Microsoft Sentinel high experimental kql

SAP BTP - Cloud Integration access policy tampering

Identifies changes to access policies in SAP Cloud Integration. Access policies control authorization for integration artifacts, defining which users and roles can access specific integration flows and related content. Unauthorized access policy manipulation could indicate: - Attacker granting themselves access to sensitive integration artifacts - Removal of security controls to enable further malicious activity - Defense evasion by modifying artifact references to hide unauthorized access

View Source

Detection Logic

let accessPolicyTypes = dynamic(["Access Policy", "Artifact Reference"]);
let monitoredActions = dynamic(["Create", "Change", "Delete"]);
SAPBTPAuditLog_CL
| where Category == "audit.security-events"
| extend data_s = tostring(Message.data),
         ipAddress = tostring(Message.ip)
| extend parsedData = parse_json(data_s)
| extend action = tostring(parsedData.action),
         objectType = tostring(parsedData.objectType),
         objectId = tostring(parsedData.objectId),
         policyMessage = tostring(parsedData.attributes.message)
| where objectType in (accessPolicyTypes)
| where action in (monitoredActions)
| extend normalizedAction = case(
    action == "Create", "created",
    action == "Change", "modified",
    action == "Delete", "deleted",
    action
)
| extend MessageText = case(
    objectType == "Access Policy", strcat("Access policy '", objectId, "' was ", normalizedAction),
    objectType == "Artifact Reference", strcat("Artifact reference '", objectId, "' was ", normalizedAction),
    strcat(objectType, " '", objectId, "' was ", normalizedAction)
)
| project
    UpdatedOn,
    UserName,
    MessageText,
    ObjectType = objectType,
    ObjectId = objectId,
    Action = action,
    PolicyMessage = policyMessage,
    Tenant,
    ipAddress,
    CloudApp = "SAP Cloud Integration"
| extend AccountName = split(UserName, "@")[0], UPNSuffix = split(UserName, "@")[1]

Field Validations

Loading…

Comments (0)

Loading comments...