ZIA Cloud Account Created

Description

This rule detects when new cloud account was created.

Query · python

from panther_zscaler_helpers import zia_alert_context, zia_success


def rule(event):
    if not zia_success(event):
        return False
    action = event.deep_get("event", "action", default="ACTION_NOT_FOUND")
    category = event.deep_get("event", "category", default="CATEGORY_NOT_FOUND")
    role_name = event.deep_get(
        "event", "postaction", "role", "name", default="<ROLE_NAME_NOT_FOUND>"
    ).lower()
    if (
        action == "CREATE"
        and category == "ADMINISTRATOR_MANAGEMENT"
        and ("admin" in role_name or "audit" in role_name)
    ):
        return True
    return False


def title(event):
    return (
        f"[Zscaler.ZIA]: New admin role was created by admin with id "
        f"[{event.deep_get('event', 'adminid', default='<ADMIN_ID_NOT_FOUND>')}]"
    )


def alert_context(event):
    return zia_alert_context(event)

Analyst notes

Verify that this change was planned. If not, revert the change and ensure this doesn't happen again.

Raw source ZIA Cloud Account Created · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
RuleID: ZIA.Cloud.Account.Created
Description: This rule detects when new cloud account was created.
DisplayName: ZIA Cloud Account Created
Runbook: Verify that this change was planned. If not, revert the change and ensure this doesn't happen again.
Reference: https://help.zscaler.com/zia/choosing-provisioning-and-authentication-methods
Enabled: true
Filename: zia_create_cloud_account.py
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0003:T1136.003 # Persistence: Create Cloud Account
LogTypes:
  - Zscaler.ZIA.AdminAuditLog
DedupPeriodMinutes: 60
Threshold: 1
Tests:
  - Name: Administration > User Management > Add User, Service Admin group
    ExpectedResult: false
    Log:
      {
        "event": {
          "action": "CREATE",
          "adminid": "admin@16991311.zscalerbeta.net",
          "auditlogtype": "ZIA",
          "category": "USER_MANAGEMENT",
          "clientip": "123.123.123.123",
          "errorcode": "None",
          "interface": "UI",
          "postaction": {
            "department": {
              "id": 16991313,
              "isDeleted": false,
              "isForUnauthenticatedUser": false,
              "isNonEditable": true,
              "name": "Service Admin"
            },
            "email": "johndoe@dev-company.com",
            "groups": [
              {
                "id": 16991312,
                "isNonEditable": true,
                "name": "Service Admin"
              }
            ],
            "id": 19752821,
            "miscflags": 0,
            "name": "johndoe",
            "password": "*****",
            "systemDefinedGroups": []
          },
          "preaction": {
            "department": {
              "id": 16991313,
              "isDeleted": false,
              "isForUnauthenticatedUser": false,
              "isNonEditable": true,
              "name": "Service Admin"
            },
            "email": "johndoe@dev-company.com",
            "groups": [
              {
                "id": 16991312,
                "isNonEditable": true,
                "name": "Service Admin"
              }
            ],
            "id": 19752821,
            "miscflags": 0,
            "name": "johndoe",
            "password": "*****",
            "systemDefinedGroups": []
          },
          "recordid": "321",
          "resource": "johndoe",
          "result": "SUCCESS",
          "subcategory": "USER",
          "time": "2024-10-22 21:57:58.000000000"
        },
        "sourcetype": "zscalernss-audit"
      }
  - Name: Administration Management > Administrators > Add Administrator
    ExpectedResult: true
    Log:
      {
        "event": {
          "action": "CREATE",
          "adminid": "admin@16991311.zscalerbeta.net",
          "auditlogtype": "ZIA",
          "category": "ADMINISTRATOR_MANAGEMENT",
          "clientip": "123.123.123.123",
          "errorcode": "None",
          "interface": "UI",
          "postaction": {
            "adminScope": {
              "scopeEntities": [],
              "scopeGroupMemberEntities": [],
              "type": "ORGANIZATION"
            },
            "disabled": false,
            "email": "ajohndoe@company.com",
            "id": 19752821,
            "isExecMobileAppEnabled": true,
            "isPasswordLoginAllowed": true,
            "loginName": "johndoe@dev-company.com",
            "pwdLastModifiedTime": 1729634767,
            "role": {
              "deleted": false,
              "extensions": {
                "adminRank": "0",
                "roleType": "EXEC_INSIGHT_AND_ORG_ADMIN"
              },
              "id": 24354,
              "isNameL10nTag": true,
              "name": "Super Admin"
            },
            "userName": "johndoe1123"
          },
          "preaction": {
            "adminScope": {
              "scopeEntities": [],
              "scopeGroupMemberEntities": [],
              "type": "ORGANIZATION"
            },
            "disabled": false,
            "email": "johndoe@company.com",
            "id": 0,
            "isAuditor": false,
            "isDefaultAdmin": false,
            "isExecMobileAppEnabled": true,
            "isPasswordExpired": false,
            "isPasswordLoginAllowed": true,
            "loginName": "johndoe@dev-company.com",
            "newLocationCreateAllowed": false,
            "password": "*****",
            "pwdLastModifiedTime": 0,
            "role": {
              "deleted": false,
              "id": 24354,
              "isNameL10nTag": false,
              "name": "Super Admin"
            },
            "userName": "johndoe1123"
          },
          "recordid": "326",
          "resource": "johndoe1123",
          "result": "SUCCESS",
          "subcategory": "ADMINISTRATOR_ADMIN_USER",
          "time": "2024-10-22 22:06:04.000000000"
        },
        "sourcetype": "zscalernss-audit"
      }
  - Name: Administration Management  > Auditors > Add Auditor
    ExpectedResult: true
    Log:
      {
        "event": {
          "action": "CREATE",
          "adminid": "admin@16991311.zscalerbeta.net",
          "auditlogtype": "ZIA",
          "category": "ADMINISTRATOR_MANAGEMENT",
          "clientip": "123.123.123.123",
          "errorcode": "None",
          "interface": "UI",
          "postaction": {
            "disabled": false,
            "id": 19752860,
            "isAuditor": true,
            "loginName": "arieeel@dev-company.com",
            "newLocationCreateAllowed": false,
            "pwdLastModifiedTime": 0,
            "role": {
              "deleted": false,
              "id": 30510,
              "isNameL10nTag": false,
              "name": "Auditor"
            },
            "userName": "areiiiel"
          },
          "preaction": {
            "adminScope": {
              "scopeEntities": [],
              "scopeGroupMemberEntities": [],
              "type": "ORGANIZATION"
            },
            "disabled": false,
            "id": 0,
            "isAuditor": true,
            "loginName": "arieeel@dev-company.com",
            "newLocationCreateAllowed": false,
            "password": "*****",
            "pwdLastModifiedTime": 0,
            "userName": "areiiiel"
          },
          "recordid": "328",
          "resource": "areiiiel",
          "result": "SUCCESS",
          "subcategory": "ADMINISTRATOR_AUDITOR",
          "time": "2024-10-22 22:10:28.000000000"
        },
        "sourcetype": "zscalernss-audit"
      }


# ------ paired body: zia_create_cloud_account.py ------

from panther_zscaler_helpers import zia_alert_context, zia_success


def rule(event):
    if not zia_success(event):
        return False
    action = event.deep_get("event", "action", default="ACTION_NOT_FOUND")
    category = event.deep_get("event", "category", default="CATEGORY_NOT_FOUND")
    role_name = event.deep_get(
        "event", "postaction", "role", "name", default="<ROLE_NAME_NOT_FOUND>"
    ).lower()
    if (
        action == "CREATE"
        and category == "ADMINISTRATOR_MANAGEMENT"
        and ("admin" in role_name or "audit" in role_name)
    ):
        return True
    return False


def title(event):
    return (
        f"[Zscaler.ZIA]: New admin role was created by admin with id "
        f"[{event.deep_get('event', 'adminid', default='<ADMIN_ID_NOT_FOUND>')}]"
    )


def alert_context(event):
    return zia_alert_context(event)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.