Sunturai
Back to results
HighMicrosoft Sentinel analytics

Uniqkey - Departing employee credential export

Correlates the archival, deletion or detachment of a Uniqkey employee account with data exports performed by that same employee during the preceding 14 days. An employee who exports credentials shortly before losing…

Description

Correlates the archival, deletion or detachment of a Uniqkey employee account with data exports performed by that same employee during the preceding 14 days. An employee who exports credentials shortly before losing access is a classic insider-risk scenario, and organization credentials touched by the export should be considered for rotation. The action filter matches the offboarding action identifiers from the Uniqkey audit-log catalog, with a name-based fallback for future action variants.

Detection logic

Detection requirements

Platform
IaaSLinuxmacOSWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source product
uniqkeyeventsconnector
Log source service
uniqkeyevents_cl

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice