sap_account_unlocked_then_used_from_same_ip

rule sap_account_unlocked_then_used_from_same_ip {

  meta:
    author = "Google Cloud Security"
    description = "An account was unlocked and then authenticated from the same IP as the account that unlocked it"
    severity = "High"
    tactic = "TA0004"
    technique = "T1098"

  events:
    $unlock.metadata.log_type = /^SAP/ nocase

    //unlock event
    $unlock.additional.fields["msg_1"] = "AUA"

    $unlock.principal.ip != ""
    $unlock.principal.ip = $ip

    $unlock.principal.user.userid = $unlocking_user

    $unlock.additional.fields["param1_1"] = $target_user

    $unlock.target.application = $system_id

    //identify login event
    (
      $login.additional.fields["msg_1"] = "AU1" or
      $login.additional.fields["msg_1"] = "AU5"
    )
    $login.principal.ip != ""
    $login.principal.ip = $ip
    $login.principal.user.userid = $target_user
    $login.target.application = $system_id

    //exclude a user unlocking their own account
    $unlocking_user != $target_user

  match:
    $ip, $target_user, $system_id over 30m

  outcome:
    $risk_score = 75
    $source_user = array_distinct($unlock.principal.user.userid)
    $unlock_description = array_distinct($unlock.security_result.summary)
    $login_description = array_distinct($login.security_result.summary)
    $instance = array_distinct($unlock.target.resource.name)
    $host = array_distinct($unlock.principal.asset.hostname)
    $email_who_unlocked = array_distinct($unlock.principal.user.email_addresses)
    $email_who_was_unlocked = array_distinct($login.principal.user.email_addresses)

  condition:
    $unlock and $login
}