Box Large Number of Permission Changes

AnalysisType: rule
Filename: box_user_permission_updates.py
RuleID: "Box.Large.Number.Permission.Updates"
DisplayName: "Box Large Number of Permission Changes"
Enabled: true
LogTypes:
  - Box.Event
Tags:
  - Box
  - Privilege Escalation:Abuse Elevation Control Mechanism
Reports:
  MITRE ATT&CK:
    - TA0004:T1548
Severity: Low
Description: >
  A user has exceeded the threshold for number of folder permission changes within a single time frame.
Reference: https://support.box.com/hc/en-us/articles/360043697254-Understanding-Folder-Permissions
Runbook: >
  Investigate whether this user's activity is expected.
SummaryAttributes:
  - ip_address
Threshold: 100
DedupPeriodMinutes: 60
Tests:
  - Name: Regular Event
    ExpectedResult: false
    Log:
      {
        "type": "event",
        "additional_details": '{"key": "value"}',
        "created_by":
          {
            "id": "12345678",
            "type": "user",
            "login": "cat@example",
            "name": "Bob Cat",
          },
        "event_type": "DELETE",
      }
  - Name: User Permission Change
    ExpectedResult: true
    Log:
      {
        "type": "event",
        "additional_details": '{"key": "value"}',
        "created_by":
          {
            "id": "12345678",
            "type": "user",
            "login": "cat@example",
            "name": "Bob Cat",
          },
        "event_type": "CHANGE_FOLDER_PERMISSION",
        "source":
          {
            "id": "12345678",
            "type": "user",
            "login": "user@example",
            "name": "Bob Cat",
          },
      }
  - Name: User Shares Item
    ExpectedResult: true
    Log:
      {
        "type": "event",
        "additional_details": '{"key": "value"}',
        "created_by":
          {
            "id": "12345678",
            "type": "user",
            "login": "cat@example",
            "name": "Bob Cat",
          },
        "event_type": "ITEM_SHARED_CREATE",
        "source":
          {
            "id": "12345678",
            "type": "user",
            "login": "user@example",
            "name": "Bob Cat",
          },
      }


# ------ paired body: box_user_permission_updates.py ------

PERMISSION_UPDATE_EVENT_TYPES = {
    "CHANGE_FOLDER_PERMISSION",
    "ITEM_SHARED_CREATE",
    "ITEM_SHARED",
    "SHARE",
}


def rule(event):
    return event.get("event_type") in PERMISSION_UPDATE_EVENT_TYPES


def title(event):
    return (
        f"User [{event.deep_get('created_by', 'login', default='<UNKNOWN_USER>')}]"
        f" exceeded threshold for number of permission changes in the configured time frame."
    )