Users searching for VIP user activity

Back


Id	f7f4a77e-f68f-4b56-9aaf-a0c9d87d7a8e
Rulename	Users searching for VIP user activity
Description	This query monitors for users running Log Analytics queries that contain filters for specific, defined VIP user accounts or the VIPUser watchlist template. Use this detection to alert for users specifically searching for activity of sensitive users.
Severity	Low
Tactics	Collection Exfiltration
Techniques	T1530 T1213 T1020
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Detections/LAQueryLogs/UserSearchingForVIPUserActivity.yaml
Version	1.1.4
Arm template	f7f4a77e-f68f-4b56-9aaf-a0c9d87d7a8e.json

KQL

// Replace these with the username or emails of your VIP users you wish to monitor for.
let vips = dynamic(['vip1@email.com','vip2@email.com']);
// Add users who are allowed to conduct these searches - this could be specific SOC team members
let allowed_users = dynamic([]);
LAQueryLogs
| where QueryText has_any (vips) or QueryText has_any ('_GetWatchlist("VIPUsers")', "_GetWatchlist('VIPUsers')")
| where AADEmail !in (allowed_users)
| project TimeGenerated, AADEmail, RequestClientApp, QueryText, ResponseRowCount, RequestTarget
| extend timestamp = TimeGenerated, AccountName = tostring(split(AADEmail, "@")[0]), AccountUPNSuffix = tostring(split(AADEmail, "@")[1])

YAML

queryFrequency: 1d
kind: Scheduled
version: 1.1.4
relevantTechniques:
- T1530
- T1213
- T1020
triggerOperator: gt
metadata:
  categories:
    domains:
    - Security - Others
  author:
    name: Microsoft Security Research
  support:
    tier: Community
  source:
    kind: Community
requiredDataConnectors: []
id: f7f4a77e-f68f-4b56-9aaf-a0c9d87d7a8e
name: Users searching for VIP user activity
query: |
  // Replace these with the username or emails of your VIP users you wish to monitor for.
  let vips = dynamic(['vip1@email.com','vip2@email.com']);
  // Add users who are allowed to conduct these searches - this could be specific SOC team members
  let allowed_users = dynamic([]);
  LAQueryLogs
  | where QueryText has_any (vips) or QueryText has_any ('_GetWatchlist("VIPUsers")', "_GetWatchlist('VIPUsers')")
  | where AADEmail !in (allowed_users)
  | project TimeGenerated, AADEmail, RequestClientApp, QueryText, ResponseRowCount, RequestTarget
  | extend timestamp = TimeGenerated, AccountName = tostring(split(AADEmail, "@")[0]), AccountUPNSuffix = tostring(split(AADEmail, "@")[1])  
queryPeriod: 1d
triggerThreshold: 0
description: |
  This query monitors for users running Log Analytics queries that contain filters for specific, defined VIP user accounts or the VIPUser watchlist template.
  Use this detection to alert for users specifically searching for activity of sensitive users.  
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountName
  - identifier: UPNSuffix
    columnName: AccountUPNSuffix
- entityType: AzureResource
  fieldMappings:
  - identifier: ResourceId
    columnName: RequestTarget
severity: Low
tactics:
- Collection
- Exfiltration
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/LAQueryLogs/UserSearchingForVIPUserActivity.yaml

ARM