Detection rules › Kusto
CTE - Enrollment Token Generated
An enrollment token was generated for onboarding a new device.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence |
Rule body
id: 0be1ebaf-36f8-49a6-a3b6-56491ccfda7f
name: CTE - Enrollment Token Generated
description: |
An enrollment token was generated for onboarding a new device.
severity: Informational
requiredDataConnectors:
- connectorId: cybereinforce_cte
dataTypes:
- CybereinforceCTE_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- Persistence
relevantTechniques:
- T1098
query: |
CybereinforceCTE_CL
| where EventType == "token.generated"
| extend AccountName = tostring(split(Actor, "@")[0]), UPNSuffix = tostring(split(Actor, "@")[1])
| project TimeGenerated, TenantId, Actor, AccountName, UPNSuffix, Severity, Category, Source
entityMappings:
- entityType: Account
fieldMappings:
- identifier: Name
columnName: AccountName
- identifier: UPNSuffix
columnName: UPNSuffix
version: 1.0.0
kind: Scheduled
Stages and Predicates
Stage 1: source
CybereinforceCTE_CL
Stage 2: where
| where EventType == "token.generated"
Stage 3: extend
| extend AccountName = tostring(split(Actor, "@")[0]), UPNSuffix = tostring(split(Actor, "@")[1])
Stage 4: project
| project TimeGenerated, TenantId, Actor, AccountName, UPNSuffix, Severity, Category, Source
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventType | eq |
| field:"EventType" kind:eq value:"token.generated" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
AccountName | project |
Actor | project |
Category | project |
Severity | project |
Source | project |
TenantId | project |
TimeGenerated | project |
UPNSuffix | project |