Zendesk

Panther #

• Admin Role Assigned source medium: Assigning an admin role manually could be a sign of privilege escalationT1078
• Enabled Zendesk Support to Assume Users source medium: User enabled or disabled zendesk support user assumption.T1550
• GreyNoise V3 Malicious IP Activity source high: Detects when an IP address in any log event is classified as malicious or unknown by GreyNoise V3 internet scanner intelligence. Known business services and benign IPs are excluded.T1595.001
• GTI/VirusTotal Threat Intelligence Indicator Match source high: Detects when an IP address, domain, or file hash in any log event matches a known malicious indicator from Google Threat Intelligence (GTI) / VirusTotal enrichment. Severity is elevated based on GTI's threat severity verdict and the number of vendors flagging the indicator as malicious.T1595.001
• MFA Disabled source high: Detects when Multi-Factor Authentication (MFA) is disabledT1556
• OTX Threat Intelligence Indicator Match source high: Detects when an IP address in any log event matches a known threat indicator from AlienVault OTX pulse intelligence. Severity is elevated when the pulse includes a named adversary or known malware families.T1595.001
• Sign In from Rogue State source medium: Detects when an entity signs in from a nation associated with cyber attacksT1078.004
• Zendesk Account Owner Changed source high: Only one admin user can be the account owner. Ensure the change in ownership is expected.T1078
• Zendesk API Token Created source high: A user created a new API token to be used with Zendesk.T1528
• Zendesk Credit Card Redaction Off source high: A user updated account setting that disabled credit card redaction.T1213