sap_credential_reset_followed_by_use_from_shared_ip

rule sap_credential_reset_followed_by_use_from_shared_ip {

  meta:
    author = "Google Cloud Security"
    description = "A privileged account's credentials were reset and then used from an IP the resetting account had also used"
    severity = "High"
    tactic = "TA0004"
    technique = "T1098"

events:
    $mod.metadata.log_type = "SAP_SECURITY_AUDIT"

    (
      (
        $mod.additional.fields["msg_1"] = "BU2" and
        $changed_user = $mod.additional.fields["param2_1"]
      ) or (
        $mod.additional.fields["msg_1"] = "AUD" and
        $changed_user = $mod.additional.fields["param1_1"]
      )
    )

    $actor = $mod.principal.user.userid
    $actor != $changed_user
    $sid = $mod.target.application

    $client = $mod.target.resource.attribute.labels["slgmand_1"]

    not $actor in %SAP_ChangeUserMasterDataExcludedUsers.userid

    $changed_user in %sap_admin_users.user

    // the actor logging on
    $login_actor.metadata.log_type = "SAP_SECURITY_AUDIT"
    $login_actor.additional.fields["msg_1"] = /^(AU1|AU5)$/
    $actor = $login_actor.principal.user.userid
    $shared_ip = $login_actor.principal.ip
    $sid = $login_actor.target.application
    $client = $login_actor.target.resource.attribute.labels["slgmand_1"]

    // the changed user logging on from the same IP
    $login_changed.metadata.log_type = "SAP_SECURITY_AUDIT"
    $login_changed.additional.fields["msg_1"] = /^(AU1|AU5)$/
    $changed_user = $login_changed.principal.user.userid
    $shared_ip = $login_changed.principal.ip
    $sid = $login_changed.target.application
    $client = $login_changed.target.resource.attribute.labels["slgmand_1"]

  match:
    $actor, $changed_user, $sid, $client, $shared_ip over 48h after $mod

  outcome:
    $risk_score = 85
    $source_actor = array_distinct($actor)
    $changed_user_final = array_distinct($changed_user)
    $target_sid = array_distinct($sid)
    $sap_client = array_distinct($client)
    $shared_terminal_ip = array_distinct($shared_ip)
    $log_description = array_distinct($mod.metadata.description)
    $instance = array_distinct($mod.target.resource.name)

  condition:
    $mod and $login_actor and $login_changed
}