F&O - Bank account change following network alias reassignment

Identifies changes to user accounts where the network alias was modified to a new value. Shortly afterwards, the updated alias is used to update a bank account number.

Detection logic

Detection requirements

Platform: Containers ESXi IaaS Identity Provider Linux macOS Network Devices None Office Suite SaaS Windows
The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.
Log source product: dynamics365finance
Log source service: financeoperationsactivity_cl

Detection rules

F&O - Bank account change following network alias reassignment

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules