Notion Login WITH AccountChange

Description

A Notion User logged in then changed their account details.

Query

Detection:
    - Group:
        - ID: Login
          RuleID: Notion.Login
        - ID: AccountChange
          RuleID: Notion.AccountChange
      MatchCriteria:
        field_name:
          - GroupID: Login
            Match: p_alert_context.actor_id
          - GroupID: AccountChange
            Match: p_alert_context.actor_id
      LookbackWindowMinutes: 1800
      Schedule:
        RateMinutes: 1440
        TimeoutMinutes: 5

Rule dependencies

⚠ Higher-order rule. It fires on other rules' alerts, not on raw events, so it cannot fire on its own. Deploy the rules it depends on too.

Depends on

Analyst notes

Possible account takeover. Follow up with the Notion User to determine if this email change is genuine.

Raw source Notion Login WITH AccountChange · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: correlation_rule
RuleID: "Notion.Login.WITH.AccountChange"
DisplayName: "Notion Login WITH AccountChange"
Enabled: false
Severity: Medium
Description: A Notion User logged in then changed their account details.
Reference: https://www.notion.so/help/account-settings
Runbook: Possible account takeover. Follow up with the Notion User to determine if this email change is genuine.
Reports:
  MITRE ATT&CK:
    - TA0004:T1098  # Account Manipulation
Detection:
    - Group:
        - ID: Login
          RuleID: Notion.Login
        - ID: AccountChange
          RuleID: Notion.AccountChange
      MatchCriteria:
        field_name:
          - GroupID: Login
            Match: p_alert_context.actor_id
          - GroupID: AccountChange
            Match: p_alert_context.actor_id
      LookbackWindowMinutes: 1800
      Schedule:
        RateMinutes: 1440
        TimeoutMinutes: 5
Tests:
    - Name: Login, Followed By AccountChange within short time
      ExpectedResult: true
      RuleOutputs:
        - ID: Login
          Matches:
            p_alert_context.actor_id:
              'i-abcdef0123456789a':
                - "2024-06-01T10:00:01Z"
        - ID: AccountChange
          Matches:
            p_alert_context.actor_id:
              'i-abcdef0123456789a':
                - "2024-06-01T10:01:01Z"
    - Name: Login, Followed By AccountChange not within short time
      ExpectedResult: false
      RuleOutputs:
        - ID: Login
          Matches:
            p_alert_context.actor_id:
              'i-abcdef0123456789a':
                - "2024-06-01T10:00:01Z"
        - ID: AccountChange
          Matches:
            p_alert_context.actor_id:
              'i-abcdef0123456789a':
                - "2024-06-03T10:01:01Z"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.