Elastic Security Detection Rules

CyberArk Privileged Access Security Error

Last updated 7 months ago on 2025-01-15
Created 4 years ago on 2021-06-23

About

Identifies the occurrence of a CyberArk Privileged Access Security (PAS) error level audit event. The event.code correlates to the CyberArk Vault Audit Action Code.
Tags
Data Source: CyberArk PASUse Case: Log AuditingUse Case: Threat DetectionTactic: Privilege EscalationLanguage: kuery
Severity
high
Risk Score
73
MITRE ATT&CK™

Privilege Escalation (TA0004)(opens in a new tab or window)

↳ Valid Accounts (T1078)(opens in a new tab or window)

Initial Access (TA0001)(opens in a new tab or window)

False Positive Examples
To tune this rule, add exceptions to exclude any event.code which should not trigger this rule.
License
Elastic License v2(opens in a new tab or window)

Definition

Rule Type
Query (Kibana Query Language)
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
filebeat-*logs-cyberarkpas.audit*
Related Integrations

cyberarkpas(opens in a new tab or window)

Query
event.dataset:cyberarkpas.audit and event.type:error

Install detection rules in Elastic Security

Detect CyberArk Privileged Access Security Error in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).