3b6348
tactics:
- Impact
- Collection
queryPeriod: 10m
queryFrequency: 5m
entityMappings:
- entityType: Mailbox
  fieldMappings:
  - identifier: MailboxPrimaryAddress
    columnName: user_email
customDetails:
  ItemCount: total_items
  User: user_email
triggerOperator: gt
triggerThreshold: 0
severity: High
relevantTechniques:
- T1485
- T1074
incidentConfiguration:
  createIncident: false
kind: Scheduled
displayName: User deletes items in bulk
name: NordPass - User deletes items in bulk
description: |
  This will alert you if a user deletes items in bulk, namely, more than 10 items or in the span of 10 minutes. 
  If a mix of bulk and one-off deletions were performed, this will group all actions and report the total number of items deleted.

ARM