Elastic Security Detection Rules

CyberArk Privileged Access Security Recommended Monitor

Last updated 5 months ago on 2025-01-15
Created 4 years ago on 2021-06-23

About

Identifies the occurrence of a CyberArk Privileged Access Security (PAS) non-error level audit event which is recommended for monitoring by the vendor. The event.code correlates to the CyberArk Vault Audit Action Code.
Tags
Data Source: CyberArk PASUse Case: Log AuditingUse Case: Threat DetectionTactic: Privilege EscalationLanguage: kuery
Severity
high
Risk Score
73
MITRE ATT&CK™

Privilege Escalation (TA0004)(opens in a new tab or window)

↳ Valid Accounts (T1078)(opens in a new tab or window)

Initial Access (TA0001)(opens in a new tab or window)

False Positive Examples
To tune this rule, add exceptions to exclude any event.code which should not trigger this rule.
License
Elastic License v2(opens in a new tab or window)

Definition

Rule Type
Query (Kibana Query Language)
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
filebeat-*logs-cyberarkpas.audit*
Related Integrations

cyberarkpas(opens in a new tab or window)

Query
event.dataset:cyberarkpas.audit and
  event.code:(4 or 22 or 24 or 31 or 38 or 57 or 60 or 130 or 295 or 300 or 302 or
              308 or 319 or 344 or 346 or 359 or 361 or 378 or 380 or 411) and
  not event.type:error

Install detection rules in Elastic Security

Detect CyberArk Privileged Access Security Recommended Monitor in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).