Microsoft Sentinel low experimental kql

F&O - Bank account change following network alias reassignment

Identifies changes to user accounts where the network alias was modified to a new value. Shortly afterwards, the updated alias is used to update a bank account number.

View Source

Detection Logic

let query_frequency = 15m;
FinanceOperationsActivity_CL
| where LogType == "Update" and TableName == "UserInfo"
| extend UserId = tostring(parse_json(tostring(FormattedData.["03::id"])).NewData)
| extend NetworkAlias = parse_json(tostring(FormattedData.networkAlias))
| extend
    CurrentAlias = tostring(NetworkAlias.NewData),
    PreviousAlias = tostring(NetworkAlias.OldData)
| where CurrentAlias != PreviousAlias
| extend
    AliasUpdated = LogCreatedDateTime,
    AliasChangedBy = Username
| join kind=inner(FinanceOperationsActivity_CL
| where TimeGenerated >= ago (query_frequency)
| where LogType == "Update" and TableName == "BankAccountTable"
| extend AccountId = tostring(parse_json(tostring(FormattedData.AccountID)).NewData)
| extend AccountNum = parse_json(tostring(FormattedData.AccountNum))
| extend
        CurrentAccountNum = tostring(AccountNum.NewData),
        OldAccountNum = tostring(AccountNum.OldData)
| where CurrentAccountNum != OldAccountNum
| extend BankUpdated = LogCreatedDateTime)
    on $left.UserId == $right.Username
| where BankUpdated > AliasUpdated
| extend
    FinOpsAppId = 32780,
    AccountName = tostring(split(CurrentAlias, "@")[0]),
    UPNSuffix = tostring(split(CurrentAlias, "@")[1])
| project
    AliasUpdated,
    AliasChangedBy,
    Username,
    AccountId,
    CurrentAccountNum,
    OldAccountNum,
    CurrentAlias,
    PreviousAlias,
    FinOpsAppId,
    AccountName,
    UPNSuffix

Field Validations

Loading…

Comments (0)

Loading comments...