sap_btp_workzone_role_collection_tampering

rule sap_btp_workzone_role_collection_tampering {

  meta:
    author = "Google Cloud Security"
    description = "A Build Work Zone role was added to or removed from a BTP role collection"
    severity = "High"
    tactic = "TA0004"
    technique = "T1098.003"

  events:
    $e.metadata.log_type = "SAP_BTP"

    $e.security_result.detection_fields["object_id_tableName"] = "xsrolecollection2role" nocase
    $e.security_result.detection_fields["object_id_role_roletemplate_app_appid"] = /portal-cf-service/ nocase

    $tenant = $e.security_result.detection_fields["tenant"]
    $user = strings.coalesce($e.principal.user.user_display_name, $e.principal.user.userid)

    not $e.principal.user.userid            = /^sb-/ nocase
    not $e.principal.user.user_display_name = /^sb-/ nocase

  match:
    $user, $tenant over 1h

  outcome:
    $risk_score = max(if($e.security_result.detection_fields["object_id_role_name"] = /admin|super/ nocase, 95, 80))
    $crud_type = array_distinct($e.security_result.detection_fields["object_id_crudType"])
    $role_name = array_distinct($e.security_result.detection_fields["object_id_role_name"])
    $role_collection = array_distinct($e.security_result.detection_fields["object_id_rolecollection_name"])
    $role_app_id = array_distinct($e.security_result.detection_fields["object_id_role_roletemplate_app_appid"])
    $mapping_changes = count_distinct($e.security_result.detection_fields["message_uuid"])

  condition:
    $e
}