Crowdstrike API Key Deleted

Description

A user deleted an API Key in CrowdStrike

Query · python

from panther_crowdstrike_event_streams_helpers import cs_alert_context


def rule(event):
    return all(
        [
            event.deep_get("event", "OperationName") == "DeleteAPIClients",
            event.deep_get("event", "Success"),
        ]
    )


def title(event):
    user = event.deep_get("event", "UserId")
    service = event.deep_get("event", "ServiceName")
    return f"{user} deleted an API key in {service}"


def alert_context(event):
    return cs_alert_context(event)

Analyst notes

Validate this action was authorized.

Raw source Crowdstrike API Key Deleted · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Filename: crowdstrike_api_key_deleted.py
RuleID: "Crowdstrike.API.Key.Deleted"
DisplayName: "Crowdstrike API Key Deleted"
Reports:
    MITRE ATT&CK:
        - TA0040:T1531 # Account Access Removal
        - TA0005:T1070 # Indicator Removal
Enabled: true
LogTypes:
  - Crowdstrike.EventStreams
Severity: Medium
Description: A user deleted an API Key in CrowdStrike
DedupPeriodMinutes: 60
Threshold: 1
Runbook: Validate this action was authorized.
Tests:
  - Name: API Key Deleted
    ExpectedResult: true
    Log:
      event:
          AuditKeyValues:
              - Key: scope(s)
                ValueString: alerts:read,api-integrations:read
              - Key: actor_user
                ValueString: tester@panther.com
              - Key: actor_user_uuid
                ValueString: a11a1111-1a11-1a1a-1a11-a11a111a111a
              - Key: actor_cid
                ValueString: aaa111111111111111aaaaaa11a11a11
              - Key: trace_id
                ValueString: 1a111111-a1a1-111a-11aa-a111111a1a1a
              - Key: APIClientID
                ValueString: aaa1a11aaa111a1a11a11aaaa1aa1a11
              - Key: id
                ValueString: aaa1a11aaa111a1a11a11aaaa1aa1a11
              - Key: name
                ValueString: key name
          OperationName: DeleteAPIClients
          ServiceName: Crowdstrike API Client
          Success: true
          UTCTimestamp: "2024-07-08 14:01:54.000000000"
          UserId: tester@panther.com
          UserIp: 11.1.111.11
      metadata:
          customerIDString: aaa111111111111111aaaaaa11a11a11
          eventCreationTime: "2024-07-08 14:01:54.451000000"
          eventType: AuthActivityAuditEvent
          offset: 111111
          version: "1.0"
  - Name: API Key Delete failed
    ExpectedResult: false
    Log:
      event:
          AuditKeyValues:
              - Key: scope(s)
                ValueString: alerts:read,api-integrations:read
              - Key: actor_user
                ValueString: tester@panther.com
              - Key: actor_user_uuid
                ValueString: a11a1111-1a11-1a1a-1a11-a11a111a111a
              - Key: actor_cid
                ValueString: aaa111111111111111aaaaaa11a11a11
              - Key: trace_id
                ValueString: 1a111111-a1a1-111a-11aa-a111111a1a1a
              - Key: APIClientID
                ValueString: aaa1a11aaa111a1a11a11aaaa1aa1a11
              - Key: id
                ValueString: aaa1a11aaa111a1a11a11aaaa1aa1a11
              - Key: name
                ValueString: key name
          OperationName: DeleteAPIClients
          ServiceName: Crowdstrike API Client
          Success: false
          UTCTimestamp: "2024-07-08 14:01:54.000000000"
          UserId: tester@panther.com
          UserIp: 11.1.111.11
      metadata:
          customerIDString: aaa111111111111111aaaaaa11a11a11
          eventCreationTime: "2024-07-08 14:01:54.451000000"
          eventType: AuthActivityAuditEvent
          offset: 111111
          version: "1.0"


# ------ paired body: crowdstrike_api_key_deleted.py ------

from panther_crowdstrike_event_streams_helpers import cs_alert_context


def rule(event):
    return all(
        [
            event.deep_get("event", "OperationName") == "DeleteAPIClients",
            event.deep_get("event", "Success"),
        ]
    )


def title(event):
    user = event.deep_get("event", "UserId")
    service = event.deep_get("event", "ServiceName")
    return f"{user} deleted an API key in {service}"


def alert_context(event):
    return cs_alert_context(event)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.