↳ GitHub sourceAnalytics ruleMedium

Uniqkey - Credential export from newly created account

Description

Detects a data export performed by an employee whose Uniqkey account was created or activated within the preceding 14 days. A freshly provisioned account has little legitimate reason to export organization credentials, so this pattern can indicate a compromised onboarding flow or an account created specifically to stage exfiltration. The action filter matches the provisioning action identifiers from the Uniqkey audit-log catalog, with a name-based fallback for future action variants.

Rule type: Scheduled
Version: 1.0.0
Query frequency: 1h
Query period: 14d
Trigger: gt 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

UniqkeyEventsConnector

Data types

UniqkeyEvents_CL

KQL query

Original query, unchanged.

let lookback = 14d;
let frequency = 1h;
let provisioningActionIds = dynamic([
    "eb7dea42-df3a-44c6-808d-94b7fc46dde9", // Create employee account
    "263c44a2-2075-46bd-949d-aa828517a3d1", // Link employee account
    "4ed5b3be-d1b1-4447-af32-9ae2f1c090c7", // Activate employee
    "e494db5c-b135-441c-8fa3-6e5ad94d05f8", // Activate employee account
    "a652e6df-5a3c-438b-afde-198cd62e8491", // Activated account
    "c7d4f9b2-5e3a-4f8c-9b6d-2e7a1c8d5f3b", // Activate SSO employee
    "3cc88450-39ef-472e-9e0c-06ad7c9af257", // Process new employee
    "c9ebd265-3c60-4228-b948-863c8134d29c", // Approve process new employee
    "1b6c2121-00cc-40fe-9ea4-01f6dd085c34"  // Approve process invite employee
]);
let newAccounts =
    UniqkeyEvents_CL
    | where TimeGenerated > ago(lookback)
    | where Category == "account_management"
    | where tolower(ActionId) in (provisioningActionIds) or Action has_any ("create", "invite", "activate", "link")
    | where TargetType == "employee"
    | project CreationTime = TimeGenerated, CreationAction = Action, NewEmployeeId = TargetId, NewEmployeeName = TargetName;
UniqkeyEvents_CL
| where TimeGenerated > ago(frequency)
| where Category == "data_export"
| join kind=inner newAccounts on $left.ActorId == $right.NewEmployeeId
| where TimeGenerated > CreationTime
| project TimeGenerated, ActorEmail, ActorType, Action, TargetType, TargetName, SrcIpAddr, CreationTime, CreationAction, NewEmployeeName

Declared entities

AccountIP

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Uniqkey/Analytic Rules/Uniqkey - Credential export from newly created account.yaml ↗
Commit: 9800e51 ↗
Source identifier: 3939f01f-9563-4cd3-8423-97a82e82719b

Additional source files 2

Solutions/Uniqkey/Analytic Rules/Uniqkey - Credential export from newly created account.yamlsource ↗Solutions/Uniqkey/Data/Solution_Uniqkey.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.